CIG Server and Desktops TO get the latest information on security updates, subscribe the debian security mailing list debian-security@lists.debian.org.

Run daily package checkup with cron-apt. Cron-apt just updates the package list and download new packages without installing. It is configured that cron-apt will send email to the system administrator with the list of packages to be upgraded. Here is a sample email from cron-apt:

  CRON-APT RUN [/etc/cron-apt/config]: Thu Nov  6 04:00:01 PST 2008
  CRON-APT SLEEP: 2302, Thu Nov  6 04:38:23 PST 2008
  CRON-APT ACTION: 0-update
  CRON-APT LINE: /usr/bin/apt-get update -o quiet=2
  CRON-APT ACTION: 3-download
  CRON-APT LINE: /usr/bin/apt-get autoclean -y
  Reading package lists...
  Building dependency tree...
  CRON-APT LINE: /usr/bin/apt-get dist-upgrade -d -y -o APT::Get::Show-Upgraded=true
  Reading package lists...
  Building dependency tree...
  The following packages will be upgraded:
    libmysqlclient15off mysql-client mysql-client-5.0 mysql-common mysql-server
    mysql-server-5.0
  6 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
  Need to get 34.4MB of archives.
  After unpacking 4096B of additional disk space will be used.
  Get:1 http://security.debian.org stable/updates/main mysql-common 5.0.32-7etch8 [54.5kB]
  Get:2 http://security.debian.org stable/updates/main mysql-server 5.0.32-7etch8 [48.1kB]
  Get:3 http://security.debian.org stable/updates/main mysql-client 5.0.32-7etch8 [46.1kB]
  Get:4 http://security.debian.org stable/updates/main libmysqlclient15off 5.0.32-7etch8 [1793kB]
  Get:5 http://security.debian.org stable/updates/main mysql-client-5.0 5.0.32-7etch8 [7199kB]
  Get:6 http://security.debian.org stable/updates/main mysql-server-5.0 5.0.32-7etch8 [25.2MB]
  Fetched 34.4MB in 5s (5896kB/s)
  Download complete and in download only mode

Whenever there is a security update or new kernel update, apply the upgrade ASAP on all systems. Email the machine owner if reboot is required.

Regular S/W maintenance is done weekly on Wednesday morning.

Request for installation of s/w packages by user will be handled on case by case base. There are no restrictions on desktops as long as the normal function of the desktop is not interrupted or in inhibited. Any S/W package to be installed on the server needs to be evaluated by system administrator. The guideline is to keep server function as top priority.