2

These days, pretty much every desktop operating system is designed to constantly get new security updates from the Internet. It's a great and very necessary feature, and the tools for managing updates in a networked corporate or lab environment are fairly mature as well.

However, I've got an environment where connectivity to the outside world is limited or nonexistent, but system security is still a high priority.

Our standard procedure for updating the software is to reimage all workstations from upon each new release of our software, using a kickstart based on the latest available RHEL image. But there can be close to a year between RHEL releases, whereas new security updates are rolled out every day. Given our environment and requirements, our preference would be to ship an image that is as close to "today's fully-patched RHEL" as possible on our release day.

(Patching systems in-place between update cycle is generally a last resort because of stability and accreditation concerns. Being able to distribute an up-to-date and fully tested image is the goal.)

In short,

  • Is there an easy way to download or self-package an RHEL installation image that includes not only the latest release but all incremental security patches to it?
  • Has something like this been done before or would we basically need to implement our own solution from scratch?
  • 1
    Why not host a mirror of the RHEL repository internally if outside connectivity is an issue? access.redhat.com/solutions/23016 – jordanm Nov 30 '16 at 19:39
  • ... and then yum -y update in the kickstart script to pull in the latest from whatever repos you configure. – thrig Nov 30 '16 at 19:48
  • Do you not have a staging environment to test patches before apply to prod and a proper rollback plan in case shit hits the fan? – Dejan Nov 30 '16 at 19:51
  • @jordanm Mostly because of reasons in the parenthetical: accreditation gets really thorny if the system is getting patches outside of an approved release version (which are more frequent than RHEL releases). It's a viable approach if we get more flexibility there, but just doing this for every install means replacing a relatively simple process (pop the disk in, reboot, wait) with a more complex one (you now have to image the repo mirror and make sure everything syncs before you have a system that matches what's supposed to be deployed). – Alex P Nov 30 '16 at 19:59
  • 1
    I hate myself for saying this, but being Redhat Enterprise you should open a support ticket with them and ask this. You are paying for it and are entitled an answer. – ron Nov 30 '16 at 20:54
0

I was able to integrate RHEL security updates into a custom kickstart image using the following procedure:

  1. Set up an RHEL mirror with a history depth of 1.

  2. When building the kickstart image, copy the repo data to its own directory on disk.

    ISO build script pseudo-code:

    #!/bin/bash pseudo-code
    
    # make a copy of the RHEL system image
    mount rhel-7-server-dvd.iso /tmp/rhelbaseiso
    cp -a /tmp/rhelbaseiso /tmp/rheliso
    
    # add your own custom kickstart files
    cp myimage/ks.cfg /tmp/rheliso/.
    cp -f myimage/isolinux.bin /tmp/rheliso/isolinux/isolinux.bin
    
    # copy files from repo mirror
    mkdir /tmp/rheliso/rhelUpdatePackages
    cp -a /myrhelmirror/repos/rhel7/rhel-7-server-rpms/* rhelUpdatePackages
    
    # TODO add any custom packages to their own directory, and run createrepo on it
    
    # build the iso image
    mkisofs -rDfJV "DISK NAME" -b isolinux/isolinux.bin \
            -c isolinux/boot.cat     \
            -no-emul-boot            \
            -boot-load-size 4        \
            -boot-info-table         \
            -graft-points            \
            -eltorito-alt-boot       \
            -e images/efiboot.img    \
            -no-emul-boot            \
            -o custom_rhel.iso  /tmp/rheliso
    
    # TODO unmount and clean up
    
  3. Tell kickstart to use the update repository as an additional repo:

    ...
    repo --name="rhel_update"  --baseurl="file:///run/install/repo/rhelUpdatePackages"
    repo --name="your_own_software"  --baseurl="file:///run/install/repo/customPackages"
    ...
    

This seems to be sufficient to get Yum/Anaconda to pull in the appropriately updated packages during system installation. When installed, the system will have up-to-date software "out of the box," without needing to connect to an update repository.

(This works for bootable BluRay, USB-HD, or LAN-based install. Additional effort is required to shave down the image size if you need to fit it on a bootable DVD.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.