Red Hat

Does anyone else think RHEL's way of getting software updates to their customers (via the up2date utility) is not a friendly process?

UP2DATE is fine to use, but it either has to be connected to the internet to get updates, or a "satellite server" has to be setup ( which ocsts more money).
And if the systems are not accessible from the internet at all, how are you supposed to update stuff easily & efficiently?


Anyone else ever have to patch systems that were not internet accessible?

What are your feelings on this subject?

No one wants to touch this hot potato... well, I will give it a try.

I have never used up2date and possibly never will. If you don't like it, why use it? Looking at up2date's docs, I see option to specify directories containing patches. It can get patches from directories and remote servers, so what might it be missing? This is the problem with your post... you only seem to state that you find up2date disagreeable but you give no clue as to what you actually want.

At my last job, a deployed server was frozen... no patching allowed. In theory a deployed server was tested and found to working correctly prior to deployment, so "if ain't broke, don't fix it". At some point, it would be redeployed with the latest OS, and DB server, etc... but frozen again. If a frozen system had a problem, we had to get approval for a patch. Once approved, it could be installed. On redhat, this took the form of a tarball with an rpm file or two that was ftp'ed or (scp'ed or whatever) into place.

As I said, it looks like up2date can function without a local server, but I don't see a local server as big deal. Most companies upgrade servers from time to time. And so servers from yester-year are usually available to be pressed into service. Even an old pentuim-pro with 10 GB of disk should work for this. Management usually seems love it when an old box is taken off the scrap heap and re-used. And I doubt that it needs to be a dedicated box. It could also run big brother to monitor the boxes, serve as an ntp server, etc. Nothing on the scrap heap? Then buy an old box off ebay. If a box like this dies, you can usually go a day or two without patches or ntp updates while it is fixed or replaced. So I do not see the big cost here that you do.

I had problems installing patches due to prerequsites / dependencies not being met.

What I want is to be able to download an "update file" from the internet to my laptop, ftp the file to the server and run it, Like Solaris.

You need UP2Date to run a many patches / updates at once.
or else you'll be screwin around with meeting requirements.

They make us patch all the time, it's become a monthly thing, nightly scanning for virus also.

This is really good reference, really.. I try to use the 'search' function above, about rhel patches and I found this. right now, I'm facing a same thing like you did.

My servers never connects to the internet at all. it blocks by firewall. but suddenly my boss asked me to update those servers, because it is related to security issue where I think it is not really necessary since it did not connect to the internet at all. as what you said above "if ain't broke, don't fix it"

Now I'm getting my head spinning of the security patches that I need to install. I really think it is not necessary to updates, because in order to updates those security patches from

Code:

  http://rhn.redhat.com/errata/rhel4-extras-errata-security.html

I need this server to connect to the internet. why we should connect to the internet and patch this security while we never use it for any purposes that related to connect to internet?

Thanks.