RE: WSUS/Reboot

From: David LeBlanc (dleblanc_at_mindspring.com)
Date: 06/25/05

  • Next message: David LeBlanc: "RE: Using Messenger Service for 'Net Send' Functionality --- Dangerous?Why?" 
    To: "'Martin Mewes'" <mm@mewes.tv>, <focus-ms@securityfocus.com>
Date: Sat, 25 Jun 2005 14:52:45 -0700

    > Did someone ever tell Microsoft that they should have a look
    > on unixoid systems. The only scenario a unixoid box _must_ be
    > rebooted is, when the kernel has been patched or the main
    > glibc must be changed for some reasons. But even the latter
    > does not mean to always you need to reboot the system.

    Reducing reboots is something that I know is a priority for Microsoft, and
    you're right - having systems rebooting all the time is a problem, even if
    they're just desktops. I think you'll see improvement on this over time, and
    one of the new features of WSUS I notice is immediate application of patches
    that don't need reboots.

    However, they way that you get this system uptime on most *nix systems is to
    drop the service in question, apply patches and restart the service. IMHO,
    if the system's job is to provide that service, there is only a little
    difference between bouncing the service and bouncing the box. If you take
    the same approach on a Windows server, you will often find that you get
    similar gains. For example, back when there were enough IIS patches to worry
    about, you could stop the web service and if the patch were applied when
    then server wasn't up, it didn't need a reboot. You'd then restart the
    service once the patch was applied. Many of the patches only trigger a
    reboot if a file that needed to be replaced will only get replaced on
    reboot.

    IMHO, it would be a good thing if the patch were to do this on it's own, but
    in the meantime you can certainly do it yourself.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: David LeBlanc: "RE: Using Messenger Service for 'Net Send' Functionality --- Dangerous?Why?"

    Relevant Pages

    • Re: [Total OT] Trying to improve some numbers ...
      ... But patch frequency means what exactly? ... Thus making only, say, a driver or some kernel component reboot, ... Actually it means advertising an unpatched machine running unpatched services not available to the outside. ... a lot of work-arounds for security patches amount to "lock the front door." ...
      (freebsd-questions)
    • Re: [Total OT] Trying to improve some numbers ...
      ... But patch frequency means what exactly? ... Thus making only, say, a driver or some kernel component reboot, ... Actually it means advertising an unpatched machine ... a lot of work-arounds for security patches amount to "lock the ...
      (freebsd-questions)
    • Re: pca install features vs. smpatch
      ... I want to have close control over patch installation. ... If I decide to install patches in single user mode, ... A system starting to install patches automatically during a reboot just doesn't make me feel comfortable. ...
      (comp.unix.solaris)
    • The patch killed my system!
      ... prompts for a reboot, I say "Yes"...boom! ... that reason more often than any other on a server. ... when a patch appears to cause a problem with your server its more likely ... Now I'm not saying this to discourage reports of problems with patches, ...
      (NT-Bugtraq)
    • Re: [Total OT] Trying to improve some numbers ...
      ... required a kernel recompilation and a reboot, it means the server is not ... Perhaps it means the OS doesn't need to be patched that frequently or has a patch mechanism that avoids reboots? ... That's certainly worth advertising. ... a lot of work-arounds for security patches amount to "lock the front door." ...
      (freebsd-questions)