** xref:using-aide.adoc[Checking file integrity with AIDE]

  ** xref:getting-started-with-apache-http-server.adoc[Getting started with Apache HTTP Server]

  ** xref:how-to-edit-iptables-rules.adoc[How to edit iptables rules]

  * xref:getting-started-with-selinux.adoc[SELinux]

  ** xref:how-to-use-vmware.adoc[How to use Vmware Product's]

  //FIXME * xref:debug-dracut-problems.adoc[How to debug Dracut problems]

  //FIXME * xref:debug-systemd-problems.adoc[How to debug systemd problems]

  //FIXME * xref:debug-wayland-problems.adoc[How to debug Wayland problems] - note: maintained on wiki, does not fit quick-docs IMHO

  = AutoUpdates

  [[automatic-updates]]

  Automatic Updates

  -----------------

  owner of each machine to decide whether automatic updates are desirable

  or not for that machine. One of the things which makes one a good system

  administrator is the ability to evaluate the facts and other people's

  _If the machine is a critical server, for which unplanned downtime of a

  service on the machine can not be tolerated, then you should not use

  Even the general rule above has exceptions, or can be worked around.

  Some issues might be resolved through a special setup on your part. For

  updates from only your own repository. Such setups, while perhaps more

  difficult to setup and maintain, can remove a large amount of risk

  otherwise inherent in automatic updates.

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  You can use a service to automatically download and install any new

  [[fedora-22-or-later-versions]]

  Fedora 22 or later versions

  ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  The http://dnf.readthedocs.org/en/latest/automatic.html[dnf-automatic]

  started automatically.

  [[install-and-settings-of-dnf-automatic]]

  Install and settings of dnf-automatic

  +++++++++++++++++++++++++++++++++++++

  ....

  ....

  ....

  env EDITOR='gedit -w' sudoedit /etc/dnf/automatic.conf

  Once you are finished with configuration, execute:

  to enable and start the systemd timer.

  Check status of dnf-automatic:

  [[changes-as-of-fedora-26]]

  Changes as of Fedora 26

  * dnf-automatic-download.timer - Only download

  * dnf-automatic-install.timer - Download and install

  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  The yum-cron RPM package provides a service which is started

  the yum-cron RPM is not installed, the first command below installs this

  RPM.

  ....

  env EDITOR='gedit -w' sudoedit /etc/yum/yum-cron.conf"

  ....

  when there are new updates available.

  [[can-we-trust-dnf-or-yum-updates]]

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  their original state. Using the GPG key checks, there is no way for an

  attacker to generate packages that your system will accept as valid

  (unless they have a copy of the *private* key corresponding to one you

  However, the question would also apply to the question of update

  quality. Will the installation of the package cause problems on your

  system? This we can not answer. Each package goes through a QA process,

  test all possible cases. It is always possible that any update may cause

  problems during or after installation.

  internet which would have been safe if the latest updates where

  installed in a timely way.

  solution, in particular on production systems, it is definitely worth

  [[reasons-for-using-automatic-updates]]

  Reasons FOR using automatic updates

  * You installed a custom kernel, custom kernel modules, third party

  kernel modules, or have a third party application that depends on kernel

  versions (this may not be a problem if you exclude kernel updates, which

  https://bugzilla.redhat.com/show_bug.cgi?id=870790[bug #870790] - you

  may need to modify in Fedora 22 or later versions in base section to add

  exclude=kernel*. or in Fedora 21 or earlier versions to

  exclude=kernel*.)

  (core, extras, legacy ) repositories which may conflict in versioning

  schemes for the same packages.

  seemingly unrelated packages.

  * Bugs. Many packages contain buggy software or installation scripts.

  The update may create problems during or after installation. Even

  * Automatic updates may not complete the entire process needed to make

  automatically) the new changes won't take effect. The same may apply to

  restarting daemons. This can leave the user feeling that he is secure

  when he is not.

  Check for package updates which have been automatically performed, and

  note if they need further (manual) intervention. You can monitor what

  [[fedora-22-or-later-versions-1]]

  Fedora 22 or later versions

  ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  You can monitor updates availability automatically by email after

  ....

  [emitters]

  You can monitor this automatically by email by modifying the cron job to

  mail you the last part of the log file. For example, edit

  ....

  #!/bin/sh

  You would replace youremail@yourdomain with a actual email address to

  which you want to report sent. This change will mean that after yum runs

  every night, it will email you the tail end of the log file showing what

  [[alternative-methods]]

  Alternative methods

  more complexity to configure.

  ....

  ....

  Edit the configuration. Descriptions of the options are contained in the

  +++++++++++++++++++++++++++++

  One method is to use a crontab entry instead of the

  updates from Monday through Friday mornings (avoiding weekends), you

  might use a crontab entry such as the following:

  ....

  If you need more control over when it runs, you could create a file

  list of dates not to update on. What dates go in this file is up to you

  to decide (vacations, holidays, etc). The dates would be in the format

  YYYY-MM-DD (e.g. 2005-03-31). Then create a

  ....

  #!/bin/sh

  include an external firewall, a host-based firewall (like iptables,

  ipchains, and/or tcp wrappers), not performing dangerous tasks on the

  computer (like browsing the web, reading e-mail, etc), and monitoring

  authentication or login monitoring, etc).