rocky8内网离线批量补丁（你之前搭建的架构，多台服务器首选，无订阅）

1.第一步：外网同步机（能上网）搭建全量定时仓库

同步机写入阿里云 Rocky8 完整源（不要用过期 CentOS8 归档源）

bash 复制代码

rm -rf /etc/yum.repos.d/*
cat > /etc/yum.repos.d/Rocky8-Aliyun.repo <<'EOF'
[rocky8-BaseOS]
name=Rocky Linux 8 BaseOS
baseurl=https://mirrors.aliyun.com/rockylinux/8/BaseOS/x86_64/os/
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/rockylinux/RPM-GPG-KEY-rockyofficial
enabled=1

[rocky8-AppStream]
name=Rocky Linux 8 AppStream
baseurl=https://mirrors.aliyun.com/rockylinux/8/AppStream/x86_64/os/
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/rockylinux/RPM-GPG-KEY-rockyofficial
enabled=1

[rocky8-extras]
name=Rocky Linux 8 Extras
baseurl=https://mirrors.aliyun.com/rockylinux/8/extras/x86_64/os/
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/rockylinux/RPM-GPG-KEY-rockyofficial
enabled=1

[rocky8-PowerTools]
name=Rocky Linux 8 PowerTools
baseurl=https://mirrors.aliyun.com/rockylinux/8/PowerTools/x86_64/os/
gpgcheck=1
gpgkey=https://mirrors.aliyun.com/rockylinux/RPM-GPG-KEY-rockyofficial
enabled=1
EOF

rpm --import https://mirrors.aliyun.com/rockylinux/RPM-GPG-KEY-rockyofficial
dnf clean all && dnf makecache

安装同步工具（用原生createrepo，避开createrepo-c找不到包问题）

bash 复制代码

dnf install -y yum-utils createrepo httpd wget cronie epel-release
systemctl enable --now httpd
firewall-cmd --add-service=http --permanent && firewall-cmd --reload

创建仓库目录 + 同步脚本

Kotlin 复制代码

mkdir -p /var/www/html/yum/rocky8.10/{BaseOS,AppStream,Extras,PowerTools,epel}

新建 /opt/sync_yum.sh

bash 复制代码

#!/bin/bash
LOCK=/tmp/sync_yum.lock
exec 9>$LOCK
flock -n 9 || exit 1
REPO=/var/www/html/yum/rocky8.10

reposync --delete --download-metadata -p $REPO --repoid=rocky8-BaseOS
reposync --delete --download-metadata -p $REPO --repoid=rocky8-AppStream
reposync --delete --download-metadata -p $REPO --repoid=rocky8-extras
reposync --delete --download-metadata -p $REPO --repoid=rocky8-PowerTools
reposync --delete --download-metadata -p $REPO --repoid=epel

createrepo --update $REPO/rocky8-BaseOS
createrepo --update $REPO/rocky8-AppStream
createrepo --update $REPO/rocky8-extras
createrepo --update $REPO/rocky8-PowerTools
createrepo --update $REPO/epel

chcon -R -t httpd_sys_content_t $REPO
echo "同步完成: $(date)" >> /var/log/yum_sync.log

bash 复制代码

chmod +x /opt/sync_yum.sh
# 首次全量同步
/opt/sync_yum.sh
# 定时每日凌晨2点增量同步补丁
echo "0 2 * * * /opt/sync_yum.sh >> /var/log/yum_sync.log 2>&1" | crontab -

第二步：内网所有 RHEL 客户端统一配置（彻底干掉订阅报错）

bash 复制代码

# 1. 卸载订阅组件，永久消除授权提示
subscription-manager unregister
subscription-manager clean
dnf remove -y subscription-manager
rm -rf /etc/rhsm /var/lib/rhsm /etc/yum.repos.d/redhat.repo
# 2. 清空原有源
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/
mkdir /etc/yum.repos.d

新建内网源文件 /etc/yum.repos.d/intranet.repo 把下面 IP 换成你同步服务器内网 IP

bash 复制代码

[BaseOS]
name=Intranet BaseOS
baseurl=http://192.168.1.100/yum/rocky8.10/rocky8-BaseOS
gpgcheck=1
gpgkey=http://192.168.1.100/yum/rocky8.10/RPM-GPG-KEY-rockyofficial
enabled=1

[AppStream]
name=Intranet AppStream
baseurl=http://192.168.1.100/yum/rocky8.10/rocky8-AppStream
gpgcheck=1
gpgkey=http://192.168.1.100/yum/rocky8.10/RPM-GPG-KEY-rockyofficial
enabled=1

[extras]
name=Intranet extras
baseurl=http://192.168.1.100/yum/rocky8.10/rocky8-extras
gpgcheck=1
gpgkey=http://192.168.1.100/yum/rocky8.10/RPM-GPG-KEY-rockyofficial
enabled=1

[PowerTools]
name=Intranet PowerTools
baseurl=http://192.168.1.100/yum/rocky8.10/rocky8-PowerTools
gpgcheck=1
gpgkey=http://192.168.1.100/yum/rocky8.10/RPM-GPG-KEY-rockyofficial
enabled=0

[epel]
name=Intranet epel
baseurl=http://192.168.1.100/yum/rocky8.10/epel
gpgcheck=1
gpgkey=https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8
enabled=1

bash 复制代码

# 导入密钥并刷新缓存
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial http://192.168.1.100/yum/rocky8.10/RPM-GPG-KEY-rockyofficial
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial
dnf clean all && dnf makecache

客户端打补丁命令（全程无红帽订阅）

bash 复制代码

# 只修复安全漏洞（推荐）
dnf update --security -y
# 全部软件升级
dnf update -y
# 开启自动安全更新
dnf install -y dnf-automatic
sed -i 's/upgrade_type =.*/upgrade_type = security/' /etc/dnf/automatic.conf
sed -i 's/apply_updates =.*/apply_updates = yes/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic.timer