8
votes

I'm running a small (but growing) Linux environment comprising of no more than 10 Linux servers.

The environment consists of CentOS 5 & 6, and Oracle Linux 5 & 6 boxen. All of these are patched individually via their appropriate yum repos.

Can anyone suggest a method of centralising patch management for these servers? I've heard that Puppet is often used to do this but I've never used it myself, and would be interested in hearing from other system administrators.

4 Answers 4

Reset to default
7
votes

Most Configuration Management tools are really good at this. puppet and Chef being two of the most popular, and radmind being the one I use.
The documentation for the specific tool will give you an idea of how to implement patch management -- it does vary from tool to tool.

Other options include a centralized yum/apt/whatever repository and homegrown scripts to pull patches from it at scheduled intervals (or on demand), and there are also commercial solutions from some major vendors, some of which (like RedHat's RHN Satellite) are quite excellent if you spend the time learning how they work and really take advantage of their capabilities.

One item nobody has pointed out yet that I feel bears noting is homogeny -- to the extent possible, make your servers interchangeable cogs running the same software. This greatly simplifies patch management (the same patches have to go everywhere) and IMHO makes life a lot easier as your environment grows.

2
  • Puppet and Chef look complex but interesting, and I'm going to give them a look. I'll mark your answer as my accepted answer as it a) supports the clients and specified in my question OOTB and b) seems the most comprehensive.
    – leftcase
    May 10, 2012 at 20:45
  • Puppet and Chef are fairly complex but the stuff you need to know to get started is pretty low on the learning curve. By the time you get into really complicated stuff you'll be glad you have a whole programming language inside your CM system.
    – voretaq7
    May 10, 2012 at 21:45
6
votes

I would recommend something along the lines of Spacewalk. It is basically the free version of Red Hat's Satellite software.

3
  • 1
    Specifically "the upstream community project from which the Red Hat Network Satellite product is derived."
    – Wesley
    May 10, 2012 at 16:43
  • Spacewalk looks awesome, but it looks a bit of a PITA to get working with Oracle Linux forums.oracle.com/forums/thread.jspa?threadID=2262193
    – leftcase
    May 10, 2012 at 20:24
  • Unfortunately I've never used Spacewalk with Oracle Linux. We primarily used it in a Fedora/CentOS shop, so I wouldn't be much help in that area. However I would assume such a popular product would have enough followers that has found a viable method of using it.
    – Eric
    May 10, 2012 at 21:16
4
votes

Since you are looking at Linux, checkout an upcoming project from Redhat: Pulp.

Pulp is a more modern solution to the problem, which specifically targets package & patch management, audit etc. This is something that puppet/chef can do on their own with some amount of effort. Pulp only does packages and Yum, and leaves the Config management to puppet/chef, which is how it should be. It's got a Rest api for scripting etc.

I'm not a fan of Spacewalk/Satellite, but YMMV.

3
  • Pulp looks interesting, but it also looks pretty new and it's not immediately apparent to me how it would be possible to configure Oracle Linux clients how to use it.
    – leftcase
    May 10, 2012 at 20:39
  • Pulp looks interesting, I wonder how well it will support the BSDs (right now all the patch management stuff I see is heavily tied to package managers, so guys like me who use make world to do our patching are still stuck with something like radmind to distribute the changes...)
    – voretaq7
    May 10, 2012 at 21:47
  • @leftcase All pulp does is install an agent which can add/modify yum config files. I've used it on CentOS and RHEL, and I'm sure Oracle linux will work the same. Additionally, the agent reports activities back to a central server, and polls the server for package related commands to execute.
    – Not Now
    May 11, 2012 at 3:38
3
votes

Yes we use puppet for a large cluster patch and administrative management. Another alternative for small sets is to create a local yum repo and deploy changes with custom RPM packaging.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .