Re: [gentoo-server] Automating security updates on non-cutting edge server

[Jon Kinred]

Hi Andy,

I too am working on migrating our Red Hat 7.3 servers to Gentoo. I will 
outline what i have done to address some of the issues when running 
production servers, you can probably get some ideas from this and i'd 
certainly like to hear from anyone how it can be improved.

What i have done is created an internal rsync server which serves a 
fixed copy of the Portage tree. This server also houses the distfiles 
archive and a binary packages repository, both of which are mounted via 
NFS. Almost all my servers are p3's so i have the same make.conf 
distributed between the servers (manually at build time, with cfengine 
planned), so they all build with the same CFLAGS,  i use "buildpkg" in 
my FEATURES so all machines contribute any binary package they build.

When building a new server, i rsync with the fixed portage tree then use 
buildpkg to install from the packages repository, generally it takes 
around 1-2 hours to build a server (including compiling the kernel). It 
is probably easier than some distributions to install: Do the regular 
partitioning, copy the make.conf, emerge sync, mount the nfs exports, 
emerge -u system, build the kernel, install the bootloader. We also run 
a distributed mail system so we have quite a few servers which need an 
identical setup, for these i just copy the world file and do "for 
package in `cat world`; emerge ...".

Your question was mainly regarding updates, which is fairly easy. To 
handle security updates, i sync the branch of the portage tree which has 
the update, eg sys-libs/glibc/, the rest of the tree stays in a good, 
stable, known state. At the moment i am jumping on the servers manually 
to do the updates (only the first server builds the binary package), 
which isn't too bad for 7 servers but you could add a cron job to sync 
the tree every night and do an emerge -u, someone else posted a simple 
command to do this. What i plan to do, is implement cfengine to manage 
all the hosts, so instead of rsyncing every night, send out a cfengine 
job when an update to the tree is applied.

That's pretty much where i am at the moment, though i'm sure that more 
things will come up in the future. I am very happy with Gentoo in a 
production environment so far.

Jon


Andy Mayer wrote:
> Hi there,
>
> I've been using Gentoo as my desktop platform for about 3 months now and
> I really like it's power and flexibility. But  I usually use Red Hat 7.3
> on our production servers as I really like the Red Hat Network up2date
> functionality which automatically applies security patches without
> needing human intervention.
>
> Basically, I am the sort of guy that wants to spend minimal time
> maintaining production servers that are not cutting edge so that I can
> concentrate my time on development work.
>
> But with Red Hat dropping Red Hat Network support for RH7.3, I am
> seriously considering changing our server platform over to Gentoo.
>
> Our server requirements are not cutting edge; we only need Apache, PHP.
> Perl and mySql (and maybe later some mail services). My question is: if
> I move our server platform to Gentoo, is there an automated way of
> applying security patches to the currently installed software that I can
> "fire and forget" without fear of things breaking big time.?
>
> I know this question is not very focused, but I wanted to start a
> discussion as to the best methods of automating security updates for
> non-cutting edge Apache/MySQl/PHP servers using Gentoo.
>
> Thanks for your help!
>
> Andy
>
> PS. Is there a web-archive of this list that I can search?
>