## NAME

         GetApplyPatch - retreive and apply a vendor patch

## SYNOPSIS

         GetApplyPatch [ -b ][ -s site ][ -u  user  ][   - d  dir  ][
         patchno .. ]

## DESCRIPTION

         Sun Microsystems supports an anonymous ftp site where recom-
         mended patches are found. It is a fundamental security prin-
         ciple that systems which have vendor patches installed  will
         be  more  secure  than those that do not. In the life of any
         released operating system there will be many patches.

         GetApplyPatch is a simple tool to assist in patch management
         on  Solaris  systems.  It  will  retrieve and install vendor
         patches under user control. Patches can  be  listed  on  the
         command  line  or  on  standard input -- that makes the tool
         suitable for a pipeline as in:

           [1:05pm wally] CheckPatches | GetApplyPatch

         In "batch" mode (ie. when  run  from  cron(8))  patches  are
         applied  blindly  with no human intervention. In interactive
         mode you have several opportunities to consider the patch:

           [3:32pm xsv] CheckPatches | GetApplyPatch
           ***************** Recommended Patch *****************
           105403-03   SunOS 5.6: ypbind/ypserv patch
           Get/Examine? [y/n] y
           Fetching ftp://sunsolve.sun.com/pub/patches/105403-03.tar.Z ...

           Patch 105403-03 retrieved from sunsolve.sun.com; README says:
           Patch-ID# 105403-03
           Keywords: security ypbind ypbind.pid diskless clients lookup rpcbind
           Synopsis: SunOS 5.6: ypbind/ypserv patch
           Date: Apr/14/00
            ...etc.
           Apply 105403-03? [y/n] n

           Cleanup 105403-03? [y/n] y
            ..etc.

         One should, of course, be very careful to  read  the  README
         documentation  that  comes  with  each  patch.  Some patches
         advise that you bring the system into single user mode, oth-
         ers  advise  that  you  reboot the system after applying the
         patch. In interactive mode you have the opportunity to defer
         the  patch if you so decide after reading the patch documen-
         tation.

         If you need to back out of a patch that you  have  installed
         you will need use the vendor provided script:

           /var/sadm/patch/nnnnnn-mm/backoutpatch

         Every vendor patch will have this procedure to  restore  the
         system to it's pre-patched state.

## OPTIONS

         Sites with a local mirror, or sites that  must  use  an  ftp
         proxy will require these options:

         -b              forces "batch" mode. No questions are  asked
                        and  patches  are  applied with minimal fuss.
                        This is the same behaviour as when  run  from
                        cron(8) or as an at(1) job.

         -s site         specifies an alternative  ftp  site  --  the
                        default  is "sunsolve.sun.com".  This is use-
                        ful if you have a local mirror of sunsolve or
                        if you need to connect through an ftp proxy.

         -u user         specifies an alternative login  id  for  the
                        anonymous  ftp  site -- the default is "ftp".
                        This is useful if you have an ftp  proxy  you
                        connect   through  --  eg.  "anonymous@proxy"
                        might be required to get through a proxy.

         -d directory    specifies the  directory  at  the  ftp  site
                        where  you  expect  to find vendor patches --
                        the default is "/pub/patches". This is useful
                        if  you  have  a local mirror but a different
                        directory structure.

## EXAMPLES

         GetApplyPatch is designed to  be  used  interactively  in  a
         pipeline with CheckPatches as in:

           [1:05pm wally] CheckPatches | GetApplyPatch

         You can also use it to selectively apply patches as in:

           [1:05pm wally] GetApplyPatch 105403-03 105552-03 108333-02

         On many systems (certainly  not  backroom  mission  critical
         servers)  you  probably  can  get  away with a cron job that
         applies all outstanding patches from a cron job.

## BUGS/BEWARE

         GetApplyPatch cannot get a patch if it isn't  there.   There
         have  been  times  when  the  Solaris patch report refers to
         patches that cannot be  found  at  their  patch  depot.  The
         vendor has also transitioned from traditional compressed tar
         files to zip files. Most recently on Solaris 7.

         GetApplyPatch  can  only  retrieve  patches   available   by
         anonymous  ftp. Sometimes Sun will have other patches hidden
         away in other support areas with different  access  require-
         ments.

         GetApplyPatch assumes the vendor patches are found at a well
         known  site  in  a  well known location with well known file
         extensions. When that changes this tool will fail.

## FILES

         CheckPatches works in a directory /tmp/GetApplyPatch.nnnn.

         When vendor patches are applied you'll discover  directories
         with  patch  number  names  in  /var/sadm/patch.   As  noted
         earler, that's where you'll find a back out procedure as may
         be  required  (seldom  if  ever) to restore things to a pre-
         patched state.  You probably ought to purge the patch direc-
         tory periodically.

         Patches,  when  applied,  update  the  package  database  at
         /var/sadm/install/contents.

## SEE ALSO

         CheckPatches(8), ftp(1), patchadd(1M), pkginfo(1M), and  Sun
         Microsystems support site at http://sunsolve.Sun.COM.

## AUTHOR

         Reg Quinton, University of Waterloo, Information Systems and
         Technology.  1999/07/09 - 2001/01/19.