<HTML ><HEAD ><TITLE >Step 2: Updating</TITLE ><META NAME="GENERATOR" CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+ "><LINK REL="HOME" TITLE="Security Quick-Start HOWTO for Red Hat Linux" HREF="index.html"><LINK REL="PREVIOUS" TITLE="Step 1: Which services do we really need?" HREF="services.html"><LINK REL="NEXT" TITLE="Step 3: Firewalls and Setting Access Policies" HREF="firewalls.html"></HEAD ><BODY CLASS="SECT1" BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#0000FF" VLINK="#840084" ALINK="#0000FF" ><DIV CLASS="NAVHEADER" ><TABLE SUMMARY="Header navigation table" WIDTH="100%" BORDER="0" CELLPADDING="0" CELLSPACING="0" ><TR ><TH COLSPAN="3" ALIGN="center" >Security Quick-Start HOWTO for Red Hat Linux</TH ></TR ><TR ><TD WIDTH="10%" ALIGN="left" VALIGN="bottom" ><A HREF="services.html" ACCESSKEY="P" >Prev</A ></TD ><TD WIDTH="80%" ALIGN="center" VALIGN="bottom" ></TD ><TD WIDTH="10%" ALIGN="right" VALIGN="bottom" ><A HREF="firewalls.html" ACCESSKEY="N" >Next</A ></TD ></TR ></TABLE ><HR ALIGN="LEFT" WIDTH="100%"></DIV ><DIV CLASS="SECT1" ><H1 CLASS="SECT1" ><A NAME="UPDATES">4. Step 2: Updating</H1 ><P > OK, this section should be comparatively short, simple and straightforward compared to the above, but no less important.</P ><P > The very first thing after a new install you should check the errata notices at <A HREF="http://redhat.com/errata/" TARGET="_top" >http://redhat.com/apps/errata/</A >, and apply all relevant updates. Only a year old you say? That's a long time actually, and not current enough to be safe. Only a few months or few weeks? Check anyway. A day or two? Better safe than sorry. It is quite possible that security updates have been released during the pre-release phase of the development and release cycle. If you can't take this step, disable any publicly accessible services until you can. </P ><P > Linux distributions are not static entities. They are updated with new, patched packages as the need arises. The updates are just as important as the original installation. Even more so, since they are fixes. Sometimes these updates are bug fixes, but quite often they are security fixes because some hole has been discovered. Such <SPAN CLASS="QUOTE" >"holes"</SPAN > are <EM >immediately</EM > known to the cracker community, and they are quick to exploit them on a large scale. Once the hole is known, it is quite simple to get in through it, and there will be many out there looking for it. And Linux developers are also equally quick to provide fixes. Sometimes the same day as the hole has become known! </P ><P > Keeping <EM >all</EM > installed packages current with your release is one of the most important steps you can take in maintaining a secure system. It can not be emphasized enough that all installed packages should be kept updated -- not just the ones you use. If this is burdensome, consider uninstalling any unused packages. Actually this is a good idea anyway. </P ><P > But where to get this information in a timely fashion? There are a number of web sites that offer the latest security news. There are also a number of mailing lists dedicated to this topic. In fact, Red Hat has the <SPAN CLASS="QUOTE" >"watch"</SPAN > list, just for this purpose at <A HREF="https://listman.redhat.com/mailman/listinfo/redhat-watch-list" TARGET="_top" >https://listman.redhat.com/mailman/listinfo/redhat-watch-list</A >. This is a very low volume list by the way. This is an excellent way to stay abreast of issues effecting your release, and is <EM >highly recommended</EM >. <A HREF="http://linuxsecurity.com" TARGET="_top" >http://linuxsecurity.com</A > is a good site for Linux only issues. They also have weekly newsletters available: <A HREF="http://www.linuxsecurity.com/general/newsletter.html" TARGET="_top" >http://www.linuxsecurity.com/general/newsletter.html</A >. </P ><P > Red Hat also has the <SPAN CLASS="APPLICATION" >up2date</SPAN > utility for automatically keeping your system(s) up to date ;-). See the man page for details. </P ><P > This is not a one time process -- it is ongoing. It is important to stay current. So watch those security notices. And subscribe to that security mailing list today! If you have cable modem, DSL, or other full time connection, there is no excuse not to do this religiously. All distributions make this easy enough! </P ><P > One last note: any time a new package is installed, there is also a chance that a new or revised configuration has been installed as well. Which means that if this package is a server of some kind, it may be enabled as a result of the update. This is bad manners, but it can happen, so be sure to run <SPAN CLASS="APPLICATION" >netstat</SPAN > or comparable to verify your system is where you want it after any updates or system changes. In fact, do it periodically even if there are no such changes. </P ><DIV CLASS="SECT2" ><H2 CLASS="SECT2" ><A NAME="AEN571">4.1. Summary and Conclusions for Step 2</H2 ><P > It is very simple: make sure your Linux installation is current. Check the Red Hat errata for what updated packages may be available. There is nothing wrong with running an older release, just so the packages in it are updated according to what Red Hat has made available since the initial release. At least as long as Red Hat is still supporting the release and updates are still being provided. For instance, Red Hat has stopped providing updates for 5.0 and 5.1, but still does for 5.2. </P ></DIV ></DIV ><DIV CLASS="NAVFOOTER" ><HR ALIGN="LEFT" WIDTH="100%"><TABLE SUMMARY="Footer navigation table" WIDTH="100%" BORDER="0" CELLPADDING="0" CELLSPACING="0" ><TR ><TD WIDTH="33%" ALIGN="left" VALIGN="top" ><A HREF="services.html" ACCESSKEY="P" >Prev</A ></TD ><TD WIDTH="34%" ALIGN="center" VALIGN="top" ><A HREF="index.html" ACCESSKEY="H" >Home</A ></TD ><TD WIDTH="33%" ALIGN="right" VALIGN="top" ><A HREF="firewalls.html" ACCESSKEY="N" >Next</A ></TD ></TR ><TR ><TD WIDTH="33%" ALIGN="left" VALIGN="top" >Step 1: Which services do we really need?</TD ><TD WIDTH="34%" ALIGN="center" VALIGN="top" > </TD ><TD WIDTH="33%" ALIGN="right" VALIGN="top" >Step 3: Firewalls and Setting Access Policies</TD ></TR ></TABLE ></DIV ></BODY ></HTML >
