Skip to main content

Jira Update

 Info: 


OK, I know my updates are long but I have been trying to track all the issues and the fixes/findings.  

Status Update

  • RHEL 8.10 OS patching is complete on all A-site servers in the reference environment, including the Ansible Master. All servers are running the new kernel 4.18.0-553.184.1.el8_10.
  • The eMudhra fix (ca-certificates 2026.2.92_v9.0.319-81.3.el8_10, RHSA-2026:88550) is in the patch repo and was applied in the patch run.
  • Root causes found and fixed:
    • The patch repo was missing matching packages. The os-patch link pointed to an old repo, and the monthly download only holds BaseOS, not AppStream. I built a new repo (rhel-8-10-nov2026) from the Nov 8 BaseOS download, added the missing AppStream packages from Red Hat (perl, gcc, cpp, gcc-plugin-annobin, gdk-pixbuf2-modules, python3-pip) and pointed os-patch at it.  (I used symbolic link instead of updating repo)
    • The earlier patch run had removed lvm2 from 7 servers and the GRUB BIOS packages from 2 servers. This caused boot failures on vlim02, vlim04 and vlim05 after the new kernel. I reinstalled the packages, rebuilt the boot images and the GRUB boot loader, and all three now boot normally.
  • allowerasing is set to false on branch RBB-447, so dnf can no longer remove packages during patching. No packages were removed in the final runs.
    • But I do need to ask @gilbert, adam about the product level updates.
  • Post-patch checks passed for kernel and OS version, Docker and ESP services, Apache, patch repo disabled, no removed packages, and the login message (MOTD).
  • I'm using the OS Patch Wizard script from my current training course to run these steps, and I'm passing the code through Tabnine to fix any issues.
  • A Nessus scan has been started to confirm the eMudhra fix and the open CVEs. It is not finished yet.

Next Steps

  • Review the Nessus results when the scan finishes. Confirm plugin 371119 (ca-certificates RHSA-2026:88550) is cleared and note any remaining findings.
  • Setup the b side to be completed with wizard and show Adam.
  • Raise that the monthly repo build needs to include AppStream as well as BaseOS, so dependency gaps like this do not repeat each month.
  • Discuss with the senior engineer (@gilbert, adam) whether to merge the allowerasing change on branch RBB-447 into master.
  • Remove the old repo folders and old tar files from /var/www/html once the scan results are confirmed.

In the wizard menu, Steps 2, 4 and 12 still show FAIL, but none of those is a problem:

Comments

Post a Comment

Popular posts from this blog

Joke of Day

Home / Blog / 35 Cybersecurity Jokes to Make Any Security Geek Chuckle (or Groan) 35 Cybersecurity Jokes to Make Any SecurityGeek Chuckle (or Groan) Posted on September 8, 2020 Last updated on December 13, 2024. Good IT jokes are few and far between, especially when it comes to cybersecurity. That’s why we put on our creativityhats to brainstorm joke after joke – with a break to pull in a few of our favorites from the web – for the ultimate result: themotherlode (or should we say mother board ?) of cybersecurity jokes and puns. P.S.: we side with Alfred Hitchcock on thisone: puns are the highest form of literature. Everyone deserves an eye-catching intro to break the ice at the start of a meeting or spice up a PowerPoint – gotta keepthe CEO’s attention somehow! And no joke is complete without the perfect graphic. Feel free to grab ours and includethem in your next newsletter, quarterly presentation, or for a workday pick-me-up. Without further ado, we present… Our Favorite Cybersecurit...
Post a Comment
Read more

3/19

 Greetings. The last few days on this weight management program as been a bit crazy.  I had serious cravings.  Then I did some serious yard work then took a shower.  After that I felt like I would faint.  Chiquita and I had to go and get some powerade.  I ate some crackers as well and it seem to help.  Tomorrow back to the weight management grind.  :) G 283.1 lb
Post a Comment
Read more