Skip to main content

Nov 10

Nov 10 

Status Update

  • Code: got the latest Ansible code from Bitbucket and started work branch RBB-447.
  • Root cause found: os_patch.yml had allowerasing set to true in 4 places, so dnf could delete packages to get around version conflicts. I changed it to false in my local copy. That copy is in the collections folder, so where to commit it still needs to be confirmed with senior staff.
  • Packages put back: reinstalled and restarted SSH (openssh-server) and audit on the affected servers, so they are reachable again.
  • Test patch run: with the false setting, the run stopped safely instead of removing packages, so nothing was deleted this time.
  • New issue: the app repo base_orch contains newer OS packages (openssh and audit) without their matching partner packages. That conflicts with the OS repo os-base. This is very likely why packages were removed in the first patch run.
  • vlim03 and vlim06: still cannot find yum-utils, which points to a repo setup problem on those two servers.
  • Patching helper: I am building an OS patching helper script (the OS Patch Wizard) in my current training course and trying it in the reference environment for this task. I am running the code through Tabnine to catch and fix any issues.

Next Steps

  1. Build a complete OS patch repo from the newest RHEL 8.10 BaseOS and publish it at the address the servers already use (os-patch). The old repo is kept as a fallback.
  2. Check that the new repo has matching openssh and audit packages. If base_orch still conflicts, agree with senior staff on keeping it out of OS patching.
  3. Put back the remaining removed packages on all servers, restore their saved settings, then reboot one server at a time with VMware snapshots taken first.
  4. Fix the repo access on vlim03 and vlim06.
  5. Patch one test server first, confirm nothing was removed, then patch the rest.
  6. Agree with senior staff where the allowerasing change should be committed, then open the pull request.
  7. Rerun the Nessus scan to confirm the eMudhra fix (ca-certificates, RHSA-2026:88550) and the other open CVEs are resolved.

Comments

Post a Comment

Popular posts from this blog

Joke of Day

Home / Blog / 35 Cybersecurity Jokes to Make Any Security Geek Chuckle (or Groan) 35 Cybersecurity Jokes to Make Any SecurityGeek Chuckle (or Groan) Posted on September 8, 2020 Last updated on December 13, 2024. Good IT jokes are few and far between, especially when it comes to cybersecurity. That’s why we put on our creativityhats to brainstorm joke after joke – with a break to pull in a few of our favorites from the web – for the ultimate result: themotherlode (or should we say mother board ?) of cybersecurity jokes and puns. P.S.: we side with Alfred Hitchcock on thisone: puns are the highest form of literature. Everyone deserves an eye-catching intro to break the ice at the start of a meeting or spice up a PowerPoint – gotta keepthe CEO’s attention somehow! And no joke is complete without the perfect graphic. Feel free to grab ours and includethem in your next newsletter, quarterly presentation, or for a workday pick-me-up. Without further ado, we present… Our Favorite Cybersecurit...
Post a Comment
Read more

3/19

 Greetings. The last few days on this weight management program as been a bit crazy.  I had serious cravings.  Then I did some serious yard work then took a shower.  After that I felt like I would faint.  Chiquita and I had to go and get some powerade.  I ate some crackers as well and it seem to help.  Tomorrow back to the weight management grind.  :) G 283.1 lb
Post a Comment
Read more