Re: OS patching via cfengine

[Jamie Wilkinson]

Quoting Nate Campi <nate@campin.net>:

> On the same topic, but with a debian focus, has anyone had any problems
> with debian auto-updates using stable (apt-get -q -q -y -u
> dselect-upgrade)? I do it on some non-production hosts and my
> workstation, but I've always been hesitant to do it for production
> hosts. Kernels are always separate packages and never actually upgrade,
> right?

I used to do a daily update and a weekly upgrade on workstations.  Now I'm using
a local repository for our own packages and also to cache "vetted" packages --
while we trust the packagers, we still like to give the new packages a cooling
off period before they go live, the theory being that we can actually check the
package before it gets installed on all the servers.

apt-proxy (or current for Red Hat using up2date) is good for the cache,
mini-dinstall for uploading your own packages into a local repository.

Jamie