Securing Linux: A Survival Guide for Linux Security (Version 2.0)

1.5 PATCHING/UPGRADES

Thanks to exploits like Code Red and Nimda, patching has become an obsession . Although patching is a necessary evil, it can be overdone. Some of the guidelines to remember when applying patches:

• Review each patch for relevance “ If you are not running a service or application on your server, there is no need to apply a patch for that service or application.

• Read the Release Notes “ It is understood that, as a rule, instructions are an annoyance. However when it comes to release notes, you need to read them to understand what the patch is going to do and how it is going to apply to your environment.

• Always apply patches in a test environment first “ Unless you need practice in resume writing, it is a good practice to test your patches before you apply them to your production environment. The last thing you need is to apply a patch to a critical web server and bring the whole e-commerce site down.

• Reaudit the system for unexpected changes “ When patches are applied, they can sometimes change system or configuration files back to the default settings. After applying patches to a system, the system should be reaudited against the last known good configuration for any unexpected changes.