Pakiti: A Patching Status Monitoring Tool

• Presentation
• Downloads
• Screenshots
• Documentation
• Know bugs
• Contact

• Major Pakiti upgrade
• Re-scope the tool to focus on security patches
• Uses OVAL data
• This release is NOT BACKWARD COMPATIBLE with earlier Pakiti releases
• This release is still under testing and should not be used on production systems
• More information about this release is available here.

• Fixed a flushing problem causing a false "vulnerable kernel" alert. Clients do not need to be updated.

• Initial release.

INTRODUCTION

WHAT DOES IT DO?

HOW AVAILABLE PACKAGES ARE GATHERED?

HOW ARE THEY REPORTED TO THE SERVER?

WHERE CAN I CONFIGURE Pakiti CLIENT?

# Configuration file for Pakiti.

# URL of your local Pakiti server. HTTPS is strongly recommended!
server_url = https://pakiti.cern.ch/feed/

# CA Path for HTTPS connection to your local Pakiti server.
# This is mandatory for HTTPS.
ca_certificate = /etc/grid-security/certificates/

# Curl binary, with the options you like
curl_path = /usr/bin/curl -s

# Delay (minutes)
delay = 0

# Package handling tool: 'up2date' or 'yum' or 'apt-get'
method = apt-get

# section: the contact for the system.
# Put something small that can identify your site.
admin = My_Organization Production

# Log file location.
log = /var/log/pakiti/pakiti.log

HOW CAN I CONFIGURE A PAKITI SERVER?

1. Install Apache, PHP, mysql-server, mod_ssl, php-mysql and pakiti-client

# apt-get install httpd php mysql-server php-mysql mod_ssl pakiti-client

2. Install Pakiti-server

# rpm -i pakiti-server-*.rpm

3. Configure the MySQL server

# chkconfig --level 235 mysqld on

# /etc/init.d/mysqld start

# /usr/bin/mysql mysql
~ update mysql.user set Password=PASSWORD('strong_root_password') where User='root' and Host='localhost';
~ flush privileges;
~ quit;

# mysqladmin -u root -p create pakiti

# /usr/bin/mysql -u root -p pakiti < /usr/share/doc/pakiti-server-*/pakiti.sql

# /usr/bin/mysql -u root -p mysql
~ GRANT SELECT,INSERT,UPDATE,DELETE ON pakiti.* TO  'mysql_user'@'localhost' IDENTIFIED BY 'mysql_password';
~ flush privileges;
~ quit;

~ GRANT LOCK TABLES,SELECT,INSERT,UPDATE,DELETE ON pakiti.* TO  'mysql_user'@'localhost' IDENTIFIED BY 'mysql_password';

4. Configure Apache

<VirtualHost 0.0.0.0:443>
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

SSLCertificateKeyFile <YOUR_HOST_KEY_PATH>
SSLCertificateFile <YOUR_HOST_CERTIFICATE_PATH>
SSLCACertificatePath /etc/grid-security/certificates

DocumentRoot /var/lib/pakiti/www/
ErrorLog logs/pakiti-error
CustomLog logs/pakiti-access common

Alias /feed "/var/lib/pakiti/feed"

<Directory "/var/lib/pakiti/feed">
SSLRequireSSL
Options -All
AllowOverride None
DirectoryIndex index.php
</Directory>

<Directory "/var/lib/pakiti/www/">
SSLVerifyClient      require
SSLVerifyDepth       5
SSLCACertificatePath /etc/grid-security/certificates/
SSLOptions           +FakeBasicAuth
AuthName             "Pakiti: YOUR CERTIFICATE MUST BE REGISTERED"
AuthType             Basic
require              valid-user
AuthUserFile         /var/lib/pakiti/users
SSLRequireSSL
Options -All
AllowOverride None
DirectoryIndex index.php
</Directory>

</VirtualHost>

/C=CH/O=CERN/OU=GRID/CN=Romain Wartel 7120:xxj31ZMTZzkVA

<DN of user 1>:xxj31ZMTZzkVA
<DN of user 2>:xxj31ZMTZzkVA
<DN of user 3>:xxj31ZMTZzkVA
...

5. Configure the Pakiti Server

# Configuration file for the Pakiti webinterface.

# Set the parameters for connecting to
# the Pakiti database.

[mysql]
hostname = localhost
dbname   = pakiti
username = mysql_user
password = mysql_password

[webinterface]
# URL of your local Pakiti server
url = https://pakiti.cern.ch
title = My_Organization

# Reference URL to download the list of security RPMs.
# This setting should normally *not* be changed.
[security_module]
security_rpms = http://pakiti.cern.ch/security.xml

[reporting]
# This section contains details about statistics and full reports
# that can be exported from this local Pakiti server to central Pakiti servers.

# URLs of trusted *central* Pakiti servers, separated by ';'
# that would receive statistics from this local Pakiti server
#send_stats_to = http://pakiti.cern.ch/feed/

# URLs of trusted *central* Pakiti servers, separated by ';'
# that would receive detailed reports from this local Pakiti server
#send_detailed_report_to = http://pakiti.cern.ch/feed/

# CA Path for HTTPS reporting to the central servers. This is mandatory for HTTPS
ca_certificate = /etc/grid-security/certificates/

# Curl binary to connect to the central Pakiti servers, with the options you like
curl_path = /usr/bin/curl -s