
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
OS Hardening Principles
|
57
bother checking for updates to those packages. Figure 3-2 shows a screen from a file
server of mine on which I run custom kernels and therefore don’t care to download
kernel rpms.
After installing Red Hat, registering with the Red Hat Network, configuring
up2date
and running it for the first time to make your system completely current, you can
take a brief break from updating. That break should last, however, no longer than it
takes to receive a new security advisory email from Redhat-Watch that’s relevant to
your system.
RPM updates for the extremely cautious
up2date’s speed, convenience, and automated signature checking are appealing. On
the other hand, there’s something to be said for fully manual application of security
updates. Updating a small number of packages really isn’t much more trouble with
plain old rpm than with up2date, and it has the additional benefit of not requiring
Red Hat Network registration. Best of all from a security standpoint, what you see is
what you get: you don’t have to rely on up2date to relay faithfully any and all errors
returned in the downloading, signature-checking, and package-installation steps.
Figure 3-2. Red Hat’s up2date: skipping unwanted updates