Contributed by jose on from the keeping-up-to-date dept.
"I have been developing a script to automatically patch OpenBSD installations, aimed mainly at sites running large numbers of OpenBSD machines. Although this program will never replace a security-conscious system administrator (in fact, it acts quite like a brain-dead one ;-) ), it will surely help many people manage the patching system.Read on ...
If you are interested, please visit http://www.gwolf.cx/soft/tepatcheI'm a bit gunshy about automatic updates, I tend to do this only after careful automatic review of the changes. This is even more so during hackathons and the like. Still, this can be useful if you have a farm to maintain, especially with the severity of recent security flaws.
I quote a bit of information from the web site:
RATIONALE OpenBSD is a stable, robust and secure operating system. Systems administrators running OpenBSD tend to be also more security conscious than administrators running other operating systems. Nevertheless, patching an OpenBSD system can be a tedious process for many people. If a person manages multiple OpenBSD servers, patching each of them can be a long and repetitive task, ideal for automatization. Tepatche will periodically check the FTP site we indicate it to, and if there is a new patch to be applied, downloads, applies, builds and installs it. Tepatche mantains a small status database to know in what is the status of each of the system's patches.
- Tepatche is released under a BSD license - read the COPYING file.
- This is EXPERIMENTAL code. It works for me. However, it is code intended to be run as root and to modify vital system binaries, and a programming error can have nasty consequences.
- Tepatche assumes that the patches published in the specified ftphost is trustable. If the ftphost (typically ftp.openbsd.org or one of its mirrors) were to be comprimised, anything can happen.
- If applying a patch requires kernel compilation, the system administrator MUST DO SO MANUALLY. Tepatche will patch the sources, but building the kernel involves many steps that do require manual operator involvement."
(Comments are closed)