DSPT Evidence: a patching schedule (or IT supplier confirmation of automatic patching), plus the run
record. Re-verified 2026-10-13 — the previous version of this page described watchtower as the
container update mechanism; it was retired deliberately (it auto-updated latest tags without review) so
the control as written did not exist. Corrected below.
unattended-upgrades applies security-repository patches daily on the primary and the app engine.
Verified in /etc/apt/apt.conf.d/20auto-upgrades (Unattended-Upgrade "1"), with the
apt-daily-upgrade.timer active on each host.
/opt/security-scanner-scripts/patch_monthly.sh --apply --reboot runs on the primary at 02:00 on the
1st of each month: applies OS updates, runs the image scans, pushes results to DefectDojo, and schedules a
reboot when one is required. Logs to /var/log/patching/ (cron.log, summary.log).
Recent runs (all completed, each scheduling a reboot where needed): 2026-06-01 (3 applied), 2026-07-01
(17), 2026-08-01 (15), 2026-09-01 (101), 2026-10-01 (43). Recorded in
Patching Log.
App engine: added 2026-10-13 — patch-host.sh --apply --reboot at 03:00 on the 1st
(patch-monthly.timer, Persistent=true). Auxiliary host (ERPNext): added the same day at 04:30,
same script, same unit file with a per-host slot drop-in; its containers were confirmed
restart=unless-stopped before the reboot step was enabled. The three slots are staggered deliberately so
no two hosts patch at the same minute. See
Software Patching — Assessment & Recommendations.
Images are pinned by digest. There is no automatic image updater: watchtower was retired, and no
pull/update units exist on either host. Image updates are therefore a deliberate, reviewed action —
compose pull then up -d per stack, following
Container Image Upgrade — Remediation Guide, with the
previous container kept for 48 hours as a rollback path.
Consequence, stated honestly: an image only moves when someone upgrades it. The weekly scan below is
what detects that an image needs it; the oldest images in use are minio (over 12 months), wikijs,
keycloak and the four aes-service images (around five months).
Refresh cadence (set 2026-10-13): quarterly — the first Saturday of January, April, July and October at
03:30, per stack, driven by the weekly Trivy result, via
refresh-image.sh <compose-dir> <service> (report-only until --apply: it resolves the upstream digest,
bumps the pin, pulls and recreates, then prints the log line). Rollback is reverting the pin and up -d,
with the previous image left in the local store. Each refresh is recorded in the
Patching Log.
| Scan | Cadence | Script / output |
|---|---|---|
| Container images (Trivy) | weekly, Sat 03:00 and Sun 03:00 | scan_trivy.sh, scan_trivy_weekly.sh → /var/log/security-scanner/, pushed to DefectDojo |
| Host and Docker-network enumeration (nmap) | weekly, Sun 03:30 | scan_nmap.sh |
| Web application DAST (ZAP) | first Sunday, 04:00 | scan_zap.sh |
| Host hardening audit (Lynis) | weekly, Sun 06:30 | report at /var/log/lynis-report.dat |
Findings land in DefectDojo (security.veripath.co.uk/dojo/) and the security dashboard; critical and
high severity findings are remediated through the guide above.
When a scan reports vulnerabilities:
Worked example (24 May 2026): nginx:1.25 → nginx:stable reduced total findings by 94% (465 → 29)
and eliminated all criticals (16 → 0).
| Claim | Where the evidence is |
|---|---|
| A schedule exists and is met | /var/log/patching/cron.log + summary.log (primary), Patching Log |
| Every run is recorded automatically | the app's maintenance view (/infrastructure/maintenance/) — filterable, with CSV export, fed by the scripts that perform the work; Patching Log holds the cadence and the pre-2026-10-13 history |
| Job definitions are controlled | veripath-ops — scripts/patch-host.sh, scripts/refresh-image.sh, systemd/patch-monthly.{service,timer} |
| Automatic daily security patching | /etc/apt/apt.conf.d/20auto-upgrades on each host; apt-daily-upgrade.timer active |
| Reboots are applied | the monthly run's reboot step; outstanding reboots are listed as open items rather than omitted |
| Vulnerabilities are found and tracked | weekly Trivy / nmap / Lynis, monthly ZAP, all reporting to DefectDojo |
| Image updates are controlled | images pinned by digest, scheduled quarterly refresh, digest-pin rollback — not an auto-updater |