Hot answers tagged updates
20
I've found that in most cases, if YOU are the one responsible for the physical server its best to NOT give the devs root access.
This is a bit of a "holy war" debate as I'm sure you will find developers who disagree. I've personally been on both sides of that debate.
My MAIN reasoning for not giving the devs (even 100% trusted devs) root access is because ...
16
I run apt-get update -qq; apt-get upgrade -duyq daily. This will check for updates, but not do them automatically.
Then I can run the upgrades manually while I am watching, and can correct anything that might go wrong.
Besides the security concerns of maintaining a patched system, I find that if I leave it too long between patches, I end up with a whole ...
16
There is nothing really special about having a long uptime. It is generally better to have a secure system. All systems need updates at some point. You are probably already applying updates, do you schedule outages when you apply those updates? You probably should just in case something goes wrong. A reboot shouldn't that that much time really.
If your ...
15
Golden Rule: Don't let non-admins touch anything you don't want broken and for which you will be held responsible.
Devs should have access to a test environment. Once their work is ready to be put onto the production machine it should be handed over to the sys admin. If the devs have done their job and properly documented the procedure all will go well. If ...
12
I've been in this battle as well. My answer is that whomever is responsible for the uptime of the server is the one who should be responsible for all updates, changes, etc., etc. Nobodoy else should have the ability to perform these types of functions on the server. If it's your job to make sure the server is up and running and if the boss holds you ...
10
There is nothing special about patching Ubuntu vs. Windows, RHEL, CentOS, SuSE, debian, etc.
The basic state of mind you need to be in when designing your patch procedure is to assume something will break.
Some of the basic guidelines I tend to use when designing a patch setup are:
Always use a local system to centralize internally to your network ...
10
I update firmware in two key instances.
When staging up a server.
When I just get the server, I'll check the the HP web-site for the date of their latest "Firmware Update CD". If it's new enough, I'll run it against the server before bringing it up to production.
When I repurpose a server. Typically, this server is 2-5 years old and probably hasn't had a ...
9
On top of previous answers - a couple more specifically Debian things: you should Subscribe to debian-security-announce and debian-announce and / or check out the Debian Security page.
9
You can use the exec type such as:
exec { "upgrade_packages":
command => "apt-get upgrade -q=2",
path => "/usr/local/bin/:/bin/:/usr/bin/",
# path => [ "/usr/local/bin/", "/bin/" ], # alternative syntax
}
To be honest, I did not try it myself, but I think you just need to create a new module that include such an exec definition.
...
8
Debian patterns for Puppet.
Are configuration management tools (Puppet, Chef) capable of keeping installed packages up to date?
Wikipedia's blog entry and link to their repository (all the configs except the passwords).
... Puppet! (fanaticism is fun)
8
Yes, update.
RHEL (and therefore CentOS) are careful not to update versions to anything incompatible, instead they backport bugfixes and security fixes, so the actual changes to packages are minimal and reasonably unlikely to cause compatibility problems.
If any config files have changed, the packages will tell you about a .rpmorig or .rpmnew file that ...
8
Sometimes the package manager just gets a bit confused over what constitutes a modified file or not. Usually it's because some program or another has made modifications (especially those TeX map files).
There's two approaches that I use when dealing with these sorts of files, depending on my mood, the criticality of the system, and how much I know about ...
8
(First, a disclaimer: I work for Ksplice.)
We use it on our own production infrastructure, naturally, but more importantly, so do our our 500+ corporate customers (number as of Dec '10).
One sysadmin asks the same question on a Red Hat Enterprise Linux user mailing list, and is met with a number of answers, a few of which are excerpted below:
We've ...
8
Security and agility should be balanced against stability and uptime when determining your patching strategy. Your push-back approach for this should be along the lines of 'Okay, but you need to know that we're now at risk of these servers becoming compromised and having our data stolen, or having the servers be rendered non-functional' and 'Okay, but you ...
7
Production servers only get production code.
Only install non-production code on non-production servers.
RC-code also has support impacts if that matters to you. Don't go there unless you're OK with flattening the server and rebuilding it on a released service-pack before calling in.
7
There are two cases:
If a file was installed as part of a rpm, it is a config file (i.e. marked with the %config tag), you've edited the file afterwards and you now update the rpm then the new config file (from the newer rpm) will replace your old config file (i.e. become the active file). The latter will be renamed with the .rpmsave suffix.
If a file was ...
7
Associating the files with patches.
The "WINDOWS\Installer\" folder has several key sub-folders.
You can search for the sub-folder name (without the braces {}) in the registry.
The key can be searched within the "HKLM\SOFTWARE\" tree
to get the Software association.
The key would be placed in the Installer sub-tree on the name ENU_GUID.
Similarly, in the ...
7
I usually make every update on the stable branch, no problems for years and years even passing from a release to another.
My servers live with a daily, manually run, upgrade-system (great tool) and they have been updated and upgraded from Woody to Lenny quite simply.
Of course I do not make the updates via cron, I get only the updates availability this ...
7
Most updates do not require a reboot, but Kernel updates do (you can't really replace the running kernel without rebooting).
One thing I have discovered is that if your server has been running for a long time without a reboot, it's more likely to want to do disk checks (fsck) when you reboot, and this can add significantly to the time it takes to get back ...
6
Non-Microsoft packages would be fantastic if enough people supported it.
All the other standard desktop applications that self update at different times (particularly Adobe Acrobat) are becoming an increasing blight on the desktop environment, causing much user confusion and system instability.
If the vendors could get together and agree a single update ...
6
i'm using the script already mentioned by Oskar with psexec to patch a bunch of servers. if a server has a borked WU Agent i use this script:
net stop bits
net stop wuauserv
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /f
rd /s /q %WINDIR%\SoftwareDistribution
gpupdate /force
wuauclt /resetauthorization /detectnow
6
I like to have the minimum of auto-updated packages and the important ones are the security updates. For this reason, I add the following to the cron-apt config file:
OPTIONS="-o Dir::Etc::SourceList=/etc/apt/security.sources.list"
and then make /etc/apt/security.sources.list have just the Debian security repositories enabled. That way, I get all the ...
6
There are many available tools
apt-mirror (howto)
apt-proxy (wiki)
apt-cacher (howto)
approx
You can even simply install a simple cache like squid and simply adjust the maximum_object_size so it will cache larger files like the package updates.
6
Yes, its perfectly possible to install Mac OSX Server on a Mac Mini, although performance may not be stellar.
The minimum system requirements advertised for OS X 10.5 Server are:
Mac server or desktop computer with an Intel, PowerPC G5, or PowerPC G4 (867MHz or faster) processor
1 GB of RAM
20 GB of available disk space
A recent Mac Mini will fulfill ...
6
While yes, it would take time to upgrade, And in the same manor, it would take time to restore if something went wrong, How much pain/suffering would it be if the data on that system was deleted through a exploit / hack?
For the most part upgrades from the CentOS base repositories are safe to install, The only time i've had update issues with CentOS is when ...
6
Quick and dirty (ie. Battlefield Administrator) solution:
Take your system offline (I hope you can) and do a NortonGhost backup (or something similar) to a 2nd hard drive.
Boot up the 2nd hard drive (to make sure your backup actually works) and do the yum update on THAT drive.
If it all works... congratulations!
If it screws something up... go ahead and ...
6
Look into WSUS for updates. Do you have any group policies defined (Think: different update policies for in-house systems versus laptops)? For inventory, Spiceworks is a good start.
5
If you want to avoid security problems, then you should install them shortly after patches are released. Microsoft releases scheduled patches on the second Tuesday of every month. We plan downtime for either the second Wednesday evening or Thursday evening to facilitate the installation of these patches, you would do well to implement a similar schedule if ...
5
According to this Technet article (in the section called Proxying between Client Access Servers), the order that servers are updated in is as follows:
Client Access server
Hub Transport server
Mailbox server
There are special instructions for installing update roll-ups into DAGs according to this Technet blog post.
5
Security vulnerabilites in packages gets backported by Ubuntu developers into the ubuntu-maintained package. Even though you might not always get the latest software-versions, you will be assured that the version you have installed is supported with security upgrades through the entire life-cycle of the Ubuntu release.
I recommend you to use the available ...
Only top voted, non community-wiki answers of a minimum length are eligible
