Questions[automatic-updates](server)

As part of my job I manage a few tens of CentOS 5 servers, using puppet for the main set up. About half of our servers have a standardised set up for hosting various django sites, while the rest are a mish mash of applications.

I'm gradually sorting out our hosting practices, and I've now got to the point of working out how to manage security updates at the OS level. I'm wary of just having a cron job doing a yum -y update but also don't want to have to go round each server in time and review every package with updates available, as that would take a while.

So I'm wondering if there are any good shortcuts or working practices that would minimise the risks involved and minimise the amount of time I need to spend. Or to put it another way are there any tools or practices that can automate a lot of the work while still giving control.

Steps I've decided on so far:

• disable all third party repositories and set up our own repository so I can control what updates go through there.
• we have staging servers for (most of) our production servers where I could do testing (but how much testing is enough testing?)

Also note that I've looked into the yum security plugin but it does not work on CentOS.

So how do you manage updates for significant numbers of CentOS servers running a heterogeneous array of applications?

I'd like to leave Windows Automatic Updates enabled but block a specific patch from being installed that is causing us problems.

Is this possible? Anyone know how to do that?

Does anyone know of a good tool for managing updates to Acrobat Reader?

I've just noticed that there is yet another security update, and I'd love to find something as good as WSUS to manage it.

Do the third-party tools like Shavlik do the trick?

I'm just tweaking out my new Windows 7 laptop and wanted to disable the automatic Java updating (and thus kill the silly jusched.exe background process), but I can't seem to get it to actually turn it off.

I found the Java Control Panel applet and found the settings on the Update tab that should control it. I can turn them off, apply them, and close the dialog successfully. But if I just open the dialog backup again right away, I see that the changes weren't actually made. I've tried it numerous times and it just doesn't take. What's up with that?

I also tried to disable the icon in the system tray and got the same effect. Changing the size of the Temporary Internet Files cache work however.

Any ideas? Thanks!

Now that I have started the Software Update service on my Leopard Server, how do I change my client Macs to check for updates on it?