AWS linux high security documentation change
Summary
Updated repository information for AL2, removed references to deprecated Amazon Linux AMI, added warnings about unmaintained EPEL repository lacking security fixes
Security assessment
Added explicit warning about EPEL repository being unmaintained and having no security updates, which directly addresses potential security risks from using outdated third-party packages
Diff
diff --git a/linux/al2/ug/add-repositories.md index 3b69193a0..867dce457 100644 --- a/linux/al2/ug/add-repositories.md +++ b/linux/al2/ug/add-repositories.md @@ -7 +7 @@ -This information applies to AL2 and Amazon Linux. For information about AL2023, see [Using Deterministic upgrades through versioned repository](https://docs.aws.amazon.com/linux/al2023/ug/deterministic-upgrades.html) in the _AL2023 User Guide_. +This information applies to AL2. For information about AL2023, see [Deterministic upgrades through versioned repositories on AL2023](https://docs.aws.amazon.com/linux/al2023/ug/deterministic-upgrades.html) in the _Amazon Linux 2023 User Guide_. @@ -9 +9 @@ This information applies to AL2 and Amazon Linux. For information about AL2023, -###### Note +By default, AL2 instances launch with the following repositories enabled: @@ -11 +11 @@ This information applies to AL2 and Amazon Linux. For information about AL2023, -The Amazon Linux AMI reached its end-of-life on December 31, 2023 and will not receive any security updates or bug fixes starting January 1, 2024. For more information about the Amazon Linux AMI end-of-life and maintenance support, see the blog post [Update on Amazon Linux AMI end-of-life](https://aws.amazon.com/blogs/aws/update-on-amazon-linux-ami-end-of-life/). We recommend that you upgrade applications to AL2023, which includes long-term support until 2028. + * `amzn2-core` @@ -13,5 +13 @@ The Amazon Linux AMI reached its end-of-life on December 31, 2023 and will not r -By default, Amazon Linux instances launch with the following repositories enabled: - - * AL2: `amzn2-core` and `amzn2extra-docker` - - * Amazon Linux AMI: `amzn-main` and `amzn-updates` + * `amzn2extra-docker` @@ -24,4 +19,0 @@ While there are many packages available in these repositories that are updated b -###### Important - -This information applies to Amazon Linux. For information about other distributions, see their specific documentation. - @@ -32 +24,2 @@ To install a package from a different repository with **yum** , you need to add - * List the installed yum repositories with the following command: +List the installed yum repositories with the following command: + @@ -38,4 +31 @@ The resulting output lists the installed repositories and reports the status of - - - -###### To add a yum repository to `/etc/yum.repos.d` +###### To add a yum repository to /etc/yum.repos.d @@ -59,3 +49 @@ After you install a repository, you must enable it as described in the next proc -###### To enable a yum repository in `/etc/yum.repos.d` - - * Use the **yum-config-manager** command with the `--enable `repository`` flag. The following command enables the Extra Packages for Enterprise Linux (EPEL) repository from the Fedora project. By default, this repository is present in `/etc/yum.repos.d` on Amazon Linux AMI instances, but it is not enabled. +###### To enable a yum repository in /etc/yum.repos.d @@ -63 +51 @@ After you install a repository, you must enable it as described in the next proc -###### Warning +Use the **yum-config-manager** command with the `--enable `repository`` flag. The following command enables the Extra Packages for Enterprise Linux (EPEL) repository from the Fedora project. By default, this repository is present in `/etc/yum.repos.d` on Amazon Linux AMI instances, but it is not enabled. @@ -65,5 +52,0 @@ After you install a repository, you must enable it as described in the next proc -The EPEL7 repository used in this example is a third-party. As of 2024-06-30 this third-party repository is _no longer being maintained_. - -This third-party repository will have _no future updates_. This means there will be _no security fixes_ for packages in the _EPEL_ repository. - -See the [EPEL section of the AL2023 User Guide](https://docs.aws.amazon.com/linux/al2023/ug/epel.html) for options for some EPEL packages. @@ -73,10 +56 @@ See the [EPEL section of the AL2023 User Guide](https://docs.aws.amazon.com/linu -###### Note - -To enable the EPEL repository on AL2, use the following command: - - [ec2-user ~]$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm - -For information on enabling the EPEL repository on other distributions, such as Red Hat and CentOS, see the EPEL documentation at [https://fedoraproject.org/wiki/EPEL](https://fedoraproject.org/wiki/EPEL). - - - +For more information, and to download the latest version of this package, see [https://fedoraproject.org/wiki/EPEL](https://fedoraproject.org/wiki/EPEL).