safest way to upgrade a production server

[Polytropon]

On Sun, 7 Sep 2008 18:08:55 -0400, John Almberg <jalmberg at identry.com> wrote:
> So, my first question is, do I really need to do this?

In short: Depends. For servers that are accessible to the
public (i. e. the Internet), security updates should be
installed (RELEASE-p). Furthermore, security updates for
the services you're running are always welcome (for example
for mail servers, for Apache, for SSH).



> If so, what is the minimum amount of upgrading I can do to be safe?   
> And how?

I'd say it's freebsd-update.

	% man freebsd-update

This lets you follow the RELEASE branch, including security
patches. For installed software, see

	% man portupgrade

which requires the port "portupgrade" to be installed, or the
"make update" / "portsnap" mechanism to upgrade the ports you've
installed and which then need to be re-compiled ("make install").
But I think that's stuff you're trying to avoid.



> I've studied the Upgrading chapter in Absolute FreeBSD, and think  
> what I need to do is patch the systems to the proper errata branch.
> 
> I also think I need to do this using freebsd-update to do a binary  
> update, to upgrade on an errata branch.
> 
> Am I on the right track, here?

Yes, you are. Allthough there's no problem updating the system's
source and recompile + reinstall, freebsd-upgrade saves you much
work.



> I've never done this, so will try upgrading a test system, first. If  
> all goes well, I will give it a whirl on one of the production servers.

Good approach.



> Frankly, I find this idea terrifying, but I guess it needs to be done.

Hey, I've been running FreeBSD 5.4 until July 2008 and I'd still be
using it if not my hard disk had gone mad! :-)



> Here is what we are running...
> 
>  > uname -a
> FreeBSD ***servername*** 6.3-PRERELEASE FreeBSD 6.3-PRERELEASE #1:  
> Mon Dec  3 09:46:53 EST 2007     root@***servername***:/usr/obj/usr/ 
> src/sys/INET_ON  amd64

When you're upgrading to the 7.x branch, it may (!) be neccessary
to install a backwards compatibility (COMPAT) mechanism, or certain
ports need upgrade + reinstallation, but it heavily depends on what
services you're running.


-- 
Polytropon
>From Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...