LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 09-08-2017, 06:35 AM   #1
pranesh.annamalai
LQ Newbie
 
Registered: Sep 2017
Posts: 7

Rep: Reputation: Disabled
Is there a patch management tool for patching Heterogeneous Linux servers in an enterprise?


Hi,
Is there a centralized patch management tool/mechanism by which we can patch heterogeneous Linux servers like CentOS, Ubuntu and Redhat Linux etc? How patching of these servers can be done efficiently? Apologies for my ignorance and I am studying if such tool is available and how efficient it can be for an enterprise level with ~4000 - 5000 Linux servers with various flavours
 
Old 09-08-2017, 07:30 AM   #2
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,432

Rep: Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496
Quote:
Originally Posted by pranesh.annamalai View Post
Hi,
Is there a centralized patch management tool/mechanism by which we can patch heterogeneous Linux servers like CentOS, Ubuntu and Redhat Linux etc? How patching of these servers can be done efficiently? Apologies for my ignorance and I am studying if such tool is available and how efficient it can be for an enterprise level with ~4000 - 5000 Linux servers with various flavours
In general, the answer is "no". Both kernel and application versions, patch formats, package formats, file system trees, and configuration differences between those versions of Linux make them almost as different as Linux and Windows. One patch manager will not apply to all of them.

Now to specifics. There are some patch managers that CAN be configured to handle each of those versions separately and install what patches are available in the default repositories for that version. It is not pretty.

I have, in the past, built my own solutions rather than put up with the flaws in all of the existing packages I was able to discover. Something may have evolved to improve the situation since then, my last testing and rollout was a couple of years ago now.

PS. This gets REALLY easy if all of your nodes are the same version of the same distribution. For that there are multiple tools for patch management, and several good configuration management tools. Your problem is the range of distributions you run makes the problem "interesting".

Last edited by wpeckham; 09-08-2017 at 07:44 AM.
 
1 members found this post helpful.
Old 09-11-2017, 05:10 AM   #3
pranesh.annamalai
LQ Newbie
 
Registered: Sep 2017
Posts: 7

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by wpeckham View Post
In general, the answer is "no". Both kernel and application versions, patch formats, package formats, file system trees, and configuration differences between those versions of Linux make them almost as different as Linux and Windows. One patch manager will not apply to all of them.

Now to specifics. There are some patch managers that CAN be configured to handle each of those versions separately and install what patches are available in the default repositories for that version. It is not pretty.

I have, in the past, built my own solutions rather than put up with the flaws in all of the existing packages I was able to discover. Something may have evolved to improve the situation since then, my last testing and rollout was a couple of years ago now.

PS. This gets REALLY easy if all of your nodes are the same version of the same distribution. For that there are multiple tools for patch management, and several good configuration management tools. Your problem is the range of distributions you run makes the problem "interesting".
Thanks a lot for this reply and your response made me to dig in further in the internet and I came up with this, https://www.ivanti.com/products/patc...linux-unix-mac please share your opinion if this tool would help patching heterogeneously? Also, I came across some of the blogs, where they had mentioned at a high level about 'ansible' system configuration tool, that can be used for automating the patch management in Linux servers. Also few about spacewalk, please share if these tool would be of help?

Last edited by pranesh.annamalai; 09-11-2017 at 05:11 AM.
 
Old 09-11-2017, 07:52 AM   #4
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,432

Rep: Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496
Your link provided some interesting reading. I was not aware of that product, and they do a good of of selling the concept (and product) without actually revealing anything about HOW they resolve the problem. Without actually trying the product in a mixed environment I cannot tell you how well it works for a situation like yours, but they offer a free trial that might be illuminating.

Ansible is a powerful tool for configuration management and some kinds of automation. It understands a bit about RHEL, Windows server, and VMWARE, but I am not at all sure it will grok Ubuntu or SUSE. I have not seen it used for patch management of any kind, and have no idea what a YAML rule for that would look like. Just because I have not used it for that does not mean no one has, you may want to get information from those who have tried.

SPACEWALK is a neat tool, but very RHEL specific (Which means it works well also with Fedora, Scientific, and CentOS). To my knowledge, no one uses it for patch management for ANYTHING that does not look like RHEL.

There are tools that are nearly optimal for configuration management in an environment with many kinds of Linux, BSD, and Unix (AIX/HP_UX, etc). There are tools that are optimal for configuration management of a Windows farm. I have not seen one that works over a range including multiple DIFFERENT version of Linux AND works well with Windows, but I can believe one should exist. Those are not what you want, you want patch deployment over that range of systems. Since the patches and patch tools differ widely over that range of systems the problem is "interesting" and the solution complex. I have not seen one working that is worth the price of a free trial. That does not mean it does not exist, it means I did not find one.

I would look for more answers before you test, and I would test before you buy. I might also want to contact and communicate with people who have tried and discovered the problems. (There are ALWAYS problems.) Generally the company will not want to give you contact information for contracts that they lost, but you need to find one or two of those people as well. All of this makes sure you do not pay for a product that does not solve your problems, or makes them WORSE. It also helps make your expectations realistic when you do adopt a solution.

A new thread requesting feedback from anyone who has attempted to use the IVANTI tool for patch management in a mixed environment might be in order.

I hope that this helps you a bit. I feel like I have provided a lot of NON-information, rather than any answers.
 
2 members found this post helpful.
Old 09-11-2017, 08:05 AM   #5
pranesh.annamalai
LQ Newbie
 
Registered: Sep 2017
Posts: 7

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by wpeckham View Post
Your link provided some interesting reading. I was not aware of that product, and they do a good of of selling the concept (and product) without actually revealing anything about HOW they resolve the problem. Without actually trying the product in a mixed environment I cannot tell you how well it works for a situation like yours, but they offer a free trial that might be illuminating.

Ansible is a powerful tool for configuration management and some kinds of automation. It understands a bit about RHEL, Windows server, and VMWARE, but I am not at all sure it will grok Ubuntu or SUSE. I have not seen it used for patch management of any kind, and have no idea what a YAML rule for that would look like. Just because I have not used it for that does not mean no one has, you may want to get information from those who have tried.

SPACEWALK is a neat tool, but very RHEL specific (Which means it works well also with Fedora, Scientific, and CentOS). To my knowledge, no one uses it for patch management for ANYTHING that does not look like RHEL.

There are tools that are nearly optimal for configuration management in an environment with many kinds of Linux, BSD, and Unix (AIX/HP_UX, etc). There are tools that are optimal for configuration management of a Windows farm. I have not seen one that works over a range including multiple DIFFERENT version of Linux AND works well with Windows, but I can believe one should exist. Those are not what you want, you want patch deployment over that range of systems. Since the patches and patch tools differ widely over that range of systems the problem is "interesting" and the solution complex. I have not seen one working that is worth the price of a free trial. That does not mean it does not exist, it means I did not find one.

I would look for more answers before you test, and I would test before you buy. I might also want to contact and communicate with people who have tried and discovered the problems. (There are ALWAYS problems.) Generally the company will not want to give you contact information for contracts that they lost, but you need to find one or two of those people as well. All of this makes sure you do not pay for a product that does not solve your problems, or makes them WORSE. It also helps make your expectations realistic when you do adopt a solution.

A new thread requesting feedback from anyone who has attempted to use the IVANTI tool for patch management in a mixed environment might be in order.

I hope that this helps you a bit. I feel like I have provided a lot of NON-information, rather than any answers.
I think, I am moving in the right direction to find the solution and all your "Non-Information" really makes sense to me and thanks for showing a direction.
 
Old 09-11-2017, 11:40 PM   #6
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,790

Rep: Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538
An alternative to Ansible is 'puppet', which can handle those 3 Linuxes.
It also handles MSWin (though only as a client I believe).
It comes as Enterprise (paid for) or open src ie free - no support. Your choice.

Others in that area inc Chef & Salt. You should have a read (& play if possible) with all of them and decide which one you want.
 
1 members found this post helpful.
Old 09-12-2017, 12:26 AM   #7
pranesh.annamalai
LQ Newbie
 
Registered: Sep 2017
Posts: 7

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by chrism01 View Post
An alternative to Ansible is 'puppet', which can handle those 3 Linuxes.
It also handles MSWin (though only as a client I believe).
It comes as Enterprise (paid for) or open src ie free - no support. Your choice.

Others in that area inc Chef & Salt. You should have a read (& play if possible) with all of them and decide which one you want.
Ok. But, can Chef be used for patching the servers as well? If so, can you help me on how is it used?
 
Old 09-13-2017, 05:04 AM   #8
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,790

Rep: Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538
I'm afraid we use Puppet where I work; I haven't used the other players in the market.
If you use Chef, I'd assume they have their own Community support setup eg https://www.chef.io/community/
 
1 members found this post helpful.
Old 09-13-2017, 05:16 AM   #9
pranesh.annamalai
LQ Newbie
 
Registered: Sep 2017
Posts: 7

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by chrism01 View Post
I'm afraid we use Puppet where I work; I haven't used the other players in the market.
If you use Chef, I'd assume they have their own Community support setup eg https://www.chef.io/community/
Thanks a lot
 
Old 09-13-2017, 05:20 AM   #10
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,432

Rep: Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496Reputation: 1496
Quote:
Originally Posted by chrism01 View Post
I'm afraid we use Puppet where I work; I haven't used the other players in the market.
If you use Chef, I'd assume they have their own Community support setup eg https://www.chef.io/community/
Do you control patch levels or software version updates using puppet?
 
Old 09-26-2017, 04:09 AM   #11
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,790

Rep: Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538
Quote:
Do you control patch levels or software version updates using puppet?
Actually, in Puppet you can tag a pkg 'latest' so it always updates, or you can specify a specific 'version' (amongst other attributes) so its always locked to that and won't update; see eg
 
Old 01-17-2018, 05:02 AM   #12
derek765
LQ Newbie
 
Registered: Jan 2018
Posts: 1

Rep: Reputation: Disabled
Ivanti / Lumension .. ?

Anyone used / what are your thoughts about the product. We use on Windows and are thinking of extending to Linux (OEL and RHEL)

Thanks
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Open Source Patch Management Tool kdvfense Linux - Newbie 1 03-08-2014 11:14 AM
LXer: Patch Management of Linux Servers Using Spacewalk LXer Syndicated Linux News 0 07-01-2013 08:42 PM
Linux Enterprise Distribution and Central Patch Management jpa9058 Linux - Enterprise 4 02-15-2008 08:16 AM
patch management tool hassan2 SUSE / openSUSE 1 06-09-2005 02:25 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 09:26 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration