Recently something have been bothered with my mind regarding my linux CentOS box.My client have been asking to set up a CentOS machine in their environment which works as server. One of their requirement is to make sure that the set up is to be as secure as possible. Mostly have been covered except the security update inside CentOS.

So my question are as follows:

1.. How to apply the latest security,patches or bug fixes in CentOS?

When doing some research, I've been told that we can update the security of CentOS by running

yum install yum-security

but after install this plug in,seems there is no output for this method.Its like this command is not working anymore.

2.. Can i update the security patches through rpm packages?

I couldn't find any site that can download the security patches,enhancement or bug fixes for CentOS.But I know that CentOS have been releasing these update through their CentOS announcement here It just it lack of documentation on how to apply these update into my CentOS installation.

For now the only way that I know is to run

    yum update

I am hoping that someone can help me to clarify these matter.Thanks.

  • yum install yum-security ... Its like this command is not working anymore. yum-security does not currently work on CentOS 6, although it does work on RHEL, Scientific Linux, Fedora, Oracle Linux and some third party repositories like EPEL and Oracle. – Stefan Lasiewski Nov 13 '13 at 18:47

Running the following two commands, will get you up to date with the latest security patches and upgrades available in the CentOS repositories. This answers both your questions.

yum clean all
yum upgrade

You normally always want to stay up to date with the latest packages.

You should also look into actively monitoring available updates, you can do this manually by running the following command.

yum check-update
  • Yeah..i've also have been thinking to do the same thing like this. anyway seems that the yum-security command is already obsolete in CentOS.there are other people that facing same issues as i am. – user119720 Sep 7 '12 at 7:50
  • This is the standard and supported way of doing it. Stick with it :) – pkhamre Sep 7 '12 at 7:54

The easiest and most reliable way to enable automatic updates is to install yum-cron package:

yum install yum-cron

And turn on automatic updates, by enabling automatic startup of yum-cron service:

chkconfig yum-cron on

You'd also need to reboot a server sometimes — when an update requires restart, like kernel or glibc etc. If you don't want to do this manually you can configure the server to reboot automatically at night once a week by creating an executable file with a word reboot as /etc/cron.weekly/reboot:

echo reboot > /etc/cron.weekly/reboot
chmod a+x /etc/cron.weekly/reboot

But it isn't an accepted practice — you're supposed to schedule maintenance downtime at night, inform your users several days ahead and then reboot manually at this time (at night). For not very important server is it sometimes just not worth it.

And forget

  • I would prefer to do the actual upgrades manually, but get notified automatically so I can take action quickly. Too bad if an automated update brakes something when someone is on vacation or away. – pkhamre Sep 7 '12 at 7:45
  • @Tometzky using this method is ok but what if there is no outside internet connection through this server(act as intranet server)?Is there any way to manually add the update? – user119720 Sep 7 '12 at 7:55
  • @pkhamre: I suppose a downtime is better than a compromise because of skipped update. We, humans, are notoriously bad at mundane, repeatable jobs — we tend to delay work for days or weeks, forget about it, be sick or on vacation etc. Big organizations with multiple full time administrators, night shifts, with lots of money lost for every hour of downtime can and should do updates manually. – Tometzky Sep 7 '12 at 8:04
  • It really depends, not all updates are security updates. – pkhamre Sep 7 '12 at 8:06
  • 1
    @user119720: if this server can not connect to Internet, nor Internet can connect to it, then what are you securing it against? Inside job? This is much harder than securing software — a physical security is crucial for example, secure (encrypted) backups is a must etc. – Tometzky Sep 7 '12 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.