Tag Info

Hot answers tagged

24

(Warnings regarding automatic upgrades have already been voiced by previous posters.) Given the track record of the Debian Security team in the last few years, I consider the risks of broken upgrades far less than the benefit of having automatic updates on seldom-visited systems. Debian Lenny comes with unattended-upgrades, which originated from Ubuntu and ...


22

I run apt-get update -qq; apt-get upgrade -duyq daily. This will check for updates, but not do them automatically. Then I can run the upgrades manually while I am watching, and can correct anything that might go wrong. Besides the security concerns of maintaining a patched system, I find that if I leave it too long between patches, I end up with a whole ...


21

I've found that in most cases, if YOU are the one responsible for the physical server its best to NOT give the devs root access. This is a bit of a "holy war" debate as I'm sure you will find developers who disagree. I've personally been on both sides of that debate. My MAIN reasoning for not giving the devs (even 100% trusted devs) root access is because ...


18

There is nothing really special about having a long uptime. It is generally better to have a secure system. All systems need updates at some point. You are probably already applying updates, do you schedule outages when you apply those updates? You probably should just in case something goes wrong. A reboot shouldn't that that much time really. If your ...


16

Golden Rule: Don't let non-admins touch anything you don't want broken and for which you will be held responsible. Devs should have access to a test environment. Once their work is ready to be put onto the production machine it should be handed over to the sys admin. If the devs have done their job and properly documented the procedure all will go well. If ...


16

Some packages are held by more than one repository. The priorities plugin choose packages from the highest-priority repository, excluding duplicate entries from other repos.


15

From what I understand, this error is generated from the priorities plugin as noted by Pawel. In 2009, the maintainer of yum mentioned that he hoped people would not use priorities. To disable the priorities plugin, edit /etc/yum/pluginconf.d/priorities.conf and set enabled = 0. After this change, next time you run yum update, you should not get any ...


15

An application my company is considering buying requires Java 6. You should push back against this decision. There is really no excuse for purchasing a new application that is tied to a depreciated product that no longer receives security updates. You're brand new application already comes with substantial technical debt instead of eliminating existing ...


13

Yes, according to apple themselves you can run OSX server on a mac pro, iMac or Mac Mini. So it should just work.


12

There are two cases: If a file was installed as part of a rpm, it is a config file (i.e. marked with the %config tag), you've edited the file afterwards and you now update the rpm then the new config file (from the newer rpm) will replace your old config file (i.e. become the active file). The latter will be renamed with the .rpmsave suffix. If a file was ...


12

I've been in this battle as well. My answer is that whomever is responsible for the uptime of the server is the one who should be responsible for all updates, changes, etc., etc. Nobodoy else should have the ability to perform these types of functions on the server. If it's your job to make sure the server is up and running and if the boss holds you ...


12

The simplest answer is, in this case, the correct answer: You will no longer be able to get firmware updates for HP equipment which is not (a) under its original factory warranty, or (b) covered by an active support contract with HP. This has a number of implications, chief among them: As a sysadmin you will have to ensure that you have an HP support ...


11

On top of previous answers - a couple more specifically Debian things: you should Subscribe to debian-security-announce and debian-announce and / or check out the Debian Security page.


10

I update firmware in two key instances. When staging up a server. When I just get the server, I'll check the the HP web-site for the date of their latest "Firmware Update CD". If it's new enough, I'll run it against the server before bringing it up to production. When I repurpose a server. Typically, this server is 2-5 years old and probably hasn't had a ...


10

There is nothing special about patching Ubuntu vs. Windows, RHEL, CentOS, SuSE, debian, etc. The basic state of mind you need to be in when designing your patch procedure is to assume something will break. Some of the basic guidelines I tend to use when designing a patch setup are: Always use a local system to centralize internally to your network ...


10

Security and agility should be balanced against stability and uptime when determining your patching strategy. Your push-back approach for this should be along the lines of 'Okay, but you need to know that we're now at risk of these servers becoming compromised and having our data stolen, or having the servers be rendered non-functional' and 'Okay, but you ...


10

You can use the exec type such as: exec { "upgrade_packages": command => "apt-get upgrade -q=2", path => "/usr/local/bin/:/bin/:/usr/bin/", # path => [ "/usr/local/bin/", "/bin/" ], # alternative syntax } To be honest, I did not try it myself, but I think you just need to create a new module that include such an exec definition. ...


9

Yes, update. RHEL (and therefore CentOS) are careful not to update versions to anything incompatible, instead they backport bugfixes and security fixes, so the actual changes to packages are minimal and reasonably unlikely to cause compatibility problems. If any config files have changed, the packages will tell you about a .rpmorig or .rpmnew file that ...


9

Sometimes the package manager just gets a bit confused over what constitutes a modified file or not. Usually it's because some program or another has made modifications (especially those TeX map files). There's two approaches that I use when dealing with these sorts of files, depending on my mood, the criticality of the system, and how much I know about ...


9

(First, a disclaimer: I work for Ksplice.) We use it on our own production infrastructure, naturally, but more importantly, so do our our 500+ corporate customers (number as of Dec '10). One sysadmin asks the same question on a Red Hat Enterprise Linux user mailing list, and is met with a number of answers, a few of which are excerpted below: We've ...


9

About comparing installed kernels with running one: #!/bin/bash LAST_KERNEL=$(rpm -q --last kernel | perl -pe 's/^kernel-(\S+).*/$1/' | head -1) CURRENT_KERNEL=$(uname -r) test $LAST_KERNEL = $CURRENT_KERNEL || echo REBOOT Hope that helps!


9

Oracle's pretty hostile, and wants more money from the Sun tech they spent so much on - security for end users (who can't afford $10k for basic updates) be damned. You're almost certainly looking at a large bill if you go the paid support route to get the JRE 6 updates - I'm not seeing anything you're missing that would be any cheaper. Ideas: What OS is ...


8

Most updates do not require a reboot, but Kernel updates do (you can't really replace the running kernel without rebooting). One thing I have discovered is that if your server has been running for a long time without a reboot, it's more likely to want to do disk checks (fsck) when you reboot, and this can add significantly to the time it takes to get back ...


8

If you just need security updates and not a completely new kernel, you may be interested in Ksplice - it lets you patch certain kernel updates into a running kernel.


8

Debian patterns for Puppet. Are configuration management tools (Puppet, Chef) capable of keeping installed packages up to date? Wikipedia's blog entry and link to their repository (all the configs except the passwords). ... Puppet! (fanaticism is fun)


7

Associating the files with patches. The "WINDOWS\Installer\" folder has several key sub-folders. You can search for the sub-folder name (without the braces {}) in the registry. The key can be searched within the "HKLM\SOFTWARE\" tree to get the Software association. The key would be placed in the Installer sub-tree on the name ENU_GUID. Similarly, in the ...


7

I usually make every update on the stable branch, no problems for years and years even passing from a release to another. My servers live with a daily, manually run, upgrade-system (great tool) and they have been updated and upgraded from Woody to Lenny quite simply. Of course I do not make the updates via cron, I get only the updates availability this ...


7

Production servers only get production code. Only install non-production code on non-production servers. RC-code also has support impacts if that matters to you. Don't go there unless you're OK with flattening the server and rebuilding it on a released service-pack before calling in.


7

This is done with yum-cron. It includes a cron job at /etc/cron.daily/yum.cron which only runs if the yum service (CentOS 5 'extras' repo) or yum-cron service (CentOS 6 'base' repo) is activated: CentOS 5: # yum install yum-cron # chkconfig --level 345 yum on # service yum start CentOS 6: # yum install yum-cron # chkconfig --level 345 yum-cron on # ...


6

I like to have the minimum of auto-updated packages and the important ones are the security updates. For this reason, I add the following to the cron-apt config file: OPTIONS="-o Dir::Etc::SourceList=/etc/apt/security.sources.list" and then make /etc/apt/security.sources.list have just the Debian security repositories enabled. That way, I get all the ...



Only top voted, non community-wiki answers of a minimum length are eligible