Once you have the subscription, you can use mrepo, or reposync, to setup an in.Which is a good investment IMO, but lets stick to the point. The only requirement is that you will need to have at-least one subscription to RHN.

But once you have it setup, it's all automated. If you absolutely want to use yum security plugin, there is a way to do this, although a little elaborate.

Are there any tools which do this already? I have considered using yum-plugin-changelog to print out the changelog for each package, and then parse the output for certain strings.

Optionally, automatically install the minimum upgrade required to address a security vulnerability, which would probably be yum update-minimal -security on the commandline?.

Automatically (Progamatically, via cron) inform us if there are known vulnerabilities with my current RPMs.

I monitor the CentOS and Scientific Linux mailinglists for updates, but this is tedious and I want something which can be automated.įor those of us who maintain CentOS and SL systems, are there any tools which can: I don't think this handles Security Updates only, however.ĬentOS does not support yum-plugin-security. It does ship with /etc/cron.daily/yum-autoupdate, which updates RPMs daily. Scientific Linux 6 did not support yum-plugin-security as of late 2011. In addition, Fedora recently started to support yum-plugin-security. RedHat provides yum-plugin-security, which can check for vulnerabilities by their Bugzilla ID, CVE ID or advisory ID.

FreeBSD does this with the ports-mgmt/portaudit port. We want the systems to automatically notify us if there are any known vulnerabilities to the installed packages. We have machines running RedHat-based distros such as CentOS or Scientific Linux.

Centos packages