topic Patch Management in Operating System - Linux

Patch Management

Mike Duffy — Tue, 25 Feb 2003 09:56:54 GMT

Morning,

I have been tasked with the following;

1. Detail listings of all patches on each server.
2. Details of missing patches.
3. Required patches.

Anyone got any ideas?

Re: Patch Management

Stuart Browne — Tue, 25 Feb 2003 22:30:42 GMT

What do you mean 'patches'?

Do you mean udpated software packages?

Which distribution are you using?

In the RedHat world, this sort of thing is handled by RHN and 'up2date'. Of course, up2date requries Internet access.

If you're in an Advanced Server network, you have the ability to use your local servers as a distribution point for the RHN.

As for getting lists of installed software, 'rpm -qa' is where you look, but this is a very messy way of trying to get up-to-date lists of installed packages.

Re: Patch Management

Steven E. Protter — Wed, 26 Feb 2003 05:47:22 GMT

You sound like an HP-UX admin who's wants the Linux equivalent of swlist.

Sorry, Linux doesn't work like that though the update tools are pretty slick.

Even with rpm queries you are not going to get a current list, because this does not cover stuff you've installed and compiled off tarball or other compressed format.

BTW, HP-UX swlist doesn't show those installs better.

Red hat dosn't really use patches the HP does.

If sendmail 8.1.2 has a problem, Red Hat will put up the next version in rpm format for either downland and install(rpm -i filename).

The installation whichever way you do it will replace sendmail 8.1.2 with the newever version.

SEP

Re: Patch Management

John de Villiers — Wed, 26 Feb 2003 09:13:56 GMT

You can also try installing red-carpet. It has support for more products that what RHN does. It will give you a list of what you currently have installed ( it its a product that red-carpet lists ) and provide you with updates if needed.

Re: Patch Management

dan dobbs — Wed, 26 Feb 2003 14:19:04 GMT

If you want a list of 'patches' that haven't been installed (and you're running Red Hat), try up2date. Up2date is the free upgrade tool from Red Hat, and it will not only tell you what new packages are out, but it will download and install them, too. Up2date -l shows a 'list' of possible updates. Here's my monitoring box (it's already patched up, except for the kernel):

[root@obiwan root]# up2date -l

Fetching package list for channel: redhat-linux-i386-7.2...
########################################

Fetching Obsoletes list for channel: redhat-linux-i386-7.2...
########################################

Fetching rpm headers...

Name Version Rel
----------------------------------------------------------

The following Packages were marked to be skipped by your configuration:

Name Version Rel Reason
-------------------------------------------------------------------------------
kernel 2.4.18 24.7.xPkg name/pattern
kernel-source 2.4.18 24.7.xPkg name/pattern

None of the packages you requested were found, or they are already updated.
[root@obiwan root]#

Good luck!

-dd

Re: Patch Management

Christopher C. Weis — Wed, 26 Feb 2003 15:28:20 GMT

If you're using an RPM-based distro, and you're not worried about "non-RPM" stuff, then the "rpm" command-line tool is your friend.

Download ALL of the latest and greatest updated packages from your distro., 'cd' into the directory(ies) where the updates are at, and do a "rpm -Fv --test *.rpm". This will take a little while, but it will give you a list of every RPM that is out of date. MAKE SURE you pass it the "--test" option, of you'll actually start patching things. If you put all the patches on an NFS server somewhere, you can script this process on every machine (and actually patch things much easier)

"rpm" also has the "--queryformat" option, that allows you to specify exactly what you want to know about a package. For you, something like the following might be useful...

rpm -qa --qf "%{NAME}\t%{VERSION}\t%{RELEASE}\n"

This will give you a nice parseable output that you can feed into something else to do the version comparison.

It's too bad "rpm" doesn't get more publicity. It's a very powerful tool.

I hope this helps.

~Chris