This topic is intended for system administrators or patch administrators in charge of performing patching for Linux servers in an environment that does not have access to the internet.
This topic is intended for system and patch administrators. The goal of this topic is to demonstrate how to organize patch information by setting up a central location for storing metadata about a type of patch. BSA calls these locations patch catalogs. By creating patch catalogs customized to your needs, it becomes easier to select the patches you want to evaluate on servers.
A patch catalog provides a place to store metadata about patches and the patch payloads themselves. Patch catalogs can be designed for specific needs. For example, a patch catalog can used for a particular operating system, such as Red Hat Enterprise Linux (RHEL). With well designed patch catalogs, it is easier to select the patches that should be used when evaluating the patch configuration of a particular server.
This walkthrough shows how to download RHEL patches from the Shavlik website to any server having internet access, using the offline downloader utility shipped with BMC Server Automation. After downloading the RHEL patches, you can perform patching operations by transferring the metadata and payload information, using a removable storage, to the patch repository within the air-gapped environment.
For this walkthrough, you must have the following:
Any server with access to the internet. In this walkthrough we will be using a Linux server to download the patch payload from the Red Hat website.
Note
In this walkthrough we will use the offline downloader utilities in the first directory path as we are downloading the patch payload on a Linux server.
The server that houses the patch repository must have the createrepo and pythonurl-grabber packages pre-installed before download begins. The required version for the packages is as follows:
Package | Tested version |
---|---|
createrepo | 0.4.6 |
pythonurl-grabber | 2.9.6 |
Note
You do not require createrepo and pythonurl-grabber if you are using a Microsoft Windows server to run the Patch Downloader utility.
Ensure that your Linux machine has the glibc.i686 library installed. Alternatively, you can ensure that the JRE version is upgraded to 1.8 or later.
The first step is to prepare the configuration file, which contains XML information that is used by the Patch Downloader utility. The configuration file must contain the download settings and patch filter information as show in the image below. You can also enter proxy server information if you are using one.
BMC Server Automation provides sample configuration files in the installer package at <installer-path>/Disk1/files/installers/other_files/All-OS-Patch-Downloaders-linux-build-8.7.00/sample-downloader-config-files/. Edit the sample XML configuration file (sample-redhat-downloader-config.xml) provided by BMC, and add the following XML tags based on your requirements:
(Optional) Add proxy information using the following XML tags:
Tag | Description |
---|---|
<port></port> | Port number used to communicate with the proxy server |
<host></host> | IP address or host name of the proxy server |
<username></username> | User name required for authentication prior to communication with the proxy server |
<password></password> | encrypted password for the specified user |
<domain-name></domain-name> | Domain name of the proxy server |
<proxy-type></proxy-type>
| Type of proxy server used
|
Define download settings using the following XML tags:
Tag | Description |
---|---|
<temporary-location>
| Location where files can be stored temporarily during the download process |
<payload-repository-location>
| Local location of the patch repository where metadata and payload are stored |
<download-request-retries>
| Number of times the download utility attempts to download if the first attempt at downloading a payload fails |
<download-request-timeout>
| Number of milliseconds that the utility waits for a response before considering the attempt as failed |
<downloader-parallel-threads> | Number of downloads that can be performed in parallel |
<temporary-location>/tmp</temporary-location> <validate-payload-certificate>true</validate-payload-certificate> <payload-repository-location>/home/Payload_location</payload-repository-location> <download-request-retries>10</download-request-retries> <download-request-timeout>180000</download-request-timeout> <downloader-parallel-threads>10</downloader-parallel-threads>
Specify filters to limit the patches downloaded in the catalog. The same filters entered here must also be entered during catalog creation in the console.
For example, to create a filter that downloads the latest RPMs by errata type, use the following XML tags:
Parameter | Description |
---|---|
<os></os> | OS for the channel label |
<arch></arch> | Architecture for the channel label |
<channel-label> | Channel label to download |
<errata-severity>
| Configure filter for metadata download of security advisory errata patches. For each classification, enter
|
<errata-type>
| Configure filter for metadata download of errata according to type. For each classification, enter
|
<errata-type-filter> <os>RHES5</os> <arch>x86</arch> <channel-label>rhel-i386-server-5</channel-label> <errata-severity> <critical>true</critical> <important>true</important> <moderate>true</moderate> <low>true</low> </errata-severity> <errata-type> <security>true</security> <bugfix>true</bugfix> <enhancement>true</enhancement> </errata-type> </errata-type-filter>
To create a filter that downloads a specific errata by errata id. This filter should be used only if the downloader is executed on a Linux machine. Use the following syntax:
<errata-ids-filter> <os>RHAS4</os> <arch>x86</arch> <channel-label>rhel-i386-as-4</channel-label> <errata-ids> <errata-id>RHSA-2009:0429</errata-id> <errata-id>RHBA-2009:0388</errata-id> </errata-ids> </errata-ids-filter>
Parameter | Description |
---|---|
<os> </os> | OS for the channel label |
<arch> </arch> | Architecture for the channel label |
<channel-label> | Channel label that you want to download |
<errata-id> | A valid Errata ID for the channel label specified in the filter |
(Not applicable for RHEL 7) To create a filter that downloads a specific update level, use the following syntax:
<update-level-filter> <os>RHAS4</os> <arch>x86</arch> <channel-label>rhel-i386-as-4</channel-label> <update-level>5</update-level> </update-level-filter>
Parameter | Description |
---|---|
<os></os> | OS for the channel label |
<arch></arch> | Architecture for the channel label |
<channel-label> | Channel label you want to download |
<update-level> | A valid update level for the channel label specified in the filter Note: The update-level filter works only on Linux computers. It does not work on windows computers. |
Save the configuration file. Use the sample configuration file below as a reference:
<redhat-downloader-config> <config> <!--<proxy-settings> <port>8080</port> <host>_IPAddress_</host> <username>patch</username> <password>NWKIPRTPCWEB</password> <domain-name /> <proxy-type>ntlm</proxy-type> </proxy-settings>--> <temporary-location>c:\tmp</temporary-location> <payload-repository-location>/home/repo/</payload-repository-location> <download-request-retries>10</download-request-retries> <download-request-timeout>180000</download-request-timeout> <downloader-parallel-threads>10</downloader-parallel-threads> </config> <subscription> <errata-type-filter> <os>RHES5</os> <arch>x86</arch> <channel-label>rhel-i386-server-5</channel-label> <errata-severity> <critical>true</critical> <important>true</important> <moderate>true</moderate> <low>true</low> </errata-severity> <errata-type> <security>true</security> <bugfix>true</bugfix> <enhancement>true</enhancement> </errata-type> </errata-type-filter> <errata-ids-filter> <os>RHAS4</os> <arch>x86</arch> <channel-label>rhel-i386-as-4</channel-label> <errata-ids> <errata-id>RHSA-2009:0429</errata-id> <errata-id>RHBA-2009:0388</errata-id> </errata-ids> </errata-ids-filter> <update-level-filter> <os>RHAS4</os> <arch>x86</arch> <channel-label>rhel-i386-as-4</channel-label> <update-level>5</update-level> </update-level-filter> </subscription> </redhat-downloader-config>
Navigate to the Windows offline downloader utility located in the installer package at the following location: <installer-path>/Disk1/files/installers/other_files/All-OS-Patch-Downloaders-linux-build-8.7.00 Run the offline downloader utility and pass the the location of the the configuration file as a parameter. The RHEL patch payload is downloaded to the payload repository location that you defined while creating the configuration file. (Optional) Transfer the metadata and payload information, using a removable storage, to the patch repository server within your air-gapped environment. However in this walkthrough we will use the same Linux server to host the repository location. The New Patch Catalog wizard opens. On the General panel perform the following: On the Red Hat Linux Catalog panel, select Source From Disk Repository (Offline Mode). In the Repository Options section, provide information in the following required fields: Repository Location: Browse to an appropriate location to serve as a patch repository. The repository can reside on any server that has an RSCD agent installed on it. BMC Server Automation processes the payload and metadata files from the payload source location and populates the repository location with Windows patches that are used by the catalog. Note: The payload source location and the repository location can be the same. Define the types of patches that you want to include in the catalog by selecting the same filters you have entered in the configuration file (as in this step). The Default Notifications panel appears. The Schedules panel allows you to schedule a job to execute immediately, schedule a job at a specific time in the future, schedule a job on a recurring basis, and define notifications that are issued when a job runs. Select the Execute job now option in the top-left corner of the Schedules panel to execute the catalog update job immediately after the wizard exits. Click Next. Click Next. Using the Permissions panel, you can add individual permissions to an object. You can also set permissions by adding ACL templates or ACL policies. For more information, see Patch catalog - Permissions. Click Finish. Step Example screen sh windows_downloader.sh -configFile <downloaderConfigurationFilePath>
<downloaderConfigurationFilePath>
with the location of the configuration file used by the Patch Downloader.Perform the following:
Note: If you set up notifications for a particular scheduled job, the default notifications set here will be overridden.The Properties panel provides a list of properties automatically assigned to a Catalog Job. For any property that has a check in the Editable column, select the property and click in the Value column. The Permissions list is an access control list (ACL) granting roles access to any objects created in the system, such as jobs, servers, or depot objects. ACLs control access to all objects, including the sharing of objects between roles.
Congratulations. You have downloaded Red Hat patch payload and metadata on a Linux machine. You have also set up a job that creates a patch catalog for RHEL that will run at a specific time in the future.
Now that you have a serviceable patch catalog it is time to use it to measure your RHEL servers for patch compliance. See Walkthrough: Basic Red Hat Linux patch analysis.