These days, pretty much every desktop operating system is designed to constantly get new security updates from the Internet. It's a great and very necessary feature, and the tools for managing updates in a networked corporate or lab environment are fairly mature as well.
However, I've got an environment where connectivity to the outside world is limited or nonexistent, but system security is still a high priority.
Our standard procedure for updating the software is to reimage all workstations from upon each new release of our software, using a kickstart based on the latest available RHEL image. But there can be close to a year between RHEL releases, whereas new security updates are rolled out every day. Given our environment and requirements, our preference would be to ship an image that is as close to "today's fully-patched RHEL" as possible on our release day.
(Patching systems in-place between update cycle is generally a last resort because of stability and accreditation concerns. Being able to distribute an up-to-date and fully tested image is the goal.)
- Is there an easy way to download or self-package an RHEL installation image that includes not only the latest release but all incremental security patches to it?
- Has something like this been done before or would we basically need to implement our own solution from scratch?