Building a DNF/YUM mirror from ULN
It is very common for admins to not enable internet access for the systems running in a secure network, like banking of Government networks. A local mirror of Oracle’s Unbreakable Linux Network (ULN) is a great way to allow systems to access patches without having to reach out across the internet to access them.
Getting ready
To do this, you will need a YUM server system running Oracle Linux 8. The local system should have internet access to be able to reach the ULN servers via direct access or a proxy server. Only the system (often called a YUM server) synchronizing to ULN will require this access; all the systems using this system will not need access to the internet, they will use this system to access patches.
The system is not CPU- or RAM-intensive – 2 cores and 4 GB of RAM are often more than enough for the server, but the system will use a lot of disk space. You can check how much space is needed by running the dnf repolist -v command.
A terabyte can go quickly, depending on how many repos the server is subscribed to. The good news on space is that high-performance storage is not required. You will also need a valid support contract with Oracle, which is included with the hardware support contract if you are running on Oracle servers. On my local repos, I keep the repo in /var/www and mount it as a separate filesystem under Logical Volume Management (LVM). This way, additional space can easily be added when needed.
Additionally, an HTTP server should be installed and you must ensure that the firewall ports are opened. If you need help doing that, go back to Chapter 2, Installing with and without Automation Magic, where setting up a HTTP server is covered.
How to do it…
To build the mirror, follow these steps:
- The first step is to validate that enough space is in /var/www. For even a small mirror, 600 GB is recommended as a starting point. Watch the disk space carefully, as more will be needed down the road. Larger mirrors can easily consume 2 TB.
- Next, install the uln-yum-mirror package using the dnf install uln-yum-mirror -y command. The uln-yum-mirror package includes the scripts that automate the replication of the Oracle ULN repository to a local server. Make sure that the system has access to the ol8_addons repo:
Figure 5.9 – The uln-yum-mirror install
3. This will install the scripts from Oracle. Next, let’s register the system with ULN. This is done using the uln_register command. You will need to know the support identifier (SI) you will be using for the system, as well as your Oracle single sign-on (SSO) credentials. As a note, SIs are also often called by an older term, customer support identifier (CSI). To start the process of registering the server, run the uln_register command. From there, you will get the main screen:
Figure 5.10 – The uln_register start screen
4. Click Next to continue. On the next screen, you will be prompted to put in your Oracle SSO credentials. The CSI is the support identifier. Use the CSI assigned to you with your Premier hardware support, or your Oracle Linux subscription. Do not use a CSI for the Oracle database, WebLogic, E-Business Suite, and so on. The CSI should be for Oracle Linux.
Note
In production environments, you may want to consider creating a shared account to register all your servers using ULN directly. This makes it easier to manage the servers as staff members come and go.
Figure 5.11 – The uln_register credentials
5. Next, you will need to identify the server for ULN. Normally, you would use the Fully Qualified Domain Name (FQDN) of the server, but the choice is yours. You can also choose to upload the hardware details, but this is optional.
Figure 5.12 – The uln_register system name
6. Next, the system will update ULN with the software installed on the server, which will let you track installed RPMs via ULN but only for systems directly registered with ULN. When using a local repository, you may want to consider using a tool such as Oracle Linux Manager to track software installed on systems not registered with ULN:
Figure 5.13 – The uln_register initial packages
7. Registering the server with ULN is almost complete. The last step is to send the info to ULN to register the server, this is done automatically in the next step:
Figure 5.14 – uln_register send
The upload can take up to a minute, depending on your internet speed.
After the upload, the system is now registered in ULN. The next step is optional. It will set up Ksplice for the server. If you do not want to use Ksplice, you are done. Ksplice also requires that you have an Oracle Linux Premier Support subscription. This is included with Oracle hardware support and Oracle Cloud VMs. You can also purchase this for third-party systems, often at a cheaper price than other commercial Linux distributions.
Figure 5.15 – uln_register ksplice
8. Ksplice is a quick step; just review the settings, as seen in the following screenshot, and click OK:
Figure 5.16 – The uln_register settings
9. The registration is now complete. You should now patch the server with dnf -y update (as recommended in the tool) before continuing:
Figure 5.17 – Completed uln_register
10. Next, go ahead and patch the system with dnf update -y and reboot the system. As a note, the position of the -y option does not matter for the command. Once the system is back online, you need to log in to https://linux.oracle.com/. While this server is registered to ULN now, it is not a local repo yet! We need to tell ULN this is a local repo and select what repos we need to mirror.
