RE: Vulnerability and Patch-Management in Linux (and other Unix)

Security plugin for YUM (which might also handle Redhat)

http://wiki.linux.duke.edu/YumUtils/Plugins/Security?highlight=(Category
Yum)

I haven't tried it but we are just in the process of evaluating/moving
to centos and it's on the todo list.

With Debian I usually just used the "stable" tree for apt which only
updates packages for security. It was never supposed to update the major
version number of a package (i.e. php-4 to php-5). There should be a way
to make Ubuntu do the same thing but I haven't used Ubuntu as a server
platform yet.

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of druid@xxxxxxxxxxxxxxx
Sent: Thursday, June 19, 2008 1:09 PM
To: Rainer Duffner
Cc: focus-linux@xxxxxxxxxxxxxxxxx;
focus-linux-return-3196@xxxxxxxxxxxxxxxxx
Subject: Re: Vulnerability and Patch-Management in Linux (and other
Unix)

So, if you have the money you can use Opsware Server Automation System
(SAS) which will patch and manage all of those OSes and more. Opsware
was
bought by HP so the product is now called HP Server Automation (HPSA).

To be honest, this is a GREAT solution, but costs a lot. for medium to
large enterprises totally worth it and actually kind of necassary, for
small business, welcome to the wonderful world of scripting :P.

http://en.wikipedia.org/wiki/Opsware
https://h10078.www1.hp.com/cda/hpms/display/main/hpms_content.jsp?zn=bto
&cp=1-11-271-273^14711_4000_100__

I know this will probably be out of your price range, but it is
sometimes
enlightening to see how large corporations handle this sort of thing.

On Thu, 19 Jun 2008, Rainer Duffner wrote:

Hi,

we've amassed a veritable "zoo" of Unix-versions: RHEL4+5, CentOS5,
FreeBSD,
Ubuntu and lately Solaris.
We use these for a variety of reasons and each system does its job
quite
well.

However, patch-management seems to be a weak spot in most cases.
RedHat offers "RedHat Network", but it costs a lot of money (and they
charge
more if you want to put your servers in groups in the RHN - WTF?)
FreeBSD offers the portaudit database - we should be able to hack
together
something with that.
But what about CentOS? If you have an array of CentOS servers - how do
you
track which vulnerabilities each one has?
Running yum update every night is no option.

Does CentOS also maintain a vulnerability database along the lines of
FreeBSD?
How about Solaris?
Ubuntu?

How do you track vulnerabilities across your datacenter?


Regards,

Rainer




No virus found in this incoming message.
Checked by AVG.
Version: 8.0.100 / Virus Database: 270.4.0/1509 - Release Date:
6/19/2008 8:00 AM

Relevant Pages

  • Re: Vulnerability and Patch-Management in Linux (and other Unix)
    ... if you have the money you can use Opsware Server Automation System ... FreeBSD offers the portaudit database - we should be able to hack ... But what about CentOS? ... Running yum update every night is no option. ...
    (Focus-Linux)
  • Re: Press release: BookMasters go live on OpenQM
    ... We moved from Redhat 9 to Centos 5.2. ... I think the more significant fact is that the old hardware was a PIII ... with 1Gb RAM - new system is quad core Xeon with 8Gb RAM ...
    (comp.databases.pick)
  • Re: CentOS vs Redhat
    ... I thought CentOS had the same update tools ... >> (yum, etc.) but the location of the updates is on public mirrors. ... up2date is the official RHEL update tool. ...
    (comp.os.linux.misc)
  • Re: Best Update Method > CENTOS
    ... user RPM and other Redhat facilities with CentOS? ... >> So what is thebest solution to keep these packages ... Mail has the best spam protection around ...
    (Fedora)
  • Re: Using centos updates for RHEL (project spacewalk)
    ... I've been looking for information about the compatibility of CentOS ... updates issued from CentOS directly onto my RHEL machines. ... There are some compatibility issues: all packages that have redhat in their name like redhat-release do not exist in CentOS. ... Using yum is default if you upgrade to RHEL5. ...
    (linux.redhat)