Solaris 10: Patching

Solaris 10: Patching

Abstract:
When any vendor releases a piece of software, there is a schedule to keep. If a piece of software must be perfect before being released, it will never be released, because no one is perfect. After any software install, patching should be conducted. Patching on the local Solaris target machine with direct access to the internet is the most straight forward process and this document will describe this scenario.

Pre-Requisites:
The first step in this process is to ensure that Solaris 10 Operating System is installed, followed by the installation of any optional Solaris 10 Contributed Software.

Command Line or GUI Patching:
The patching under Solaris 10 can be conducted via the "smpatch" command or the Java X Windows GUI "updatemanager'.

CLI (Command Line Interface) Patching:
The patching can be done via the "smpatch" at the command line. If you have not registered the new installation for the Update Manager, the system will inform you of this requirement.

Ultra2/root$ smpatch analyze
Failure: Cannot connect to retrieve detectors.jar: This system is currently unregistered and is unable to retrieve patches from the Sun Update Connection. Please register your system using the Update Manager, /usr/bin/updatemanager or provide valid Sun Online Account(SOA) credentials.

X Windows GUI Registration:
The process for registering a system on the Update Manager can be done via a GUI.

Ultra2/root$ echo $DISPLAY
192.168.3.103:0.0

Ultra2/root$ updatemanager
Java Accessibility Bridge for GNOME loaded.
...

From the JAVA GUI, first time users will be prompted for a username and password.

User Name: {registered username}
Password: {registered password}
Number: {service plan number} OR [x] Continue without providing a service plan number
[x] I have read the agreement and accepted it
[Next]

[x] Enable Auto Registration
[x] Sun may contact me...
[Finish]

[Close]

If you have not formerly registered, you will need to register on-line, to get an ID, in order to get your patches.

X Windows GUI Patching

Once the Update Manager has finished the registration process of the server, either the X Windows GUI or Command Line Interface can be used to continue patching.

Since the Update Manager is already running, it makes sense to use the GUI to install the outstanding patches after an initial install.

Select the [Updates] tab
Select the double checkmark box [xx] to select all available patches
select [Install ### Patches] button in the lower left hand corner

The "Installing" popup box appears, providing an indication of the progress.

CLI Patching Continued

Patching can be conducted using the lighter weight "smpatch" command line. The "analyze" command will display all patches outstanding while the "update" command will query, download, and apply all the patches automatically.

Ultra60/root# smpatch analyze
125215-03 SunOS 5.10: wget patch

Ultra60/root# smpatch update
125215-03 has been validated.
Installing patches from /var/sadm/spool...
125215-03 has been applied.

Post-Install Instructions

Once the patching is completed, the X Windows GUI can be quit

File -> Quit

If patches were installed which requires the system to restart, the best commands to engage those patches are the "init" or "shutdown" commands - the "reboot" command will not engage those patches.

Ultra2/root$ cd / ; sync ; sync ; init 6

The "init" process will take some time to complete, but the system will come down and restart.

IBM: Sun Best in OS Vulnerabilites Reporting and Patching

IBM: Sun Best in OS Vulnerabilities Reporting and Patching - 2009-1H

I know what you are thinking, IBM thinks Sun outperformed the rest of the market in regards to OS security?

Apparently, in the 1st half of 2009, IBM commends Sun for security above all other competitors, even their own coders and product partners!

Sun is the best at sharing information about its operating system's vulnerabilities and patching them, reports IBM's "X-Force 2009 Mid-Year Trend and Risk Report." This analysis of various online threats and vulnerabilities examined statistics for the first half of 2009.

By what metrics did IBM measure?

Solaris had only 26 percent of the total number of OS vulnerabilities... Microsoft had the most ... with 39 percent of the total.

But this was not the only metric...

Sun's patch rate also was deemed impressive with only four percent left unpatched. "For the vast number of disclosures Sun makes, they have an impressive patch rate (only four percent left unpatched)"... The average patch rate within the industry is 49 percent. Sun's four percent rate tops Apple's 18 percent and Microsoft's 17 percent.

This is fairly eye opening to the industry - Sun clearly is better controlling their own destiny with Solaris than the competitors.