I have a production webserver (CentOS 6.5) and I just wanted to know how do I keep this updated interms of security updates and stable.For example, is it safe interms of not breaking anything on the server if I run this command?su -c '/sbin/chkconfig --level 345 yum on; /sbin/service yum start'This apparently updates the server automatically every day.As CentOS is supported for 10 years, I will want to make use of this.
Keeping my production webserver updated
centos;security;webserver
As others have voiced, you generally do not want to ever enable auto updates on a production server. Instead you have 2 alternatives.Method #1If the service being offered is tolerant to have some periodic outages you can do what I call in place updates. This is where you first do a cursory review of what updates are available.Example$ yum list updatesLoaded plugins: auto-update-debuginfo, langpacks, refresh-packagekitUpdated Packagesclutter.x86_64                                                               1.14.4-6.fc19                                                     updateskdelibs.x86_64                                                               6:4.11.5-1.fc19                                                   updateskdelibs-common.x86_64                                                        6:4.11.5-1.fc19                                                   updatesmutter.x86_64                                                                3.8.4-2.fc19                                                      updatesnautilus.x86_64                                                              3.8.2-2.fc19                                                      updatesnautilus-extensions.x86_64                                                   3.8.2-2.fc19                                                      updatesI then go through and consider each update and whether the service running on the box will be tolerant to this update or not. Oftentimes the screen application or other secondary packages will get updates, usually your service is not directly dependent on these, and so I do this without much concern.Other updates, such as Apache, might be direct dependents, and so these I scrutinize much more so. I'll often review the packaging logs to see what has changed and also fine the changelogs for that particular version of the package online.Changes in packages about to be updated:$ sudo yum update nautilus-extensions.x86_64 --changelog......updates/19/x86_64/other_db                                                                                                     | 5.8 MB  00:00:02     ChangeLog for: nautilus-3.8.2-2.fc19.x86_64, nautilus-extensions-3.8.2-2.fc19.x86_64* Mon Dec  9 07:00:00 2013 Matthias Clasen <mclasen@redhat.com> - 3.8.2-2- Fix transparency issues with the desktop background- Fix transparency issues with editable labels......Upgrade  1 Package (+1 Dependent package)Total download size: 2.6 MIs this ok [y/d/N]: nExiting on user commandYour transaction was saved, rerun it with: yum load-transaction /tmp/yum_save_tx.2014-01-11.08-36.3JpVYN.yumtxThe yum plugin yum-changelog is what facilitates this additional output during an update.$ sudo yum install yum-changelogMethod #2The more appropriate approach for services that are intolerant of any outages, is to setup a staging area, which is an identical system with the same setup. You can then apply the updates there and make sure that they work correctly. Once they're certified there, you can then safely apply them to your production system.