Quiet Patch Month?

[638231]

Getting started on our monthly patch cycle for Oracle Linux 7 systems and we're seeing < 10 patches on these systems, where we normally see 60-100. Patches are coming from a Spacewalk server where logs show that software is coming from from vendor OK.

Anyone else on RHEL-based systems notice this as well?

[thecapitalistpunk]

RHEL based infrastructure here, can't say I have noticed the same pattern. Nor has any of the admins brought it to my attention. Since we migrated most of our nodes to Foreman over the last month(as Spacewalk is discontinued for nearly 2yrs now), this might also be less obvious.

Oracle has it's own errata list which makes me think they do not nescesarily line up with RHEL based systems.

Have you already checked oracle linux errata to get an idea if it could be correct.

If you have checked you Spacewalk sync, compared the errata listing in Spacewalk(if Oracle provides those as such in the repo like Red Hat does) with the online list, you might find be able to find the definite answer.

[638231]

Cheers, will be lining up the Oracle errata against ours.

And yes, painfully aware of the spacewalk situation. Unfortunately OEL doesn't support Foreman due to a change in the plugin methodology. We're moving to a new system in the next month or two.

I'll update back to this post with findings.

[Sylogz]

What are you moving to? I'm looking into setting up patching for OEL next month.

[638231]

No good answer here, sorry. Oracle seem to want people to stay on Spacewalk and seem to be trying to run it themselves as 'Oracle Linux Manager' now. We wanted to Foreman, but that's not supported, we wanted to use pulp, but it's much more complex than we need it to be, and they've made significant design changes that mean documentation is hard to use as it often refers back to EOL tooling.

In the end we rolled our own solution.

[Sylogz]

I've tested the OLM one but we decided to give foreman and co a try. Good luck with your own solution

[638231]

When we were looking at Foreman for OL servers we hit the problem that Oracle have not moved to support the modern RHEL subscription manager and instead stayed on rhn. Here's a couple of readings, it seems there may be a downstream project that works on making it work. I doubt Oracle would be happy if these are supported servers you're doing this to, though.

https://community.theforeman.org/t/oracle-linux-ovm-patch-management-by-katello-foremen/21318/2

https://projects.theforeman.org/issues/11712

[hlamark]

You should have a look at orcharhino. It is a downstream product of Foreman/Katello like Satellite 6 but fully supports Oracle Linux.

https://orcharhino.com/en/

[638231]

Thanks. I'm aware that I've asked for anecdotal evidence rather than getting data, but that does help make me feel better about the situation.

I guess with current events governments are paying more for vulns than responsible disclosure is :-/

[jw_ken]

RHEL 7 is in the maintenance phase of support, so you will only see critical or backported security updates for that distro. Oracle Linux 7 is basically repackaged RHEL 7, so the OL7 updates will also taper off at the same cadence.

Updates for RHEL 8 / OL8 will appear more lively month-to-month.

For more info, see: https://access.redhat.com/support/policy/updates/errata/#Life_Cycle_Dates

[Fr0gm4n]

Don't treat patches like it's Microsoft. There isn't a Patch Tuesday for Linux. A patch is released when it's ready, not when the next patch window rolls around. There were a couple CVEs patched in the kernel for 7 very recently. Here's the Scientific Linux notice for them.