openstack-ansible-security/doc/metadata/rhel6/V-38481.rst

---id: V-38481 status: opt-in tag: misc ---

Opt-in required

Operating system patching policies vary from organization to organization and are typically established based on business requirements and risk tolerance.

Note

Automatically upgrading packages can provide significant security benefits, but they can reduce availability and reliability. Updating packages can cause daemons to restart on some systems and they can cause local customizations of configuration files to be lost.

Deployers are strongly urged to understand the nature of this change and the associated risks prior to enabling automatic upgrades.

Deployers can enable automatic updates by setting security_unattended_upgrades to True:

security_unattended_upgrades: true

In Ubuntu, the unattended-upgrades package is installed and enabled. This will apply updates that are made available to the trusty-security (Ubuntu 14.04) or xenial-security (Ubuntu 16.04) repositories.

In CentOS, the yum-cron package is installed and configured to automatically apply updates.