While there are many Linux users who prefer other tools for doing their patch management, yum is designed for RPM-based distributions. Its popularity has grown as Fedora Linux has adapted yum as its primary patch management tool. This chapter will help you set up and configure a yum repository for your Linux distribution.
Configuring a Local yum Server
The skills you need to configure a local yum server are not related to yum. They require knowledge of the FTP, Apache, or NFS services. While this section is not designed to provide a complete guide to any of these services, it provides a description of how you can configure a yum repository server based on the settings described earlier for Fedora Core 4 updates.
Because I personally prefer the efficiency of the FTP and NFS services for sharing files, I’ve covered the configuration steps required only for those services. For completeness, I’ve described how you can configure an Apache server to share files on a RHEL 4 yum repository near the end of this chapter. If you’re configuring a yum server, what you do will vary based on the following factors:
Distribution and version
Preferred version of a server (configuration steps vary for different FTP and HTTP servers and, to some extent, the way different distributions implement NFS servers)
Availability of yum for the distribution (i.e., if it isn’t available, be prepared to compile yum from a source RPM)
As with other network services, yum servers may be sensitive to any firewalls that you may configure. If you have a firewall between the yum server computer and associated clients, you’ll need to make sure traffic can travel through appropriate TCP/IP ports; for example, Apache services require access through TCP/IP port 80. Sure, there are ways to "tunnel" data through other services, such as SSH, but that should not be necessary for updates limited to your internal network. In any case, that level of detail is beyond the scope of this book.
Configuring an FTP yum Server
On current Red Hat/Fedora distributions, the default FTP server is vsFTP. According to its home page at http://vsftpd.beasts.org/, it’s the default FTP server used to share a number of Linux distributions, including Red Hat and Debian. It’s even used to share kernels through ftp.kernel.org.
The default version of vsFTP is configured in the vsftpd RPM. The default installation works well in most cases. The vsFTP configuration file is stored in /etc/vsftpd/vsftpd.conf for Red Hat/Fedora distributions (/etc/vsftpd.conf for SUSE and Debian distributions). In this case, we’re working from the RHEL 4 version of vsFTP.
By default, vsFTP files are stored in the /var/ftp directory. By convention, files that you copy for downloads are stored in the pub/ subdirectory. Therefore, the repository that you create should be in the /var/ftp/pub directory. For the example described earlier, update RPMs are stored in the following directory:
/var/ftp/pub/yum/4/i386/updates
If you’ve used the commands described earlier for Fedora Core 4, you’ll find the update header database in the repodata/ subdirectory.
There is a substantial number of options for vsFTP, most of which you can configure in the vsftpd.conf configuration file. The following is a review of active options in the RHEL 4 version of this file. If you want to check the current defaults for these and other options, read the vsftpd.conf man page associated with your vsFTP RPM.
anonymous_enable=yes
You absolutely want to enable anonymous access for a FTP-based yum server. Anonymous access is normally enabled by default on a vsFTP server.
local_enable=yes
It’s normally best to disable access by regular users to a FTP-based yum server. As it is disabled by default, all you need to do is comment out this option.
write_enable=yes
Naturally, because you do not want anyone (unless authorized) to overwrite (or even add) to a yum-repository, you should disable write access.
local_umask=022
If you do authorize write access (I believe you should not do so on an FTP-based yum server), this option sets the umask for any files created by users who are logged into your FTP server.
dirmessage_enable=yes
If active, this option looks for and reads any .message file that exists in the local directory. This can be useful if you want to send messages to other administrators.
xferlog_enable=yes
If active, this option logs downloads (and uploads) on the vsFTP server in the /var/log/xferlog file. For example, when I downloaded an updated version of yum, the vsFTP server placed the following entry in that file:
Mon Sep 2 17:18:25 2005 1 192.168.0.20 390363 /pub/yum/4/i386/updates/yum-2.4.0-0.fc4.noarch.rpm b _ o a anonymous@ ftp 0 * c
As you can see, this lists the date and time of the transfer, the client IP address, as well as the size and location of the file. This is a standard format shared with the WU-FTP server and can be mined as a database for more information on client computers that connect to your server.
connect_from_port_20=yes
Some FTP clients require this option, which uses TCP/IP port 20 for data transfers.
xferlog_std_format=yes
If you’ve activated the xferlog_enable option noted earlier, this option supports a standard format shared with the WU-FTP server.
pam_service_name=vsftpd
The pam_service_name option defers to Pluggable Authentication Modules to help secure the vsFTP service. This particular option sets rules in /etc/pam.d/vsftpd. One of the key options in this file prohibits users listed in /etc/vsftpd.ftpusers from logging into this vsFTP server.
userlist_enable=YES
As configured, this is redundant with the previous command. When enabled, it makes the vsFTP server read the /etc/vsftpd.user_list file and deny access to all who attempt to connect as one of the users listed in this file. By default, this file contains the same list of users as shown in /etc/vsftpd.users.
listen=YES
By default, Red Hat / Fedora configures the vsFTP server as a standalone service, with a vsftpd activation script in the /etc/rc.d/init.d directory. In contrast, SUSE does not configure vsFTP as a stand-alone service and configures listen=NO by default.
tcp_wrappers=YES
As configured, Red Hat / Fedora configures the vsFTP server for one more level of security, through TCP Wrappers support, which allows you to configure more security related commands in the /etc/hosts.allow and /etc/hosts.deny files.When you’re satisfied with the configuration, you should activate the vsFTP server with the following command (which is not required if you’ve set listen=NO):
/etc/init.d/vsftpd start
Finally, you can make sure that vsFTP is active the next time you reboot Linux with the following command:
chkconfig vsftpd on
This command activates the vsFTP server whenever you’re in run levels 2, 3, 4, or 5. (If you configure vsFTP in xinetd, it activates it in the /etc/xinetd.d directory.) For the purpose of this chapter, assume the name of this server is yum.example.com.
Configuring a yum Client for an FTP-Based yum Repository
After you’ve configured this FTP yum server, configuring the associated yum client is a straightforward process. As you’ve seen in Chapter 6, yum configuration files that point to yum servers are normally configured in the /etc/yum.repos.d directory. For Fedora Core 4, we will examine the client file that points to the yum Update server: fedora-updates.repo.
For the yum FTP server as configured, all you need to include in the fedora-updates.repo file is the following:
[updates-released]
name=Fedora Core $releasever - $basearch - Released Updates
baseurl=ftp://yum.example.com/pub/yum/4/i386/updates
enabled=1
gpgcheck=1
As described earlier, for a vsFTP server, this means that update RPMs as well as the associated repodata/ subdirectory are stored on the yum.example.com computer in the /var/ftp/pub/yum/4/i386/updates directory.
Configuring an NFS yum Server
On current Red Hat/Fedora distributions, an NFS server is installed by default, courtesy of the nfs-utils RPM. The default installation works well in most cases. You can specify shared NFS directories in the /etc/exports configuration file. In this case, we’re working from the RHEL 4 version of NFS.
You can share directories as configured on an NFS server. For the example described earlier, update RPMs are stored in the following directory:
/var/ftp/pub/yum/4/i386/updates
Therefore, you can share this directory at any level, as long as the mount point on the NFS client is consistent. For example, I’ve added the following line to my /etc/exports configuration file:
/var/ftp/pub 192.168.1.0/24(ro,sync)
This particular configuration command shares the /var/ftp/pub directory. It limits access to clients in the noted IP address range. Clients are allowed read-only (ro) access. Changes are committed to disk before any new requests are made (sync).
For more information, see the exports man page Linux Administration Handbook by Evi Nemeth, Garth Snyder, and Trent Hein (Upper Saddle River, NJ: Prentice Hall, 2002). After you’re satisfied with the configuration in /etc/exports, deactivate the NFS server with the following command:
/etc/init.d/nfs stop
By default, this should stop any NFS services, quotas, the NFS daemon, as well as the mountd daemon. Next, export the changes to /etc/exports with the following command:
exportfs -a
Now restart the NFS services with the following command:
/etc/init.d/nfs start
Confirm the exports in from the local list with the following command:
showmount -e
If you’re on another system, you can find the shared NFS directories. For example, you can list those on a server named yum.example.com with the following command:
showmount -e yum.example.com
Finally, you can make sure that NFS is active the next time you reboot Linux with the following command:
chkconfig nfs on
This command activates the NFS server whenever you’re in run levels 2, 3, 4, or 5.
Configuring an NFS yum Client
You’ll need to mount the NFS share on an appropriate local directory, and then configure the associated file in /etc/yum.repos.d to point to that share. Because we’re configuring a share for Fedora updates, we’ll modify the fedora-updates.repo file.
First, on the NFS client, you should confirm your ability to connect to a shared NFS directory. The following command connects to the yum.example.com NFS server to find what shares are available on that server:
showmount -e yum.example.com
You’ll see the shared directories that you configured earlier, including /var/ftp/pub. I’ve mounted it on the local /var/yum directory with the following command:
mount yum.example.com:/var/ftp/pub /var/yum
If the /var/yum directory does not yet exist, you’ll get an error message. Now you can configure your fedora-updates.repo file in your /etc/yum.repos.d directory. For the yum NFS server as configured, all you need in fedora-updates.repo is the following:
[updates-released]
name=Fedora Core $releasever - $basearch - Released Updates
baseurl=file:///var/yum/yum/4/i386/updates
enabled=1
gpgcheck=1
As described earlier, for a vsFTP server, this means that update RPMs as well as the associated repodata/ subdirectory are stored in the yum/4/i386/updates subdirectory, mounted on the /var/yum directory.
Note the syntax associated with the baseurl command. The file: command works in place of ftp: or http:. The triple forward slash (///) is the standard syntax required for mounted directories.
If you’ve configured a Fedora Updates repository on a Fedora Core server, this command may be slightly different. Based on the directory specified earlier, you would substitute the following baseurl command:
baseurl=file:///var/ftp/pub/yum/4/i386/updates
Naturally, you may want to configure this shared directory as part of the boot process for each NFS client. It’s possible to configure it in the default /etc/fstab configuration file, as well as through the Automounter daemon. I recommend the latter, which avoids hangups when there are network problems. The Automounter daemon is easy to configure; it requires the autofs RPM. After that RPM is installed, here’s how you can configure a NFS client for Fedora updates as configured in this chapter:
Install the autofs RPM; if you’ve configured yum, the simplest way is with the following command. Even if you’re not sure if autofs is installed, this command makes sure that you have the latest version of the Automounter:
yum install autofs
Configure the Automounter master file to read from /etc/auto.misc. Open the /etc/auto.master configuration file. You’ll see sample commands; activate the following to read from the noted file. The timeout prevents your system from hanging if there’s a problem with your network or the NFS server.
/misc /etc/auto.misc --timeout=60
Automounter shares configured in /etc/auto.misc are configured as subdirectories of /misc.
Configure the Automounter /etc/auto.misc file to read from the shared NFS directory. Based on the shared directory and NFS server name described earlier, add the following line to that file:
yum -ro,soft,intr yum.example.com:/var/ftp/pub
Start the Automounter service with the following command:
/etc/init.d/autofs start
Test the result. If your network is connected and the NFS server is running, you should be able to see the shared NFS directory with the following command:
ls /misc/yum
Occasionally, you may need to run this command more than once to establish the connection.
Configure the /etc/yum.repos.d/fedora-updates.repo file to point to this directory as shared. Based on the previously shared NFS directory, the baseurl command would be
baseurl=file:///var/ftp/pub/yum/4/i386/updates
Test the result with the yum update command. You should see messages similar to a regular yum update from other local or remote servers.
