CentOS - Nov 2014 - yum-plugin-security

On Sat, 22 Nov 2014 13:17:59 -0600
Frank Cox <theatre at melvilletheatre.com> wrote:
> On Sat, 22 Nov 2014 19:52:30 +0100
> Gabriele Pohl wrote:
> > 
> > because I want the alert for my individual machines.
> > So the proposed method is no solution 
> > for an automagical trigger :)
> 
> You still can do that without expending too much effort.
Although the proposal you made is /possible/ to implement,
I will not do it, because I think that this is 
the wrong way to solve the issue.
> One way would be to monitor centos-announce, parse the subject lines, 
> copy the security update filenames to a text or database file. 
> (sqlite is made for this kind of thing.)
> You can either keep a list on each machine or have a central data
repository,
> whichever suits you best.
Pardon me, but I think it is madness to maintain the info outside of yum.

And your method is not suitable to use within Munin monitoring.
And a Munin capable solution is what I am looking for with highest priority.
> Then all you need to do is have each machine run "yum
check-update"
> on whatever timed basis you wish.  Capture the list of pending updates, 
> compare it against your database, and then do your thing.
I don't like to spend time in creating ugly workarounds..
and therefore would highly appreciate if the CentOS-Developers
will add the data to the yum repositories.
Then I can use Munin to monitor the pending security packages
also for CentOS as now only for my RHEL machines.

All the best and thanks again,

Gabriele

On Sat, Nov 22, 2014 at 11:41:17PM +0100, Gabriele Pohl
wrote:
> 
> I don't like to spend time in creating ugly workarounds..
> and therefore would highly appreciate if the CentOS-Developers
> will add the data to the yum repositories.
> Then I can use Munin to monitor the pending security packages
> also for CentOS as now only for my RHEL machines.
It's not that simple.  Please have a look at the list archives in the
past couple months where this was addressed.  The threads were either
here or on the centos-devel mailing list.


http://lists.centos.org/pipermail/centos
http://lists.centos.org/pipermail/centos-devel

If memory serves the primary factor that is holding this up is a space
requirements issue; the threads can shed more light on it, however.






						John
-- 
"Which is more believable: In the beginning there was God, who created the
universe, or in the beginning there was nothing, which exploded?"

-- <nog>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL:
<http://lists.centos.org/pipermail/centos/attachments/20141122/470d5262/attachment-0001.sig>

On Sat, 22 Nov 2014 17:10:40 -0600
"John R. Dennison" <jrd at gerdesas.com> wrote:
> On Sat, Nov 22, 2014 at 11:41:17PM +0100, Gabriele Pohl wrote:
> > 
> > I don't like to spend time in creating ugly workarounds..
> > and therefore would highly appreciate if the CentOS-Developers
> > will add the data to the yum repositories.
> > Then I can use Munin to monitor the pending security packages
> > also for CentOS as now only for my RHEL machines.
> 
> It's not that simple.  Please have a look at the list archives in the
> past couple months where this was addressed.  The threads were either
> here or on the centos-devel mailing list.
thanks to Nux! who posted the following link in
the first reply of this thread:

----------------------------
Begin forwarded message:

Date: Sat, 22 Nov 2014 12:44:57 +0000 (GMT)
From: Nux! <nux at li.nux.ro>
To: CentOS mailing list <centos at centos.org>
Subject: Re: [CentOS] yum-plugin-security


This plugin does not work on CentOS, at least not yet, there were previous
discussions. e.g.
http://centos-devel.1051824.n5.nabble.com/CentOS-devel-yum-plugin-security-and-shellshock-td5710031.html
----------------------------

I read this thread and also another, which is refered to therein:
http://lists.centos.org/pipermail/centos-devel/2014-September/011893.html
> If memory serves the primary factor that is holding this up is a space
> requirements issue; the threads can shed more light on it, however.
To tell the truth, as a person who is not familiar with the 
internal structures and procedures of tree building and 
maintenance of the repositories, I don't really understand 
why it should be so difficult to handle a "security-update" flag 
for the update packages, but I have to believe the experts, 
who make statements on this topic.

Here is what I picked up when reading the thread from devel list:

1. For a valid approach data for all packages over 
the complete history of the major version is needed.

2. At the time the data is only sent to the announce mailing list
and it will need a big effort with also manual work to 
collect all the data back from there.

3. "it would add significantly to the size required to
mirror CentOS and require a redesign of how we do trees completely (we
currently only push the latest tree for each live major version)." (Johnny
Hughes)

4. The developers fear that the yum-plugin-security functions
may seduce people to only install the security relevant packages,
which can cause problems.

5. The tools used by scientific linux repo maintainers,
who support a security classification,  
are availabe under free software license.
https://cdcvs.fnal.gov/redmine/projects/python-updateinfo

My personal view is represented by the mails of Kevin Stange in this thread.
And I still hope that the issue will be solved by 
integrating the "security update" flag into the
CentOS repositories in the future.

so far and thanks for your replies to all contributors in this thread,

Gabriele