Walkthrough: Setting up and managing an offline patch catalog for Linux

This topic is intended for system administrators or patch administrators in charge of performing patching for Linux servers in an environment that does not have access to the internet.

Introduction

This topic is intended for system and patch administrators. The goal of this topic is to demonstrate how to organize patch information by setting up a central location for storing metadata about a type of patch. TrueSight Server Automation calls these locations patch catalogs. By creating patch catalogs customized to your needs, it becomes easier to select the patches you want to evaluate on servers.

What is a patch catalog?

A patch catalog provides a place to store metadata about patches and the patch payloads themselves. Patch catalogs can be designed for specific needs. For example, a patch catalog can used for a particular operating system, such as Red Hat Enterprise Linux (RHEL). With well designed patch catalogs, it is easier to select the patches that should be used when evaluating the patch configuration of a particular server.

 What does this walkthrough show?

This walkthrough shows how to download RHEL patches from the Red Hat website to any server having internet access, using the offline downloader utility shipped with TrueSight Server Automation. After downloading the RHEL patches, you can perform patching operations by transferring the metadata and payload information, using a removable storage, to the patch repository within the air-gapped environment.

• Download the payload and metadata information from Red Hat website to any server having internet access. In this walkthrough, we will download the patch payload and metadata to a Linux server.
• Use filters to limit the amount of information added to the catalog.

• Schedule the catalog update job to run at a particular time in future and set up notifications for the patch administrator in charge of Linux patching.

  From TrueSight Server Automation 8.9.02 and later, certificates are mandatory to create RHEL patch catalog because now all the catalogs use CDN.

What do I need to do before I get started?

For this walkthrough, you must have the following:

• An air-gapped environment that uses TrueSight Server Automation 8.6 or later to manage its Red Hat servers.

• Any server with access to the internet. In this walkthrough we will be using a Linux server to download the patch payload from the Red Hat website.

• From the BMC Software Electronic Product Distribution (EPD) website, download and extract the installer package (BSA<version>-<platform>64) to the Linux machine on which you want to download the payload and metadata. For steps on downloading installer package files from the EPD website, see Downloading the installation files.
• After extracting the BSA<version>-<platform>64 installer package that you have downloaded from the EPD, navigate to either of the following directories:

• Ensure that TrueSight Server Automation supports the operating system running on server that you plan to store the Red Hat patch repository.

   Click here to see the platforms supported for storing your repository

  *

  • Add filter
  • Reset column sorting
  • Export to PDF
  • Export to CSV
  • Export to Word
  • Copy the filter URL
  • Modify Settings

  • Documentation
  • What's new
  • Rate our app

  Patch catalog = ≠

  Showing the first all rows

  Start adding filters in the filter tools menu.

  The filter is disabled at the moment.

  • Export to PDF
  • Export to CSV
  • Export to Word

  • Documentation
  • What's new
  • Rate our app

  Oops, it seems that you need to place a table or a macro generating a table within the Table Filter macro.

  The table is being loaded. Please wait for a bit ...

  Patch catalog	Supported platforms for storing patch repositories
  Windows	Windows or Unix
  AIX	Any AIX server Note: If you are downloading patches using the SUMA option, ensure that you have the SUMA utility installed on your repository server.
  Red Hat Enterprise Linux (RHEL) using the CDN interface	Red Hat Enterprise Linux 6, 7, or 8
  SuSE Linux 15	To patch SuSE 15 targets, ensure that the patch repository server runs the SuSE 11 or 12 system and is configured with Subscription Management Tool (SMT). A server that runs SuSE 15 with RMT is not supported for the patch repository.
  SuSE Linux 12	SuSE Linux with SMT installed. Note:To patch SuSE 12 targets, ensure that the SuSE patch repository server is configured with SMT. The following table lists the versions that are installed with SMT out-of-the-box, as well as the versions on which SMT must be manually installed. Repository server version SMT installation SuSE 11 SP3 SuSE 11 SP4 SuSE 12 Note: SuSE recommends upgrading SuSE 12 to SuSE 12 SP1 to avoid dependency issues. Not configured with SMT out of the box. You must manually install and configure SMT (version 11 SP3) on the repository server before you create a SuSE patch catalog. SuSE 12 SP1 or later (recommended) SMT is shipped out-of-the-box with the operating system. Warning: BMC strongly recommends using Zypper when creating a patching job for a patch catalog that was created using the Subscription Management Tool (SMT). For more information, see Zypper patching tool.
  SuSE Linux 11	SuSE Linux with createrepo and python-urlgrabber installed.
  Oracle Enterprise Linux	Any supported RPM-based Linux with createrepo and python-urlgrabber installed
  Solaris	Windows or Unix Note: If you are using Solaris 11 patches, you can only use a Solaris 11 server for storing the patch repository.
  Ubuntu	Unix
  Debian	Windows or Unix
  Cent OS	For CentOS 7, use a patch repository created on the system that runs CentOS 7. Similarly, for CentOS 8, use the patch repository created on the system that runs CentOS 8. Ensure that createrepo and python-urlgrabber are installed on the CentOS system.
  Fujitsu Solaris	Windows or Linux
  HP-UX	An HP-UX patch repository must reside either directly on the HP-UX (SWA) Server or in a directory that the SWA Server considers to be a local share. Note that if you are using an offline downloader, you can run the offline downloader on any Windows or Linux machine, but the HP-UX patch repository must still reside on the HP-UX (SWA) Server.

• The server that houses the patch repository must have the createrepo and pythonurl-grabber packages pre-installed before download begins.

  Note

  You do not require createrepo and pythonurl-grabber if you are using a Microsoft Windows server to run the Patch Downloader utility.

  If you are using a Microsoft Windows server in TrueSight Server Automation 8.9.02, you cannot download the patches.

• Ensure that your Linux machine has the glibc.i686 or glibc.i386 library installed. Alternatively, you can ensure that the JRE version is upgraded to 1.8 or later.

Step 1: How to add configuration settings and filter information to sample XML file

The first step is to prepare the configuration file, which contains XML information that is used by the Patch Downloader utility. The configuration file must contain the download settings and patch filter information as show in the image below. You can also enter proxy server information if you are using one.

TrueSight Server Automation provides sample configuration files in the installer package at <installer-path>/Disk1/files/installers/other_files/All-OS-Patch-Downloaders-linux-build-8.7.00/sample-downloader-config-files/. Edit the sample XML configuration file (sample-redhat-downloader-config.xml) provided by BMC, and add the following XML tags based on your requirements:

(Optional) Add proxy information using the following XML tags:

<port></port>

<host></host>

<username></username>

<password></password>

<domain-name></domain-name>

<proxy-type></proxy-type>

1. Define download settings using the following XML tags:

   Tag	Description
   <temporary-location> </temporary-location>>	Location where files can be stored temporarily during the download process
   <payload-repository-location> </payload-repository-location>	Local location of the patch repository where metadata and payload are stored
   <download-request-retries> </download-request-retries>	Number of times the download utility attempts to download if the first attempt at downloading a payload fails
   <download-request-timeout> </download-request-timeout>	Number of milliseconds that the utility waits for a response before considering the attempt as failed This parameter is useful if the http response is slow.
   <downloader-parallel-threads> </downloader-parallel-threads>	Number of downloads that can be performed in parallel

   Example of download settings in configuration file

    <temporary-location>/tmp</temporary-location>
    <validate-payload-certificate>true</validate-payload-certificate>
    <payload-repository-location>/home/Payload_location</payload-repository-location>
    <download-request-retries>10</download-request-retries>
    <download-request-timeout>180000</download-request-timeout>
    <downloader-parallel-threads>10</downloader-parallel-threads>

   • If you are downloading rpms from CDN (reposync), you must add tags to specify the location of Red Hat certificates required for downloading the rpms.

   The syntax for the tags are as follows:

   <redhat-cert cert-arch="<arch>">             
   <caCert></caCert>

      <clientCert></clientCert>

      <clientKey></clientKey>

   </redhat-cert>

   Tag	Description
   <redhat-cert cert-arch="<arch>"> </redhat-cert>	The variable <arch> can be x86, x86_64, s390x, or ppc64.  Click here to expand a table that lists the OS version-Architecture combination of patches that are supported by the CDN (reposync) Red Hat network. RHEL version Supported processor architectures Support for child channels RHEL 6 and 7 x86_64 x86 s390x zSeries ppc64 pSeries ppc64le  Yes RHEL 5 x86_64 x86 s390x zSeries Yes RHEL 4 x86_64 x86 No
   <caCert> </caCert>	Holds the location of the CA certificate file (redhat-uep.pem) that is copied from the /etc/rhsm/ca/ directory of the RHEL 7 server, see the Before you begin section of Creating a patch catalog.
   <clientCert> </clientCert>	Holds the location of the subscription certificate file (client-cert.pem) that is downloaded from the Red Hat subscription management service, see the Before you begin section of Creating a patch catalog.
   <clientKey> </clientKey>	Holds the location of the system ID file (client-key.pem) that is downloaded from the Red Hat subscription management service, see the Before you begin section of Creating a patch catalog.

   


   Example of tags   Expand source

   <redhat-cert cert-arch="x86_64">              
      <caCert>/home/certs/rh-sslcacert.pem</caCert>
      <clientCert>/home/certs/rh-sslclientcert.pem</clientCert>
      <clientKey>/home/certs/rh-sslclientkey.pem</clientKey>
   </redhat-cert>

   


2. Specify filters to limit the patches downloaded in the catalog. The same filters entered here must also be entered during catalog creation in the console.

   • For example, to create a filter that downloads the latest RPMs by errata type, use the following XML tags:

     Parameter	Description
     <os></os>	Operating system for the channel label
     <arch></arch>	Architecture for the channel label
     <channel-label> </channel-label>	Label of the channel or child channel to download from Example of a channel label: rhel-i386-server-5 Example of a child channel label: rhel-i386-server-supplementary-5
     <channel-url> </channel-url>	Url of the channel to download from. NEW IN 8.9.02CDN is supported for all the filters of Red Hat. This is mandatory for <errata-ids-filter> and <errata-type-filter>. You can get the command URL by using the following command: [root@clm-pun-srtffq All-OS-Patch-Downloaders-linux-build-8.9.02]# ./redhat_downloader.sh -listChannels
     <errata-severity> </errata-severity>	Configure filter for metadata download of security advisory errata patches. For each classification, enter True to include patches of that type or False to exclude patches of that type. <critical> <important> <moderate> <low>
     <errata-type> </errata-type>	Configure filter for metadata download of errata according to type. For each classification, enter True to include patches of that type or False to exclude patches of that type. <security></security> <bugfix></bugfix> <enhancement></enhancement>

     Note

     If you want to add child channels for errata filters, use the same tags and add the child channel details in the <os></os>, <arch></arch>, <channel-label></channel-label> and <channel-url></channel-url>parameters.

     <errata-type-filter>
      <os>RHES7</os>
      <arch>x86_64</arch>
      <channel-label>rhel-7-server-rpms</channel-label>
      <channel-url>https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os</channel-url>
      <errata-severity>
      <critical>true</critical>
      <important>true</important>
      <moderate>true</moderate>
      <low>true</low>
      </errata-severity>
      <errata-type>
      <security>true</security>
      <bugfix>true</bugfix>
      <enhancement>true</enhancement>
      </errata-type>
      </errata-type-filter>

• To create a filter that downloads a specific errata by errata id. This filter should be used only if the downloader is executed on a Linux machine. Use the following syntax:

  <errata-ids-filter>
            <os>RHAS4</os>
            <arch>x86</arch>
            <channel-label>rhel-i386-as-4</channel-label>
            <channel-url>https://cdn.redhat.com/content/dist/rhel/as/4/4AS/i386/os</channel-url>
            <errata-ids>
                <errata-id>RHSA-2009:0429</errata-id>
                <errata-id>RHSA-2009:0430</errata-id>
                <errata-id>RHEA-2009:0422</errata-id>
                <errata-id>RHBA-2009:0407</errata-id>
                <errata-id>RHSA-2009:0397</errata-id>
                <errata-id>RHBA-2009:0388</errata-id>
            </errata-ids>
        </errata-ids-filter>

<os> </os>

<arch> </arch>

<channel-label> 
</channel-label>

<errata-id> 
</errata-id>

To create a filter that downloads a specific update level, use the following syntax:

		<update-level-filter>
            <os>RHES7</os>
            <arch>x86_64</arch>
            <channel-label>rhel-7-server-rpms</channel-label>
            <iso-url>https://cdn.redhat.com/content/dist/rhel/server/7/7.1/x86_64/iso/rhel-server-7.1-x86_64-dvd.iso</iso-url>
            <update-level>1</update-level>
        </update-level-filter>

<os></os>

<arch></arch>

<channel-label></channel-label>

<update-level></update-level>

1. Save the configuration file. Use the sample configuration file below as a reference:
   
   

   <redhat-downloader-config>
       <config>
           <!--<proxy-settings>
                   <port>8080</port>
                   <host>127.0.0.1</host>
                   <username>user</username>
                   <password></password>
                   <domain-name></domain-name>
                   <proxy-type>ntlm-v2</proxy-type>
                   <protocol>http</protocol>
           </proxy-settings>-->
           <temporary-location>/tmp</temporary-location>
           <payload-repository-location>/home/repo/</payload-repository-location>
           <!-- The default value for download-request-retries will be 10 if no value is specified -->
           <download-request-retries>10</download-request-retries>
           <download-request-timeout>180000</download-request-timeout>
           <downloader-parallel-threads>10</downloader-parallel-threads>
       </config>
   
       <subscription>
       
           <redhat-cert cert-arch="x86_64">
               <caCert>/home/certs/rh-sslcacert.pem</caCert>
               <clientCert>/home/certs/rh-sslclientcert.pem</clientCert>
               <clientKey>/home/certs/rh-sslclientkey.pem</clientKey>
           </redhat-cert>
           
           <errata-ids-filter>
               <os>RHAS4</os>
               <arch>x86</arch>
               <channel-label>rhel-i386-as-4</channel-label>
               <channel-url>https://cdn.redhat.com/content/dist/rhel/as/4/4AS/i386/os</channel-url>
               <errata-ids>
                   <errata-id>RHSA-2009:0429</errata-id>
                   <errata-id>RHSA-2009:0430</errata-id>
                   <errata-id>RHEA-2009:0422</errata-id>
                   <errata-id>RHBA-2009:0407</errata-id>
                   <errata-id>RHSA-2009:0397</errata-id>
                   <errata-id>RHBA-2009:0388</errata-id>
               </errata-ids>
           </errata-ids-filter>
           
           <errata-type-filter>
               <os>RHES7</os>
               <arch>x86_64</arch>
               <channel-label>rhel-7-server-rpms</channel-label>
                 <channel-url>https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os</channel-url>
               <errata-severity>
                   <critical>true</critical>
                   <important>true</important>
                   <moderate>true</moderate>
                   <low>true</low>
               </errata-severity>
               <errata-type>
                   <security>true</security>
                   <bugfix>true</bugfix>
                   <enhancement>true</enhancement>
               </errata-type>
           </errata-type-filter>
           
           <update-level-filter>
               <os>RHES7</os>
               <arch>x86_64</arch>
               <channel-label>rhel-7-server-rpms</channel-label>
               <iso-url>https://cdn.redhat.com/content/dist/rhel/server/7/7.1/x86_64/iso/rhel-server-7.1-x86_64-dvd.iso</iso-url>
               <update-level>1</update-level>
           </update-level-filter>
   
       </subscription>
   </redhat-downloader-config>
   
   

Step 2: How to create a Red Hat Linux patch catalog

Step	Example screen
Navigate to the Windows offline downloader utility located in the installer package at the following location:  <installer-path>/Disk1/files/installers/other_files/All-OS-Patch-Downloaders-linux-build-8.7.00 Replace <installer-path> with the path to the extracted installer package on the Linux payload machine. From TrueSight Server Automation 8.9.02, Windows offline downloader utility is not supported. Only Linux offline downloader utility is supported.
Run the offline downloader utility and pass the the location of the the configuration file as a parameter. sh redhat_downloader.sh -configFile <configFile> Replace <downloaderConfigurationFilePath> with the location of the configuration file used by the Patch Downloader.
The RHEL patch payload is downloaded to the payload repository location that you defined while creating the configuration file. (Optional) Transfer the metadata and payload information, using a removable storage, to the patch repository server within your air-gapped environment. However in this walkthrough we will use the same Linux server to host the repository location.
Perform the following: In the console Folders view, expand the Depot folder. Navigate to an existing folder or create a new folder for the patch catalog. The example screenshot on the right uses a folder named Patch Catalog. Right-click the folder in which you want to store the new catalog and select New > Patch Catalog > Red Hat Linux Patch Catalog.
The New Patch Catalog wizard opens. On the General panel perform the following: In the Name field, provide a name for the new catalog. In the Description field, optionally, provide a description of the new catalog. In the Save in field, verify that the displayed path name is the folder in which you want to save the catalog. If necessary, you can browse to another location. Click Next.
On the Red Hat Linux Catalog panel, select Source From Disk Repository (Offline Mode).
In the Repository Options section, provide information in the following required fields: Payload Source Location: Browse to the location where the metadata and payload files are stored. It must be stored on a server, with an RSCD agent installed on it. Repository Location: Browse to an appropriate location to serve as a patch repository. TrueSight Server Automation processes the payload and metadata files from the payload source location and populates the repository location with Windows patches that are used by the catalog. Note: The payload source location and the repository location can be the same.
Define the types of patches that you want to include in the catalog by selecting the same filters you have entered in the configuration file. In the Filters section, click . The Add Windows Filter panel appears. Select the channel from the list provided. The operating system (OS) and architecture are supplied automatically in read-only boxes. If you want to filter by update level, click Enable Update Level and select the Update Level from the list provided. Click OK. The second screenshot on the right, shows a completed Red Hat Catalog panel for Offline mode with two filter selections. Click Next.
The Default Notifications panel appears. Define the type of notifications and under which circumstances (status of the Catalog update job) the notifications are sent. Note: If you set up notifications for a particular scheduled job, the default notifications set here will be overridden. Click Next.
The Schedules panel allows you to schedule a job to execute immediately, schedule a job at a specific time in the future, schedule a job on a recurring basis, and define notifications that are issued when a job runs. Select the Execute job now option in the top-left corner of the Schedules panel to execute the catalog update job immediately after the wizard exits.  If you want to schedule the execution of the catalog update job at a future time, click here ... Click . The Add New Schedule dialog box appears. Because we want the Patch Catalog Job to execute once at a particular time in future, we will select the Once option in the Occurrence panel. To select a recurring schedule you can select the appropriate option. Select the time and date that you want the job to execute. Select the appropriate time zone you want to follow. Define a priority for the job execution. Click the Scheduled Job Notifications tab. Define the type of notification that the scheduled job should send and under which circumstances (status of the catalog update job) the notifications are sent. This will override the settings defined in the Default Notifications panel. Click OK. Continue adding more schedules based on your requirement. Click Next.
The Properties panel provides a list of properties automatically assigned to a Catalog Job. For any property that has a check in the Editable column, select the property and click in the Value column. Click Next.
The Permissions list is an access control list (ACL) granting roles access to any objects created in the system, such as jobs, servers, or depot objects. ACLs control access to all objects, including the sharing of objects between roles. Using the Permissions panel, you can add individual permissions to an object. You can also set permissions by adding ACL templates or ACL policies. For more information, see Patch catalog - Permissions. Click Finish.

Wrapping it up

Congratulations. You have downloaded Red Hat patch payload and metadata on a Linux machine. You have also set up a job that creates a patch catalog for RHEL that will run at a specific time in the future.

Where to go from here

Now that you have a serviceable patch catalog it is time to use it to measure your RHEL servers for patch compliance. See Walkthrough: Basic Red Hat Linux patch analysis.