Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm running a small (but growing) Linux environment comprising of no more than 10 Linux servers.

The environment consists of CentOS 5 & 6, and Oracle Linux 5 & 6 boxen. All of these are patched individually via their appropriate yum repos.

Can anyone suggest a method of centralising patch management for these servers? I've heard that Puppet is often used to do this but I've never used it myself, and would be interested in hearing from other system administrators.

share

locked by Chris S Jun 17 '13 at 3:23

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

4 Answers 4

up vote 7 down vote accepted

Most Configuration Management tools are really good at this. puppet and Chef being two of the most popular, and radmind being the one I use.
The documentation for the specific tool will give you an idea of how to implement patch management -- it does vary from tool to tool.

Other options include a centralized yum/apt/whatever repository and homegrown scripts to pull patches from it at scheduled intervals (or on demand), and there are also commercial solutions from some major vendors, some of which (like RedHat's RHN Satellite) are quite excellent if you spend the time learning how they work and really take advantage of their capabilities.


One item nobody has pointed out yet that I feel bears noting is homogeny -- to the extent possible, make your servers interchangeable cogs running the same software. This greatly simplifies patch management (the same patches have to go everywhere) and IMHO makes life a lot easier as your environment grows.

share
    
Puppet and Chef look complex but interesting, and I'm going to give them a look. I'll mark your answer as my accepted answer as it a) supports the clients and specified in my question OOTB and b) seems the most comprehensive. –  leftcase May 10 '12 at 20:45
    
Puppet and Chef are fairly complex but the stuff you need to know to get started is pretty low on the learning curve. By the time you get into really complicated stuff you'll be glad you have a whole programming language inside your CM system. –  voretaq7 May 10 '12 at 21:45

I would recommend something along the lines of Spacewalk. It is basically the free version of Red Hat's Satellite software.

share
1  
Specifically "the upstream community project from which the Red Hat Network Satellite product is derived." –  Wesley May 10 '12 at 16:43
    
Spacewalk looks awesome, but it looks a bit of a PITA to get working with Oracle Linux forums.oracle.com/forums/thread.jspa?threadID=2262193 –  leftcase May 10 '12 at 20:24
    
Unfortunately I've never used Spacewalk with Oracle Linux. We primarily used it in a Fedora/CentOS shop, so I wouldn't be much help in that area. However I would assume such a popular product would have enough followers that has found a viable method of using it. –  Eric May 10 '12 at 21:16

Since you are looking at Linux, checkout an upcoming project from Redhat: Pulp.

Pulp is a more modern solution to the problem, which specifically targets package & patch management, audit etc. This is something that puppet/chef can do on their own with some amount of effort. Pulp only does packages and Yum, and leaves the Config management to puppet/chef, which is how it should be. It's got a Rest api for scripting etc.

I'm not a fan of Spacewalk/Satellite, but YMMV.

share
    
Pulp looks interesting, but it also looks pretty new and it's not immediately apparent to me how it would be possible to configure Oracle Linux clients how to use it. –  leftcase May 10 '12 at 20:39
    
Pulp looks interesting, I wonder how well it will support the BSDs (right now all the patch management stuff I see is heavily tied to package managers, so guys like me who use make world to do our patching are still stuck with something like radmind to distribute the changes...) –  voretaq7 May 10 '12 at 21:47
    
@leftcase All pulp does is install an agent which can add/modify yum config files. I've used it on CentOS and RHEL, and I'm sure Oracle linux will work the same. Additionally, the agent reports activities back to a central server, and polls the server for package related commands to execute. –  Not Now May 11 '12 at 3:38

Yes we use puppet for a large cluster patch and administrative management. Another alternative for small sets is to create a local yum repo and deploy changes with custom RPM packaging.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.