Security of rhn and up2date

thetwin · 09-11-2003, 03:01 PM

Hello All

Does anyone know of or heard of the automatic update service of Redhat up2date being a security issue. I did not install this service on my firewall and generally download the updates from Redhat from a machine inside the network, ftp them onto the firewall and install the updates. I am thinking of putting the up2date service on the firewall.

Thanks in advance

complus · 09-11-2003, 03:46 PM

I have just recently started my search for an answer to the exact same question. I want my installation to be current, but I don't want to jeopardize the security of it to get there. I do not know the security issues involved with running up2date and rhn.

Have you had any luck in your search?

Thanks

unSpawn · 09-11-2003, 06:42 PM

Not any issues I know of if you install the latest packages, but since this is a single-purpose box (w/o any network daemons running on it RIGHT?) it shouldn't have that many packages installed. You need it 24/7 w/o glitches, I'd say if you got the time, go for manual. If you do use up2date make sure you never ever automagically update crucial stuff like the kernel or glibc.

thetwin · 09-11-2003, 07:40 PM

As far as I know I only installed the minimum packages. I am not 100 percent sure which daemons constitute all of the "network daemons' however there are no services running open to the Internet. i.e. Apache, ssh, telnet, ftp. When I need to ftp the upgrade rpm's onto the firewall/router, it is necessary for me to go into xinetd.d and turn the wu-ftpd service on. (only open to the internal network). I then turn it off again and restart xinetd. Kinda the long way to do things This box does hand IP's to the internal network though. Did I mention I am a newbie

Cheers

unSpawn · 09-14-2003, 05:02 PM

When I need to ftp the upgrade rpm's onto the firewall/router, it is necessary for me to go into xinetd.d and turn the wu-ftpd service on. (only open to the internal network). I then turn it off again and restart xinetd.
Or run OpenSSH and just scp the data over. OpenSSH comes in handy as well when you need to be on the box for other reasons as well I'd say. Just make sure you log in as regular user and sudo to root.