Re: [gentoo-server] prioritising security updates

[W.Kenworthy]

or to reduce bandwidth try this as the crontab command:

rsync --recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
rsync://rsync.gentoo.org/gentoo-portage/metadata/glsa/* /usr/portage/metadata/glsa/ ;glsa-check -n -l|grep "\[N"

This syncs only the glsa metadata, and the cron email also shows updates
that it has synced, but do not apply to your system.  However, when you
do a glsa -f package to apply the fix, you must first "emerge sync" to
update the full tree.  As glsa's that affect my systems are few and far
between, there's quite a bandwidth saving.

e.g.,

___________________
...
 
MOTD brought to you by motd-o-matic, version 0.3

receiving file list ... done
glsa-200509-03.xml
timestamp.chk

Number of files: 539
Number of files transferred: 2
Total file size: 1406439 bytes
Total transferred file size: 2153 bytes
Literal data: 2153 bytes
Matched data: 0 bytes
File list size: 8682
Total bytes written: 199
Total bytes read: 11353

wrote 199 bytes  read 11353 bytes  2100.36 bytes/sec
total size is 1406439  speedup is 121.75
WARNING: This tool is completely new and not very tested, so it should
not be
used on production systems. It's mainly a test tool for the new GLSA
release
and distribution system, it's functionality will later be merged into
emerge
and equery.
Please read http://www.gentoo.org/proj/en/portage/glsa-integration.xml
before using this tool AND before reporting a bug.

[N] indicates that the system might be affected.


___________________
In the above case, a new glsa (glsa-200509-03) has been issued, but it
doesnt apply.  On my todo list is to filter and summarize so all I get
is whats new, and what applies to me!

BillK


On Tue, 2005-09-06 at 23:12 -0700, Michael Irey wrote:
> To make it easy I have added these 2 lines to my crontab
>
> 10 2 * * * /usr/bin/emerge --sync 2> /dev/null
> > /root/tmp/daily-emerge-sync.txt
> 50 2 * * * /usr/bin/glsa-check -ln 2> /dev/null | grep ' \[N\]'
>
> Then every morning I get an email if there are packages with vulnerabilities.
>
> I can decide manually the priority.  Because I dont want apache updating
> itself in the middle of the night... I do it manually, from my emailed list.
>
>
> On Tuesday 06 September 2005 02:53 pm, Jeremy Brake wrote:
> > Hey,
> >
> > Is there anything in Portage which will allow me to view security
> > updates, seperate from general version updates?
> > At the moment i have a 5am cron job which runs "emerge --sync && emerge
> > -upvD world" , and i just glance at it as soon as I i sit down at my pc
> > for the day.
> > The problem here is that I cant tell if updates (eg, at the moment it
> > wants to update openssh and apache2) are security patches, or just
> > general version upgrades.
> >
> > I know i can use "system" instead of "world" and omit the -D option, but
> > thats not targeting my issue exactly. Is there a way to see which
> > updates are security patches, without having to manually trawl through
> > webpages and changelogs?
> >
> > Jeremy
-- 
gentoo-server@g.o mailing list