Episode Details

Back to Episodes
Course 44 - RH Security Specialist | Episode 2: Mastering Yum Updates and RPM Verification

Course 44 - RH Security Specialist | Episode 2: Mastering Yum Updates and RPM Verification

Published 1 month, 1 week ago
Description
Maintaining a secure and reliable Linux environment requires more than simply installing the latest software. Administrators must understand how security updates are identified and applied, how package authenticity is established, and how installed software can be inspected and verified at a lower level.In this episode, we explore the security-focused package management workflows used across Red Hat and CentOS environments. Starting with automated security patching through Yum, we progress into cryptographic package verification and finally examine direct package management with RPM.The goal is to build a practical understanding of how Linux administrators can keep systems patched, maintain a trusted software supply chain, and detect unexpected changes to installed packages.1. Targeted Security Patching with YumWe begin with proactive vulnerability management and security patching.Rather than updating every available package indiscriminately, Yum can be used to identify and apply updates specifically related to security advisories. This allows administrators to reduce unnecessary system changes while prioritizing vulnerabilities that require immediate attention.Key topics include:
  • Installing and configuring the Yum security functionality.
  • Reviewing available security advisories.
  • Examining outstanding security updates before installation.
  • Filtering updates according to severity, including Critical advisories.
  • Applying security-only updates with options such as yum update --security.
  • Understanding how targeted patching can reduce unnecessary system changes.
This workflow demonstrates an important principle of enterprise Linux administration: patch deliberately, not blindly.2. Understanding the Cryptographic Chain of TrustInstalling a package means trusting the software that is being introduced into the operating system. Linux package management therefore relies on cryptographic mechanisms to help verify package authenticity.We examine how GPG key pairs establish a chain of trust between software publishers and package consumers.The episode covers:
  • The difference between public and private cryptographic keys.
  • How package signatures help establish authenticity.
  • Inspecting trusted public keys installed on a system.
  • Querying GPG-related RPM packages with:
rpm -qa gpg-pubkey*
  • Understanding Yum's gpgcheck=1 configuration.
  • Why signature verification is an important defense against untrusted or modified packages.
This section connects package management with a broader security concept: software should be trusted because its integrity and origin can be verified, not simply because its filename or download location looks legitimate.3. Verifying Locally Downloaded PackagesPackage verification becomes particularly important when software has been downloaded manually rather than retrieved directly through a configured repository.We examine how administrators can verify a local package before installation by checking both its integrity and cryptographic signature.The workflow introduces:
  • Package integrity checks.
  • Cryptographic signatures.
  • Manual package validation.
  • The rpm -K verification command.
  • The importance of verifying packages before introducing them into a system.
This provides a practical foundation for understanding software supply-chain security at the operating-system level.4. Yum vs. Direct RPM OperationsYum provides a high-level package management experience, while RPM operates closer to the package database and individual package files.We compare these two approaches and examine when each is appropriate.A particularly useful workflow is installing a locally downloaded package through Yum, allowing dependency resolut
Listen Now

Love PodBriefly?

If you like Podbriefly.com, please consider donating to support the ongoing development.

Support Us