Setting up yum to automatically update

In enterprises, automating the systematic updating of your RHEL systems is very important. You want to stay ahead of hackers or, in general, people trying to hurt you by exploiting the weaknesses in your environment.

Although I do not recommend applying this recipe to all systems in an enterprise, this is quite useful to ensure that certain systems are kept up to date as the patches and bugfixes are applied to the RPMs in Red Hat's (and other) repositories.

Getting ready

In order for this recipe to work, you'll need to be sure that the repositories you are using are set up correctly and you have valid mail setup (using Postfix or Sendmail, for example).

How to do it…

We'll set up yum to autoupdate your system once a week (at 03:00 ) and reboot if necessary through the following steps:

  1. Install the yum cron plugin, as follows:
    ~]# yum install -y yum-cron
  2. Then, disable the hourly and daily yum cron jobs through the following commands:
    ~]# echo > /etc/cron.dhourly/0yum-hourly.cron
~]# echo > /etc/cron.daily/0yum-daily.cron
  3. Create the configuration file for the weekly yum update cron job via the following:
    ~]# cp /etc/yum/yum-cron.conf /etc/yum/yum-cron-weekly.conf
  4. Modify the created configuration file to apply updates and send a notification through e-mail by setting the following values:
    apply_updates = yes
emit_via = email
email_to = <your email address>
  5. Next, create a weekly cron job by adding the following contents to /etc/cron.weekly/yum-weekly.cron:
    #!/bin/bash                                                     

# Only run if this flag is set. The flag is created by the yum-cron init
# script when the service is started -- this allows one to use chkconfig and
# the standard "service stop|start" commands to enable or disable yum-cron.
if [[ ! -f /var/lock/subsys/yum-cron ]]; then
  exit 0
fi

# Action!
exec /usr/sbin/yum-cron /etc/yum/yum-cron-weekly.conf
if test "$(yum history info |egrep 'skernel'|wc -l)" != "0"; then
    
/sbin/shutdown --reboot +5 "Kernel has been upgraded, rebooting the server in 5 minutes. Please save your work."
fi
  6. Finally, make the cron job executable by executing the following command:
    ~]# chmod +x /etc/cron.weekly/yum-weekly.cron

How it works…

By default, yum-cron sets up a cron job that is run every hour (/etc/cron.dhourly/0yum-hourly.cron) and every day (/etc/cron.daily/0yum-daily.cron).

There's more…

This recipe will upgrade all your packages when there's an update available. If you just want to apply security fixes, modify the update_cmd value of your yum cron configuration file in the following way:

update_cmd = security

Alternatively, you can even use the following configuration if you only want critical fixes:

update_cmd = security-severity:Critical

See also

Check the yum cron(8) man page or the default yum-cron.conf file located at /etc/yum/yum-cron.conf for more information.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset