Network Security Hacks [Electronic resources] نسخه متنی

Hack 20 Automate System Updates

Patch security holes in a timely manner to
prevent intrusions.

Updating
and patching a system in a timely
manner is one of the most important things you can do to help protect
your systems from the deluge of newly discovered security
vulnerabilities. Unfortunately, this task often gets pushed to the
wayside in favor of "more pressing"
issues, such as performance tuning, hardware maintenance, and
software debugging. In some circles, it's viewed as
a waste of time and overhead that doesn't contribute
to the primary function of a system. Coupled with management demands
to maximize production, keeping a system up-to-date is often pushed
even further down on the to-do list.

Updating a system can be very repetitive and time consuming if
you're not using scripting to automate it.
Fortunately, most Linux distributions make their updated packages
available for download from a standard online location. We can
monitor that location for changes and automatically detect and
download the new updates when they're made
available. To demonstrate how to
do this on an
RPM-based distribution,
we'll use AutoRPM (http://www.autorpm.org).

AutoRPM is a powerful Perl script that allows you to monitor multiple
FTP sites for changes. It will automatically download new or changed
packages and either install them automatically or alert you so that
you may do so. In addition to monitoring single FTP sites, you can
also monitor a pool of mirror sites, to ensure that you still get
your updates in spite of a busy FTP server. This feature is
especially nice in that AutoRPM will monitor busy FTP servers and
keep track of how many times a connection to them has been attempted.
Using this information, it assigns internal scores to each of the FTP
sites configured within a given pool, with the outcome that the
server in the pool that is available most often will be checked
first.

To install AutoRPM, download the latest package and install it like
this:

# rpm -ivh autorpm-3.3-1.noarch.rpm

Although a tarball is also available, installation is a little more
tricky than the typical make; make install, and so
it is recommended that you stick to installing from the RPM package.

By default, AutoRPM is configured to monitor for updated packages for
Red Hat's Linux distribution. However, you can
configure it to monitor any file repository of your choosing, such as
one for SuSe or Mandrake.