WSUS Alternative solution for Linux Systems

[-]

Your_bad_sins@reddit

[Ansible & Puppet ](https://www.thecybersecuritytimes.com/linux-patch-management-made-easy-the-top-6-tools-you-need-to-know/) are good ones to check out.

Reply

[-]

For CentOS and others in the RedHat/Fedora family the OSS tool is called Spacewalk. That's the CentOS equivalent to RedHat Satellite CentOS:RHEL:: SpaceWalk:Satellite I've never used the debian side of it, but it is supposed to support it.

Reply

[-]

Nietechz@reddit

Was Spacewalk not discontinued on 2020?

Reply

[-]

mitspieler99@reddit

Isn't https://www.uyuni-project.org/ the successor to spacewalk?

Reply

[-]

levidurham@reddit

That's the OpenSUSE fork, it's the upstream for SUSE Manager.

Reply

[-]

Nietechz@reddit

>Uyuni offers seamless management of SUSE Linux Enterprise, openSUSE, Red Hat Enterprise Linux, CentOS, Oracle Linux, Ubuntu, Debian, Amazon Linux, and AlmaLinux client systems. It seems it works for many.

Reply

[-]

levidurham@reddit

Yeah, I was just pointing out it was a fork and who its maintainer is. /I/ wouldn't call it a successor, but that's a largely semantic argument. Oracle still maintains a port as well.

Reply

[-]

Hotshot55@reddit

The open source project for spacewalk has been discontinued but Oracle is still "maintaining" it but under the name Oracle Linux Manager.

Reply

[-]

friedrice5005@reddit

It would appear you're right! I haven't touched it in ages....I ran with Satellite 5 back in the day and have maintained that ever since. Looks like Satellite isn't even based on it anymore...I never even noticed since we had the subscriptions already.

Reply

[-]

Bijorak@reddit

Yes I was going to use it but l couldn't

Reply

[-]

jkalchik99@reddit

Just.... don't. As others have noted, SW has been abandoned by BlueBeanie, I mean RedHat, and unforunately, picked up by Oracle. It's got scaling problems and major problems handling errata. And if it's being run by Oracle..... instantly suspect, IMO. If they could monetize it, they sure would/will in a heartbeat. Katello/TheForeman is the open source upstream project from RHSat6. I do have it running \[mostly\] here at home, currently serving up OpenSuSE repos. Very powerful, and does have a learning curve.

Reply

[-]

yukon_corne1ius@reddit

There might be bigger and better solutions since I’ve had to manage Linux systems, but I used Spacewalk with a lot of success. https://spacewalkproject.github.io

Reply

[-]

rainer_d@reddit

It’s dead. Suse and Oracle have forks. Suse‘s is based on salt as automation solution - you really have to want to use that.

Reply

[-]

sont21@reddit

Have you looked into ubuntu maas

Reply

[-]

rainer_d@reddit

Only works for Ubuntu.

Reply

[-]

trelm249@reddit

Pulp and ansible can handle this fine.

Reply

[-]

michaelhbt@reddit

theforeman can do it, has puppet built into it and a whole lot more, but ansible is easier to implement and a lot more flexible in the long run.

Reply

[-]

jmp242@reddit

How is ansible more flexible than puppet? I can see easier to deploy, but puppet is extremely flexible IME.

Reply

[-]

michaelhbt@reddit

Oh puppet is very flexible but foreman guides you in specific direction more so than ansible and has a little more overhead in terms of setup.

Reply

[-]

craw4d@reddit

Automox

Reply

[-]

simon_uk1@reddit

If you go Ubuntu you can use landscape

Reply

[-]

Sad_Swimmer4103@reddit

APT/RPM caching server Ansible/AWX/Rundeck update job

Reply

[-]

cabledog1980@reddit

+1 Ansible

Reply

[-]

contract0rReal@reddit (OP)

I think this is a really good idea. We have our dev/test environment, so I am gonna test it there for some time. Soon we will need to migrate our outdated CentOS servers as well

Reply

[-]

Bluetooth_Sandwich@reddit

If you’re moving from CentOS, I’m a big fan of AlmaLinux

Reply

[-]

malikto44@reddit

Same. Have a caching server that uses `reposync` for the Red Hat side, which ensures all RPMs in the repo are signed and the signatures are validated. For APT, `apt-mirror`. For the jobs themselves, Ansible Tower/AWX and Rundeck come to mind. AWX is nice for a single pane of glass.

Reply

[-]

SpongederpSquarefap@reddit

What do you use for compliance and reporting?

Reply

[-]

IT_CertDoctor@reddit

Love Ansible, excellent tool

Reply

[-]

beezneezy@reddit

Automox May be worth a look.

Reply

[-]

Appropriatelog8195@reddit

We run Puppet + aptly for Debian package repositories (both as cache and to include some of our packages) > My suggested solution to pushing new package updates is creating local repository, that is connected to internet, and all the other servers are connected to it. Exactly what [aptly](https://www.aptly.info/) is for. No idea about CentOS side, for that we just had rsync from official repo + some scripts

Reply

[-]

Spubs_The_Name@reddit

Red Hat Satellite or Pulp

Reply

[-]

hoffabear@reddit

I use Manage Engine Desktop Central for my Linux boxes.

Reply

[-]

This--Username@reddit

A coworker built this in our org for Centos servers. We host local mirrors but now systems using our config package also register to a management server that sets update schedules, reboots on kernel update settings etc. It's actually 10x better than wsus IMO, very simple but entirely custom.

Reply

[-]

AmazingSwindle@reddit

Just mirror the repos

Reply

[-]

sembee2@reddit

Ubuntu has a caching proxy solution which works well. [https://help.ubuntu.com/community/Apt-Cacher%20NG](https://help.ubuntu.com/community/Apt-Cacher%20NG) I have a client on relatively low bandwidth, but lots of Linux based systems (over 100 Raspberry Pis for example) and it saves a huge amount of bandwidth. They just have a script that goes through each of them and runs the apt commands, as most of them are 100% identical. Probably more elegant ways of doing it, so could be combined with some other solutions.

Reply

[-]

fantomas_666@reddit

FYI apt-cacher and apt-cacher-ng are both available in debian.

Reply

[-]

contract0rReal@reddit (OP)

Thank you. I will most definitely give this a try as well. Apt-cacher is mostly targeted towards Debian servers

Reply

[-]

xXxLinuxUserxXx@reddit

we had some issues with apt-cacher-ng. I think mostly it was kind of stuck and restart of the daemon solved it. But also had sometimes to clean the repo metadata to work again - not sure why. We switched to Nexus Repository Manager (as we are using it for other repositories already) and that works quiet well. Nexus also has support for yum repositories. We have also teams using aptly but mainly because they also package own deb packages.

Reply

[-]

m0ta@reddit

Spacewalk

Reply

[-]

Ok_Presentation_2671@reddit

WSUS and Linux in same paragraph - wow

Reply

[-]

Hotshot55@reddit

Not only did you make a stupid comment, but you actually went and made two stupid ass comments back to back. This almost reads like someone used ChatGPT to write a response but only copied half of the relevant words.

Reply

[-]

Sad_Swimmer4103@reddit

Did you even bother to read the OP?

Reply

[-]

Zehicle@reddit

If you are lookkofor option: My company, [RackN](https://rackn.com), makes and IaC automation platform, Digital Rebar, that has integrated support for Linux (and other) O/S provisioning. All API driven with a solid UX too. It's commercial and supported with a free trial and community license too. It can do Windows via image deploy too.

Reply

[-]

pdp10@reddit

Golden images have been obsolete for twenty years. We only use monolithic images for embedded systems that have no package systems and *only* deploy as monolithic firmwares. Note that even OpenWrt, a specialty embedded distro, has a standard package system.

Reply

[-]

pdp10@reddit

A local repository is an excellent solution, but not the only one. When we used CentOS/RHEL, I deployed `mrepo` for this. Today, our policy doesn't encourage us to delay updates for any reason, instead of a local mirror we use a Squid forward proxy that whitelists specific vendor FQDNs. Through that mechanism, we ensure supply-chain integrity of updates -- and of course all distros use package signing as well. Typically we have the individual servers configured to use cleartext HTTP to retrieve packages, then we have the Squid proxy rewrite those into HTTPS for its own download. Since the proxy sees cleartext, it can keep a local disk cache of the packages. This is actually an unnecessary precaution, but it's easy and works. You need to start by defining your requirements, and then inventorying your environment. Highly distributed servers in low-bandwidth environments present a more difficult problem than a small number of datacenters with high-speed uplinks.

Reply

[-]

jshackles@reddit

Is your goal here bandwidth savings? Or monitoring of patches? If monitoring is your primary concern, check out [Patchman](https://github.com/furlongm/patchman). As others have mentioned, an Apt caching solution is the way to go for bandwidth savings.

Reply

[-]

tallblonde402@reddit

Well it's not free like wsus but RHEL satellite

Reply

[-]

nwmcsween@reddit

Why? You make all servers have a single point of failure for updates now. Even if you even do the HA setup for it, the benefit is of bandwidth savings are slim and the downsides of not having critical updates is catastrophic.

Reply

[-]

Avas_Accumulator@reddit

Azure, and for on-prem Azure Arc has a feature that replaces WSUS and also supports a list of Linux SKUs. We've used that successfully. It's then via Azure Arc and https://portal.azure.com/#view/Microsoft_Azure_Automation/UpdateCenterMenuBlade/~/machines

Reply

[-]

Ok_Presentation_2671@reddit

Why not quit comparing Linux and Windows lol as clearly Linux has always been more mature for IT management. Windows if anything in the last 10 years has taken pages from how Linux does things and added it to their playbook. If your running something outdated, maybe there is a reason for that. Let’s rephrase your question: In your production environment with your company, what is your strategy for

Reply

[-]

ZAFJB@reddit

Sigh.

Reply

[-]

samon33@reddit

Foreman+Katello is an approximation of WSUS for RHEL/CentOS/etc and Debian. It is effectively just internal repos, but it effectively presents a virtual repo to each host and then uses host groups and policies to selectively include the relevant package versions to each. The web interface is a little clunky, but it's very powerful. Takes a bit of setting up and configuration, but once it's humming along it makes light work of things like pilot groups, version pinning, etc.

Reply

[-]

HipsterSlug@reddit

Not that I know of, local repo is the way to go.

Reply

[-]

chandleya@reddit

I mean that’s a portion of the SUS model lol. No concept of reporting though.

Reply

[-]

horus-heresy@reddit

You can use your vulnerabilities scanning tool to report

Reply

[-]

jkinninger@reddit

https://www.uyuni-project.org/

Reply

[-]

AnomalyNexus@reddit

AptcacherNG ...basically like a transparent proxy type deal. NB it can only cache http not https. You need change the settings to make https flow through else those will just fail. Most core OS repos are http so mostly fine Comes with a dash so that you can see how much its saving https://i.imgur.com/HMnadWV.png

Reply

[-]

LevelHQ@reddit

You might want to check out [Level.io](https://level.io) which does patching for Windows, Mac, and Linux.

Reply

[-]

maikeu@reddit

Your suggestion is simple and will work. Just work out the Ansible / cloud-init / puppet manifests to drive it, it will work. There are some more sophisticated platforms for it - red hat's satellite (or upstream projects, katello/foreman) on the RH side, Ubuntu has Landscape, and I think SUSE forked off the old Spacewalk project? However those platforms are quite heavyweight - if you were after a windows world analogy, they are more in the scope of SCCM than WSUS - and I wouldn't go near them unless you can legitimately dedicate a couple of people to it.

Reply

[-]

minimishka@reddit

what prevents you from enabling auto-update or using ansible? Of course, you can make a local repository, but it will be two more servers, well, or a service for which you need a lot of space.

Reply to Post

61 Comments