Security Incidents mailing list archives

Re: Proxy server hit... Any ideas?


From: Valdis.Kletnieks () vt edu
Date: Tue, 26 Nov 2002 12:20:11 -0500

On Tue, 26 Nov 2002 17:47:55 +0100, Toby Felgenner said:

If you don't trust automatic updates, don't bother reading any further
(then again, if you have 30,000 hosts how else are you going to do it?).

We're a .edu.  That's why I'm laughing. ;)

Setup a protected server to get the updates from M$.  Then test the updates
in your test environment.  If the updates pass all your tests, then Approve
and distribute the updates to another internal SUS Server.  Your client
hosts then pick up the only the updates that you have approved from your
own internal SUS server.

Preaching to the choir here. I've had test environments whenever possible
since 1981 or so. (For bonus points - IBM's VM operating system originally
was developed so multiple teams could test MVS releases on the same very
expensive box, and not everybody came to a screeching halt when one team
managed to crash things...)

Yeah, 30K hosts in a *controlled* *corporate* environment using stuff like
Group Policy to push updates and prohibit user changes to the software would
be almost doable.  But if you think I wanna deal with the "Joe Freshman got
a new XP system for Christmas" problem when the students get back in January...

/Valdis

Attachment: _bin
Description:


Current thread: