Patch Management in Linux using YUM

Pre-requisites:

    Installation of Red Hat Enterprise Linux 5.
    Premium/Standard License for RHEL 5 32-bit or 64-bit servers (Note: RHEL 32-bit YUM Server will let    you apply patches on RHEL 32-bit OS. For 64-bit OS, you required YUM Server on RHEL 64-bit).
    Createrepo,  yum-downloadonly, httpd packages to be installed on the server.
    Installation and configuration of apache web server.
    Copying the rpm’s from RHEL CD to the defined DocumentRoot Path mentioned in httpd configuration file.


Installation and Configuration of YUM Server:

Step 1: Creating a Repository using apache.

      Installation of apache web server.
# rpm –ivh httpd

      Modify httpd configuration file as mentioned below.
# vi /etc/httpd/conf/httpd.conf

ServerAdmin root@192.168.0.5
ServerName 192.168.0.5:80
DocumentRoot "/var/www/html"

      Create folders as mentioned below.
# cd /var/www/html
# mkdir Server
# mkdir VT
# mkdir images

      Copy all RHEL 5 RPM’s from CD to the Server, VT & images folders on the server.

Step 2: Create Database of RPM’s

      Run createrepo command to create database of the rpm’s.
# cd /var/www/html/Server
# createrepo .
# cd /var/www/html/VT
# createrepo .
# cd /var/www/html/images
# createrepo .


       Create group of RPM’s for installing group of packages.
# createrepo -g /var/www/html/Server/repodata/comps-rhel5-server-core.xml
# createrepo -g /var/www/html/VT/repodata/comps-rhel5-VT-core.xml

Step 3: Register your YUM Server with Red hat Network.

    Ensure that the following entries have been added in host file and the URLs are accessible from the server.
# vi /etc/hosts
209.132.183.44  xmlrpc.rhn.redhat.com
209.132.183.43  satellite.rhn.redhat.com
209.132.183.42  rhn.redhat.com
    Run rhn_register command and follow the instructions as printed on screen, create a system profile. (Note: You should have a valid subscription key)
    De-select Location aware updates from RHN website of the registered machine. (Note: You should have a valid RHN login id.)

Step 4: Download required updates & hot fixes from Red hat

    Run below command to download RPM’s to configured repository.
# yum update -y --downloadonly --downloaddir=/var/www/html/Server/
 
          Re-run below command after downloading any new packages into repository.
# cd /var/www/html/Server
 # createrepo –update .

Note : If any patch is released, First download it via download command as mentioned in step 4 and then only install on YUM Server using yum update command. Else, you won’t be able to download same patch again.

Configuration of YUM Client:

Step 1: Creation of Repo file for pointing the client to server for updates.
# vi /etc/yum.repos.d/Server.repo
[rhel-i386-server-5]
name=rhel-i386-server-5
baseurl=http://192.168.0.5/Server
enabled=1
gpgcheck=0


[rhel-i386-server-vt-5]
name=rhel-i386-server-vt-5
baseurl=http://192.168.0.5/VT
enabled=1
gpgcheck=0

Step 2: Configure Mail alerts for pending patches on client.
Note: You have to enable SMTP relay on the server.
# yum check-update | mailx -s "PATCHES PENDING on $HOSTNAME" abc@tcs.com

Step 3: Run Yum update command on quarterly basis to make your system up2date with latest patches and hot fixes.
# yum update

Note: Before updating the system, have a proper backup for the same.

Rollback Package updates/Installation on YUM Server and Client:

Step 1: To configure yum to save rollback information, add the line tsflags=repackage to /etc/yum.conf.

Step 2: To configure command-line rpm to do the same thing, add the line %_repackage_all_erasures 1 to /etc/rpm/macros. If /etc/rpm/macros. Does not exist, just create it.

Step 3: You can now install, erase and update packages with yum and/or rpm, and they will save roll back information.

Step 4: When you want to roll back, use rpm to do so.
You do this by specifying the --rollback switch and a date/time, like the examples below:
rpm -Uhv --rollback '19:00'
rpm -Uhv --rollback '8 hours ago'
rpm -Uhv --rollback 'december 31'
rpm -Uhv --rollback 'yesterday'