Red Hat Training

A Red Hat training course is available for RHEL 8

Chapter 2. Installing security updates

2.1. Installing all available security updates

To keep the security of your system up to date, you can install all currently available security updates using the yum utility.

Prerequisite

  • A Red Hat subscription attached to the host.

Procedure

  1. Install security updates using yum utility: 

    # yum update --security
    Note

    The --security parameter is important. Without it, yum update installs all updates, including bug fixes and enhancements.

  2. Confirm and start the installation by pressing y: 

    ...
Transaction Summary
===========================================
Upgrade  ... Packages

Total download size: ... M
Is this ok [y/d/N]: y

  3. Optional: list processes that require a manual restart of the system after installing the updated packages: 

    # yum needs-restarting
1107 : /usr/sbin/rsyslogd -n
1199 : -bash
    Note

    This command lists only processes that require a restart, and not services. That is, you cannot restart processes listed using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

2.2. Installing a security update provided by a specific advisory

In certain situations, you might want to install only specific updates. For example, if a specific service can be updated without scheduling a downtime, you can install security updates for only this service, and install the remaining security updates later.

Prerequisites

Procedure

  1. Install a specific advisory: 

    # yum update --advisory=<Update ID>

    Replace the Update ID with the required advisory. For exaample, #yum update --advisory=<RHSA-2019:0997>

  2. Confirm and start the installation by pressing y: 

    ...
Transaction Summary
===========================================
Upgrade  ... Packages

Total download size: ... M
Is this ok [y/d/N]: y

  3. Optional: List the processes that require a manual restart of the system after installing the updated packages: 

    # yum needs-restarting
1107 : /usr/sbin/rsyslogd -n
1199 : -bash
    Note

    This command lists only processes that require a restart, and not services. This means that you cannot restart all processes listed by using the systemctl utility. For example, the bash process in the output is terminated when the user that owns this process logs out.

2.3. Additional resources

  • Refer the RHEL 8 Security Hardening document for more information on practices of securing workstations and servers.
  • For more information about Security-Enhanced Linux, see the RHEL 8 Using SELinux documentation.