Tag Info

Hot answers tagged

34

Using -f with ln will overwrite any link that was already there, so as long as you have the correct permissions, it should work... It's always worked for me. What operating system are you using?


27

I also posted this question on the puppet users group and this was a response that I got back. If you add ensure latest it will check the source file against the currently installed package and install the new one if it is latest. I'm still not sure how you would roll back to an older version, but this seems to solve my problem for now. package { ...


26

(Warnings regarding automatic upgrades have already been voiced by previous posters.) Given the track record of the Debian Security team in the last few years, I consider the risks of broken upgrades far less than the benefit of having automatic updates on seldom-visited systems. Debian Lenny comes with unattended-upgrades, which originated from Ubuntu and ...


24

I run apt-get update -qq; apt-get upgrade -duyq daily. This will check for updates, but not do them automatically. Then I can run the upgrades manually while I am watching, and can correct anything that might go wrong. Besides the security concerns of maintaining a patched system, I find that if I leave it too long between patches, I end up with a whole ...


22

Defaults The simplest method is to run a defaults command on the client Macs (easily pushed via Apple Remote Desktop): defaults write com.apple.SoftwareUpdate CatalogURL 'HTTP_URL_FOR_CATALOG' for a user. If you run it via sudo it will set it for whenever you use softwareupdate as root. The HTTP_URL_FOR_CATALOG has been changed with Mac OS X 10.6. If ...


22

Some packages are held by more than one repository. The priorities plugin choose packages from the highest-priority repository, excluding duplicate entries from other repos.


21

From what I understand, this error is generated from the priorities plugin as noted by Pawel. In 2009, the maintainer of yum mentioned that he hoped people would not use priorities. To disable the priorities plugin, edit /etc/yum/pluginconf.d/priorities.conf and set enabled = 0. After this change, next time you run yum update, you should not get any ...


20

If you are using apache: <Directory ~ "\.svn"> Order allow,deny Deny from all </Directory> That will block people from accessing .svn directories remotely (using the browser) but you can keep then (and svn capabilities) on the project. BTW you can substitute \.svn for \.git or \.cvs if you are using something different than ...


20

There is nothing really special about having a long uptime. It is generally better to have a secure system. All systems need updates at some point. You are probably already applying updates, do you schedule outages when you apply those updates? You probably should just in case something goes wrong. A reboot shouldn't that that much time really. If your ...


18

If you are starting from a bare metal install, you can slipstream updates into your installer disc so it already has updates in it (this depends on how many installs you're doing to make it worth it). WSUS will not reboot your computer for you. It only keeps track of your updates and will act as a repo for updates so that rather than updating 300+ meg of ...


16

I've done this many times with Flash Player (and other software). What you want to do is: Use ORCA to edit it with any customization that you want and save it as a transforms (or save it as a whole new MSI, whatever works for you). Put that new MSI (and transforms) on your software deployment share. Add this software (and transforms) to your existing ...


15

An application my company is considering buying requires Java 6. You should push back against this decision. There is really no excuse for purchasing a new application that is tied to a depreciated product that no longer receives security updates. You're brand new application already comes with substantial technical debt instead of eliminating existing ...


13

The simplest answer is, in this case, the correct answer: You will no longer be able to get firmware updates for HP equipment which is not (a) under its original factory warranty, or (b) covered by an active support contract with HP. This has a number of implications, chief among them: As a sysadmin you will have to ensure that you have an HP support ...


13

Assuming your DNS server is on a PC and not a router etc: Linux cache flush: /etc/init.d/nscd restart Or for distros without nscd /etc/init.d/named restart Windows client cache flush for individual machines: ipconfig /flushdns Windows server cache flush for office server (thanks to ericmayo for the correction): Navigate to Administrator ...


13

There are two cases: If a file was installed as part of a rpm, it is a config file (i.e. marked with the %config tag), you've edited the file afterwards and you now update the rpm then the new config file (from the newer rpm) will replace your old config file (i.e. become the active file). The latter will be renamed with the .rpmsave suffix. If a file was ...


13

Yes, according to apple themselves you can run OSX server on a mac pro, iMac or Mac Mini. So it should just work.


13

About comparing installed kernels with running one: #!/bin/bash LAST_KERNEL=$(rpm -q --last kernel | perl -pe 's/^kernel-(\S+).*/$1/' | head -1) CURRENT_KERNEL=$(uname -r) test $LAST_KERNEL = $CURRENT_KERNEL || echo REBOOT Hope that helps!


12

Ok, I found where my error is: one should not put the first / in path. In other words, the commands in my questions should be: Creation -> ln -s {path/to/file-name} {link-name} Update -> ln -sfn {path/to/file-name} {link-name} instead of Creation -> ln -s {/path/to/file-name} {link-name} Update -> ln -sfn {/path/to/file-name} {link-name} ...


11

There is nothing special about patching Ubuntu vs. Windows, RHEL, CentOS, SuSE, debian, etc. The basic state of mind you need to be in when designing your patch procedure is to assume something will break. Some of the basic guidelines I tend to use when designing a patch setup are: Always use a local system to centralize internally to your network ...


11

Do not update the package called redhat-release-5Server- $ rpm -qf /etc/redhat-release redhat-release-5Server-5.3.0.3 Make sure to pin that package. If you do edit /etc/yum.conf and put this in it [main] exclude=redhat-release-5Server-* yum would refrain from updating that package and that would keep /etc/redhat-release at its current version. Not ...


11

On top of previous answers - a couple more specifically Debian things: you should Subscribe to debian-security-announce and debian-announce and / or check out the Debian Security page.


10

Most updates do not require a reboot, but Kernel updates do (you can't really replace the running kernel without rebooting). One thing I have discovered is that if your server has been running for a long time without a reboot, it's more likely to want to do disk checks (fsck) when you reboot, and this can add significantly to the time it takes to get back ...


10

I update firmware in two key instances. When staging up a server. When I just get the server, I'll check the the HP web-site for the date of their latest "Firmware Update CD". If it's new enough, I'll run it against the server before bringing it up to production. When I repurpose a server. Typically, this server is 2-5 years old and probably hasn't had a ...


10

Security and agility should be balanced against stability and uptime when determining your patching strategy. Your push-back approach for this should be along the lines of 'Okay, but you need to know that we're now at risk of these servers becoming compromised and having our data stolen, or having the servers be rendered non-functional' and 'Okay, but you ...


10

One method is to update the system via the command line. Grab the lastest package from here. As of today, that is ESXi500-201205001. Transfering the update zip file to a datastore on that is visible to the host. Use commands like the following to apply the update. # check server status vicfg-hostops --server servername --username root --operation info ...


10

You should never touch anything in production unless there's a good reason to do so. Security updates are a very good reason. And as Iain mentions, testing beforehand helps you to ensure that nothing is likely to go wrong when you apply the updates to your production system.


10

The number of pending security updates can be found using: /usr/lib/update-notifier/apt-check 2>&1 | cut -d ';' -f 1 and the number of pending regular updates can be found using: /usr/lib/update-notifier/apt-check 2>&1 | cut -d ';' -f 2 http://superuser.com/questions/199869/check-number-of-pending-security-updates-in-ubuntu


10

You can use the exec type such as: exec { "upgrade_packages": command => "apt-get upgrade -q=2", path => "/usr/local/bin/:/bin/:/usr/bin/", # path => [ "/usr/local/bin/", "/bin/" ], # alternative syntax } To be honest, I did not try it myself, but I think you just need to create a new module that include such an exec definition. ...


10

The root cause of this issue is that Red Hat broke binary compatibility of their OpenSSL packages between 6.4 and 6.5, something that they promised that they would not do. Resolving this problem is straightforward, but depending on the applications you may have deployed, may take some yelling at your application vendors. Be sure to reserve most of your ire ...


9

Oracle's pretty hostile, and wants more money from the Sun tech they spent so much on - security for end users (who can't afford $10k for basic updates) be damned. You're almost certainly looking at a large bill if you go the paid support route to get the JRE 6 updates - I'm not seeing anything you're missing that would be any cheaper. Ideas: What OS is ...



Only top voted, non community-wiki answers of a minimum length are eligible