Author: Madhan Gopalakrishnan | Published on : 11-02-202

In large corporate environments, direct internet access is restricted due to security policies. Upgrading Linux platforms across multiple servers becomes a challenge, requiring a structured approach to ensure smooth updates without compromising security.

This document outlines: ✅ Secure ways to connect intranet servers to public repositories ✅ Network stabilization plans to prevent bandwidth choking ✅ Setting up a local repository server ✅ Configuring proxy settings for internet access

---

1️⃣ Secure Connectivity Without Violating Security Policies 🔒

✅ Method 1: Controlled Internet Access via Proxy

Organizations often use a centralized proxy to filter and control internet access. To use a proxy for package management:

• Ensure only a dedicated update server has internet access.
• Restrict access to only required repositories.
• Implement authentication and logging mechanisms.

✅ Method 2: VPN or Secure Tunneling

• Create a secure VPN tunnel from the update server to a trusted external network.
• Configure firewall rules to allow only repository-related traffic.
• Ensure strong encryption (IPSec, OpenVPN) for data integrity.

✅ Method 3: Dedicated Repository Mirror

• Set up a local repository mirror within the intranet.
• This mirror periodically syncs with public repositories while staying within security policies.
• Intranet servers fetch updates from the internal mirror instead of external sources.

---

2️⃣ Network Stabilization Plan to Prevent Firewall Bandwidth Choking 🌐

🔧 Challenges in Direct Repository Access

If all intranet servers directly connect to public repositories, excessive bandwidth usage can:

• Overload the firewall.
• Increase latency in updates.
• Cause security vulnerabilities if not properly restricted.

✅ Best Approach: Centralized Update Server

• Configure a single update server with internet access.
• Use rsync or reposync to fetch updates at scheduled intervals.
• Distribute updates internally via an HTTP-based repository mirror.
• Restrict external repository access only to this update server.

---

3️⃣ Using a Local Repository Server for Efficient Updates 🏢

Instead of allowing multiple servers to pull updates, one designated server can act as a central repository.

🔹 How It Works

• A single Linux server downloads and stores repository packages.
• Other intranet servers fetch updates from this local server instead of external repositories.
• The repository server syncs periodically with the public repositories.

🔹 Benefits

✔️ Reduces external bandwidth usage 🚀 ✔️ Ensures security compliance 🔐 ✔️ Faster update delivery ⚡ ✔️ Controlled access & logging 📜

---

4️⃣ Setting Up a Local Repository Server ⚙️

🏗 Step 1: Install Required Packages

For RHEL/CentOS:

sudo yum install httpd createrepo rsync -y

For Ubuntu/Debian:

sudo apt install apache2 createrepo rsync -y

🛠 Step 2: Enable and Start Web Server

sudo systemctl enable httpd
sudo systemctl start httpd

For Ubuntu:

sudo systemctl enable apache2
sudo systemctl start apache2

📥 Step 3: Sync Repository Data from Public Repository

For RHEL-Based Systems:

sudo reposync -p /var/www/html/repo --download-metadata --repoid=baseos --repoid=appstream
createrepo /var/www/html/repo

For Ubuntu/Debian-Based Systems:

sudo rsync -av --delete rsync://archive.ubuntu.com/ubuntu /var/www/html/ubuntu-repo

🔄 Step 4: Set Up Automatic Sync (Cron Job)

crontab -e

Add the following line to sync every night at 2 AM:

0 2 * * * /usr/bin/reposync -p /var/www/html/repo --download-metadata --repoid=baseos --repoid=appstream

🔧 Step 5: Configure Clients to Use Local Repository

On RHEL/CentOS Clients:

echo -e "[localrepo]\nname=Local Repository\nbaseurl=http://repo-server-ip/repo\nenabled=1\ngpgcheck=0" | sudo tee /etc/yum.repos.d/local.repo

On Ubuntu Clients:

echo "deb http://repo-server-ip/ubuntu-repo focal main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/local.list
sudo apt update

---

5️⃣ Configuring Proxy for Internet Access 🌐

If the organization requires a proxy server for internet connectivity, configure the package manager to use it.

Permanent Proxy Configuration

For RHEL/CentOS:

echo "proxy=http://proxy-server:port" | sudo tee -a /etc/yum.conf

For Ubuntu:

echo 'Acquire::http::Proxy "http://proxy-server:port";' | sudo tee /etc/apt/apt.conf.d/proxy.conf

Temporary Proxy Configuration

For RHEL/CentOS:

export http_proxy="http://proxy-server:port"
export https_proxy="http://proxy-server:port"
yum update

For Ubuntu:

export http_proxy="http://proxy-server:port"
export https_proxy="http://proxy-server:port"
sudo apt update

---

🎯 Final Thoughts

By implementing this approach: ✔️ The security policy remains intact ✅ ✔️ Bandwidth utilization is optimized ✅ ✔️ Linux updates are centralized and efficient ✅ ✔️ The IT team gains full control over software distribution ✅

This plan ensures that all Linux servers in an intranet environment receive timely updates while complying with strict security policies. 🚀