Keeping on top of your systems security updates is one important step in a defense in depth strategy for your solution. Security best practices indicate security updates should be applied within 30 days of being released.
While I prefer to test any and all updates in a test environment before deploying to production just in case the updates break existing functionality, some system administrators prefer to have the updates applied automatically nightly or weekly. The school of thought behind this is automatic updates are applied quickly, more often, and generally more consistently than they would be if done manually.
Also, its important to ensure that you are excluding any packages that may be critical to your system, such as the kernel or perhaps MySQL. The package exclusion list is provided in the example below.
Please keep in mind, in rare cases, system updates have been known to cause problems. So you should be cautious with any type of automatic updates, especially on production systems, and fully understand the risks involved before proceeding.
To enable automatic updates, first update yum, then install the yum-cron package:
[root@web01 ~]# yum -y update yum [root@web01 ~]# yum -y install yum-cron [root@web01 ~]# systemctl enable yum-cron [root@web01 ~]# systemctl start yum-cron
The configuration is pretty simplified on CentOS 7 as shown below:
[root@web01 ~]# vim /etc/yum/yum-cron.conf ... # What kind of update to use: # default = yum upgrade # security = yum --security upgrade # security-severity:Critical = yum --sec-severity=Critical upgrade # minimal = yum --bugfix update-minimal # minimal-security = yum --security update-minimal # minimal-security-severity:Critical = --sec-severity=Critical update-minimal update_cmd = default # Whether a message should be emitted when updates are available, # were downloaded, or applied. update_messages = yes # Whether updates should be downloaded when they are available. download_updates = yes # Whether updates should be applied when they are available. Note # that download_updates must also be yes for the update to be applied. apply_updates = yes # The address to send email messages from. email_from = [email protected] # List of addresses to send messages to. email_to = [email protected] ...
If you would like to exclude specific packages from receiving automatic updates, you can add exclusions. In this example, we are excluding updates to the mysql and the kernel. Please note this must be done in the ‘base’ section of the configuration as shown below:
[root@web01 ~]# vim /etc/yum/yum-cron.conf ... [base] # This section overrides yum.conf exclude=mysql* kernel* ...
After you make your changes to the configuration file, restart yum-cron by:
[root@web01 ~]# systemctl restart yum-cron
Once that is complete, no further configuration should be needed as yum-cron will run when the daily cron jobs are set to run.
If you find that you need to roll back a package update, you can do that by:
[root@web01 ~]# yum history
Loaded plugins: fastestmirror
ID | Login user | Date and time | Action(s) | Altered
-------------------------------------------------------------------------------
9 | root | 2016-02-09 17:47 | Install | 1
8 | root | 2016-02-09 17:47 | Update | 1
7 | root | 2015-08-18 03:19 | I, O, U | 189 EE
6 | root | 2015-03-01 16:44 | Install | 1
5 | root | 2015-03-01 16:31 | Erase | 1
4 | root | 2015-03-01 16:30 | Install | 49
3 | root | 2015-03-01 16:28 | Install | 1
2 | root | 2015-03-01 16:25 | I, U | 80
1 | System | 2015-03-01 15:52 | Install | 298
[root@web01 ~]# yum history undo ID