Centos - How to avoid bugged yum updates

Question

I'm running a Centos server, and i've had issue with bugged yum updates. Currently i have a cron job, which does a yum update every 3 months, but sometimes i get an update with a bug in it, that disables some aspect of my server. For example, the latest sshd update was disastrous, because it messed up permissions for chrooted sftp users, and chrooted users couldn't change folders which they were supposed to be able to change. I didn't want to start tampering with downgrade, and i needed some kind of ftp server asap. So i installed a temporary ftp server. I'm pretty much the only administrator of this server, i don't have much free time and therefore can't check every single yum update for bugs. Is there a bot, that can do this for me? Thanks.

Answer 1

Centos - How to avoid bugged yum updates

1. Don't allow the system to automatically update itself, have yum-cron run in checkonly mode.
2. Have yum-cron mail you if there are updates available
   • Review the updates
   • Test the updates on a staging system
3. If the tests pass then apply the updates to your production systems.

Answer 2

If you don't have a staging or test server to run these on to test them, then the best you can do is try and minimise how much work you need to do. Maybe install the yum-security plugin.

You don't mention which CentOS version but this page has instructions for 4,6 & 7:

https://access.redhat.com/solutions/10021

Perhaps you can have it mail you the results of:

yum list-security --security

and then install 24 hours later with:

yum update-minimal --security -y

That would at least give you a heads up on what is going to change e.g. you mention sshd/sftp is an important part of your setup.