Rainer Duffner wrote: > Am 19.02.2009 um 17:32 schrieb Jeff Schroeder: > > >> Like anything systems related the "proper way" is with a dedicated >> testing environment and a configuration management tool. Some pretty >> big companies use puppet. Some other really big companies (one of >> which I formerly worked for) use Spine >> (http://code.ticketmaster.com/index.php?page=spine) >> > > > > OK, we will be using puppet in the future. > > But it doesn't answer the question of: > - what's the revision of package "X" on my hosts > - which any CVE's apply? > - and similar questions > > > We would have little problems patching sshd on most of our hosts - but > patching apache or tomcat would need some testing. > > So, the question is not wether we can automate the patch-process > itself, but rather the "getting an overview"-phase. > > We are an ISP with a rather large managed hosting infrastructure - we > don't have 500 hosts running all the same version of apache + php. > We want to be able to make an informed decision as to which hosts > actually need patching, based on various criteria. > > Pakiti looked good - but it seems that either CERN has stopped > development or doesn't publish the code anymore. > Hm. The author still seems to work at CERN - I might just as well ask > him. > > > > Rainer > _______________________________________________ > cobbler mailing list > [email protected] > https://fedorahosted.org/mailman/listinfo/cobbler >
I still think Func would be ideally suited to generating some quick and dirty reports about what systems would need updates. It already has yum and RPM modules for this, and you could use things like the "exploding laptop finder" and "func-inventory" for examples on how to write some simple reports to do just that. If shiny enough, we could probably package them as /usr/bin/func-package-report as we do with func-inventory today. --Michael _______________________________________________ cobbler mailing list [email protected] https://fedorahosted.org/mailman/listinfo/cobbler
