I'd like to download all the rpms of security updates to fc7 since the release. I will be using a machine running fc6, so "yum -y update" won't actually do it.
If getting just the security updates is hard, I'd settle for getting all the updates.
If for some reason getting the updates is hard, I guess I will have to try to make a private mirror of the repository. That's a bit more elaborate than I really need, but at least it has been discussed recently on the list.
How should I choose a repository to get stuff from? Usually I just let yum do it, and I don't know what's going on under the hood. Is there some FAQ or howto I should look at? I tried googling and poking around, found the basic release rpms at redhat.com, but can't figure out where updates come from. Must be overlooking something obvious.
Thanks, Dave
On Sat, Nov 03, 2007 at 13:06:21 -1000, Dave Burns tburns@hawaii.edu wrote:
I'd like to download all the rpms of security updates to fc7 since the release. I will be using a machine running fc6, so "yum -y update" won't actually do it.
SNIP
How should I choose a repository to get stuff from? Usually I just let yum do it, and I don't know what's going on under the hood. Is there some FAQ or howto I should look at? I tried googling and poking around, found the basic release rpms at redhat.com, but can't figure out where updates come from. Must be overlooking something obvious.
What I do is mirror the updates repository and configure yum to use my local copy of updates. It sounds like you probably want to do some other stuff in there, but you might be able to use that as a starting point for what you are trying to do.
You should note that stuff gets removed from the updates repository from time to time. So this will only get you the most current updates (and a few older ones), not all of the updates that were ever released. I doubt you want the obsolete updates in any case.
Dave Burns wrote:
I'd like to download all the rpms of security updates to fc7 since the release. I will be using a machine running fc6, so "yum -y update" won't actually do it.
If getting just the security updates is hard, I'd settle for getting all the updates.
If for some reason getting the updates is hard, I guess I will have to try to make a private mirror of the repository. That's a bit more elaborate than I really need, but at least it has been discussed recently on the list.
How should I choose a repository to get stuff from? Usually I just let yum do it, and I don't know what's going on under the hood. Is there some FAQ or howto I should look at? I tried googling and poking around, found the basic release rpms at redhat.com, but can't figure out where updates come from. Must be overlooking something obvious.
apt-get, on Debian, has the "--print-uris" switch just for this purpose. It prints a list of URIs for the packages needed to bring _this_ box up to date, then you can take that list to someplace else and shove into wget.
You might request it as an enhancement to yum.
Dave Burns <tburns <at> hawaii.edu> writes:
I'd like to download all the rpms of security updates to fc7 since the release. I will be using a machine running fc6, so "yum -y update" won't actually do it.
Although I have not tried this you could create a script that gets a list of the rpms that are security related by including a line such as :
curl https://www.redhat.com/archives/fedora-package-announce/2007-November/date.h... |grep SECURITY > rpm_seclist.out
(all on one line of course!)
This file will then have lines that show the rpms related to security updates.
You could then extract the rpm files from this list, and send them to a command to download just these into your /var/yum/cache/updates/packages directory and then if you wished you would also extract the the list of files and make a yum -y update command line appended with your list of packages to update which matches the list of rpms you have just downloaded.
Alternatively you could create the list with the initial curl command and then just make a yum command which would update only these packages and in the process the rpms will be left in the cache provided the keepcache parameter is set to 1 in the yum.conf file.
I guess it would not be too hard to make a bash script to do this?
This would not help me, because the machine that has access to the net and the yum repos is not the machine that is out of date. I don't want to expose the out-of-date machine to the net until it has been updated (feeling paranoid). I guess I should dredge around on the yum site to figure out how to diff the fc7 original rpms and the current rpms. Dave
On 11/5/07, John Summerfield debian@herakles.homelinux.org wrote:
apt-get, on Debian, has the "--print-uris" switch just for this purpose. It prints a list of URIs for the packages needed to bring _this_ box up to date, then you can take that list to someplace else and shove into wget.
On Mon, Nov 05, 2007 at 11:30:22 -1000, Dave Burns tburns@hawaii.edu wrote:
This would not help me, because the machine that has access to the net and the yum repos is not the machine that is out of date. I don't want to expose the out-of-date machine to the net until it has been updated (feeling paranoid). I guess I should dredge around on the yum site to figure out how to diff the fc7 original rpms and the current rpms. Dave
If that's your problem, setting up your fire wall on that machine to not allow inbound connections is a pretty safe way to keep from getting rooted while you are doing the updates.
Note that there is a separate updates repository with the latest (and in a few cases some older updates) updates. You can even download the whole repository fairly conveniently if you have broadband. I would suggest doing this before Thursday, as the mirrors will be hit pretty hard for a while starting then.
On 11/5/07, Mike C mike.cohler@gmail.com wrote:
script that gets a list of the rpms that are security related by including a line such as :
curl https://www.redhat.com/archives/fedora-package-announce/2007-November/date.h... |grep SECURITY > rpm_seclist.out
I ended up with this:
touch updates echo "May June July August September October November"|while read month; do echo "$month";curl https://www.redhat.com/archives/fedora-package-announce/2007-$month/date.htm... SECURITY|sed "s/^.*SECURITY] //"|sed "s/<.*>//" >> updates; done
After that, updates contains both fc6 and fc7 security updates, grep and sed can separate them:
grep 'Fedora 7' updates |sed "s/^Fedora 7 Update: //"|sort >updates7
Then we need to grep out updates that got superceded. I can't think of a way to do that with grep, so I guess I'll just edit the file. Then wget in a similar loop will be able to download them all. Just need to choose a mirror from http://mirrors.fedoraproject.org/.
Thanks!
On 11/5/07, Bruno Wolff III bruno@wolff.to wrote:
If that's your problem, setting up your fire wall on that machine to not allow inbound connections is a pretty safe way to keep from getting rooted while you are doing the updates.
Unfortunately, iptables makes me go cross-eyed. Will using system-config-securitylevel to turn off all "trusted services" accomplish the same thing? To be totally paranoid, I guess I could turn off ssh and sendmail etc. with /etc/init.d/sshd stop.
Can yum work in single user mode?
Thanks, Dave
It seems there's at least one more step involved - some of the security updates have been superceded by ordinary updates, so the version information I extracted is not sufficient. I will have to use the security update list to grep the list of current updates.
That "crank up the firewall" idea is sounding better and better.
Dave
Dave Burns wrote:
This would not help me, because the machine that has access to the net and the yum repos is not the machine that is out of date. I don't want to expose the out-of-date machine to the net until it has been updated (feeling paranoid). I guess I should dredge around on the yum site to figure out how to diff the fc7 original rpms and the current rpms. Dave
It would help. The machine needing the updates needs a list of what's available (new metadata) to produce a list of what it needs.
You can actually download on any machine, one running FreeBSD, OS X or even Windows.
fwiw the out-of-date machine is at no risk of attack by worm if it does not accept any connexions to any services: if you're not running your web server (for example), body can attack it.
If you can't stop some service, then configure it to not listen on a public address and/or configure a firewall to block it.
Preventing an attack by "invited" content - typically email and web access - is up to the clown at the keyboard. If you don't read email, and confine your web access to downloading and applying the updates, the risks are pretty tiny. If _I_ can't trust my IAP and the suppliers (and their mirrors) of my software, I best get off the 'net.
On 11/5/07, John Summerfield debian@herakles.homelinux.org wrote:
apt-get, on Debian, has the "--print-uris" switch just for this purpose. It prints a list of URIs for the packages needed to bring _this_ box up to date, then you can take that list to someplace else and shove into wget.
On 11/5/07, John Summerfield debian@herakles.homelinux.org wrote:
The machine needing the updates needs a list of what's available (new metadata) to produce a list of what it needs.
So... If i went to another machine running fc7 and did a yum makecache and then transferred some file to the not-updated fc7 box, then it would know what it needed. How would I then ask yum or rpm to generate the list of packages? yum -C checkupdates?
Yeah, I am going to turn off services and then update directly, this is too much. Thanks to all, Dave
On Mon, 2007-11-05 at 19:07 +0900, John Summerfield wrote:
Dave Burns wrote:
I'd like to download all the rpms of security updates to fc7 since the release. I will be using a machine running fc6, so "yum -y update" won't actually do it.
If getting just the security updates is hard, I'd settle for getting all the updates.
If for some reason getting the updates is hard, I guess I will have to try to make a private mirror of the repository. That's a bit more elaborate than I really need, but at least it has been discussed recently on the list.
How should I choose a repository to get stuff from? Usually I just let yum do it, and I don't know what's going on under the hood. Is there some FAQ or howto I should look at? I tried googling and poking around, found the basic release rpms at redhat.com, but can't figure out where updates come from. Must be overlooking something obvious.
apt-get, on Debian, has the "--print-uris" switch just for this purpose. It prints a list of URIs for the packages needed to bring _this_ box up to date, then you can take that list to someplace else and shove into wget.
You might request it as an enhancement to yum.
I dunno, wget will not update just the newly created parts, as Presto does. I wish smart would catch up to this as I much prefer it to overall general front-end use. Presto be WAY cool IMHO. Ric