Tag Info

Hot answers tagged

19

Yes, products like VMware should be patched sometimes (the updates are cumulative), but the patches come less frequently than a mainline operating system and the potential attack vector is smaller - your hypervisor should not be publicly-accessible. I'll use VMware ESXi version 5.0 (not 5.1) as an example... ESXi 5.0 has had the following update schedule: ...


15

In addition to systeminfo there is also wmic qfe Example: wmic qfe get hotfixid | find "KB99999" wmic qfe | find "KB99999" There is also update.exe Or from powershell, just adjust it for your needs: Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid}


9

One solution is to use ksplice. If you use Ubuntu or CentOS kernels you can subscribe to the ksplice.com service, where for a small fee they will provide you with special kernel images that can be used to patch a running kernel. Reboots are not required for most updates. Pretty easy to use and setup. If you are particularly skilled you can use the ...


9

I won't speak to WHEN it will happen, since the date has fluctuated...but to answer your questions and help make this question a canonical for this topic that is sure to pop up a lot... So I assume that means there will be windows update patches available until that date? MS will continue to release new patches/updates for XP until that date. ...


9

Puppet doesn't do the base system provisioning as far as I know. So you always also need the distibution's base automated system installation tool. One could mention tools like FAI - Fully automatic installation - provisioning, configuration and change management - you can check out a presentation at ...


9

(First, a disclaimer: I work for Ksplice.) We use it on our own production infrastructure, naturally, but more importantly, so do our our 500+ corporate customers (number as of Dec '10). One sysadmin asks the same question on a Red Hat Enterprise Linux user mailing list, and is met with a number of answers, a few of which are excerpted below: We've ...


8

I have had servers with 1+ year of uptime. Not the best practice because from a security perspective the server...some of these servers were database masters and we couldn't afford downtime. I think security should be the prime concern but then there are some real world limitations. If you have the luxury patch it and reboot it if needed. Don't worry about ...


7

According to this page, they release them at approximately 10 AM Pacific time.


7

It is something dependent on your site. With proper backups, if something goes drastically wrong you can roll back changes by restoring to the previous update. Take a risk assessment. Automatically doing anything risks having something automatically break. Can you stand to have your server unavailable for the time it takes to restore it in the worst case ...


7

No, you cannot control FF via GPO (without an add-on or script) or update via WSUS. You may be able to push patches with SCCM, but that would be overkill if you don't have it in your environment. In short, unless you have an explicit need for FF, or something is totally incompatible with IE in your environment, stick with IE if you want ease of updates.


6

I'll recommend the apticron package. It'll check for updates every day, and hit you with a nicely formatted email with package names and change logs when there are new ones pending (using the DIFF_ONLY option).


6

This is a pretty good question if you're new to virtualisation with 'bare metal' hosts. Doing things this way requires a different mindset to the approach you might take with hypervisors that run as a service/application on top of a conventional OS. In my experience, it's probably fair to say that ESX and HyperV need less patching overall than conventional ...


6

I can tell you that Patch Management is high on the list of every IT Auditor and which does get checked quite often. Not patching your systems leaves them vulnerable for the prying eyes of attackers. Patching is required to be done, but it should also be tested before being pushed to production. The only mandatory patches you generally need to do are ...


6

Puppet is great, but doesn't really handle that problem. What should work (I've done the theory but haven't rolled it out) is using cron-apt in combination with repositories managed by debmashal to approve the patches that cron-apt will then deploy. Debmarshal is out of google and there's a tech talk available on it: http://code.google.com/p/debmarshal/ ...


6

Software maintenance in AIX is complicated and alien to the uninitiated. These days, major major AIX OS updates are referred to as a "maintenance level" (ML) and revisions to those code drops are referred to as "service packs" (SP). You'll want to determine what level you systems are currently at and the level you wish to upgrade to prior to starting the ...


6

Update: per sparks' comment, I should note that 'aptitude' can be used in place of 'apt-get' in my answer below, with one exception: 'apt-get upgrade' would be replaced by 'aptitude safe-upgrade'. The aptitude front-end to APT has some nice features compared to apt-get, as outlined in this blog post. However, if you've already got a system that you've been ...


6

The Configure a Disconnected Network to Receive Updates chapter in the WSUS documentation describes the officialy supported way to use WSUS in a disconnected environment. You need to have a second WSUS installation which can download updates from Microsoft servers. First you need to synchronize the metadata on the connected WSUS server; then you must make ...


5

There is nothing wrong with using a trusted 3rd party tool. In fact some of them are heads and shoulders above Windows Update/WSUS. That particular tools seems to use an agent, which personally I'm very wary of putting agents onto servers, you have to do due diligence and have the prove to you it won't effect your performance. However, in your situation I ...


5

We stay a month behind (it's a nice round number) and also keep a separate group for machines that shouldn't auto-reboot. We also make a specific effort to exclude service packs, new versions of IE, and other major upgrades from the patch management system, taking the view that as these constitute a major upgrade you want to be physically there to see it ...


5

Install the yum-security plugin and use yum --security check-update: [root@camel ~]# yum --security check-update Loaded plugins: puppet, security Limiting package lists to security relevant ones Needed 1 of 219 packages, for security proftpd.x86_64 1.3.3g-3.el5 epel


5

ESXi patches are cumulative. I just went from Build Number: 623860 to Build Number: 721882 skipping several patches. No problems. VMware Employee Kyle Gleed says "Patches are cumulative. We typically release patch bundles every 3 months. A new patch bulletin will include all the updates/fixes from any earlier bulletins." ...


5

Install apticron. Sends an e-mail daily with details of required updates, perfect for servers.


5

I'd caution against ignoring vulnerabilities simply because they have no publicly available exploit code - while those that get published to slashdot are highly visible, there's important software fixes getting released all the time, with and without public exploit code available. Mostly without. However, keep in mind that once a patch is released for a ...


4

You've got a couple of options. Do a full backup of all Mailbox Databases and start the upgrade ASAP after the backup (store this off the server you're upgrading!). Stop (but don't disable) the Microsoft Exchage Information Store service, snapshot your machine and start the upgrade. Of those options, the second will give you a consistent snapshot of your ...


4

If you're configuring settings with group policy and updating via WSUS, IE7/8/9 is really your only option. You can do the same thing with Firefox to some degree, but it will require a lot of not-particularly-pleasant scripting.


4

WPKG http://wpkg.org "W-package" (GUI and Command line) is an automated software deployment, upgrade and removal tool for Windows. WPKG is open source software. It can be used to push/pull software packages, such as Service Packs, hotfixes, or program installations from a central server to a number of workstations. It can run as a service to install ...


4

WSUS does have options for sending email notifications. Look in the Options section of the WSUS console.


4

This is generally handled by a monitoring and alerting system like SCOM, Nagios, OpenNMS, etc.


4

A virtual server will require the same maintenance and patches a physical server does, bare metal hypervisors will require updates, for security, but also to fix bugs, and improve performance. The more servers you have, the more work you will have to do to keep them up to date, it doesn't matter if they're physical or virtual.


4

I would recommend Puppet for any system information. Though as has been said, this doesn't handle provisioning of servers. For patch management there are the following: Red Hat => Satellite server. CentOS / Fedora, => Spacewalk. SuSE => SMT I've also been playing around with a project called 'The Foreman' which integrates puppet with kickstart. This ...



Only top voted, non community-wiki answers of a minimum length are eligible