I am trying to make a centralized patch management tool, which can be used to perform the controlled update of all the Ubuntu machines in my network.

I did some research, and collected the following information :-

  • There is a paid tool called Landscape, which can be used to achieve the same purpose. But, it is way to expensive.
  • There are other tools like Puppet/Chef/Ansible, which are mainly config tools.
  • Pulp which is basically a repository cloning tool.

The thing is I would like to achieve a combination of these. And, am wiling to put the effort in order to achieve it.

My requirements are :-

  1. To get the list of packages which need to updated [available at Ubuntu Security Notices], along with its dependencies
  2. Download those packages from a Windows machine, and keep it there.
  3. Later, Distribute these to all Ubuntu machines, as needed.

Edit : I want to avoid the each Ubuntu machine from going online, due to bandwidth constraints

Is there any API available to get the above mentioned package list (with dependencies)? If yes, for free or paid?

  • Are you trying to keep the Ubuntu machines disconnected from the internet or something? Jul 30 '15 at 0:06
  • Yes, I want to avoid each machine going online. And, want all the downloads to go through my Windows machine before reaching the Ubuntu machines, for efficient bandwidth utilization. I forgot to mention in the question itself. Will update the same. Jul 30 '15 at 5:52
  • Do you specifically want to prevent the ubuntu machines being connected to the internet, or is it just about bandwidth? Jul 30 '15 at 7:35
  • Yes, I would like to keep them disconnected from the internet, for patching. This is mainly due to bandwidth. Also, I want to patch them in a centralized manner. Please suggest options either way. Jul 30 '15 at 9:03

Assuming you're not actually trying to air-gap the machines for security purposes or something:

  1. Connect one ubuntu machine to the internet. Install updates as normal with apt-get.

  2. The .deb's you just upgraded that box with are now stored in /var/cache/apt/archives.

  3. scp the .deb's to each of the other ubuntu machines.

  4. At a cost of a little bandwidth, on each other machine, place the .debs in /var/cache/apt/archives and run apt-get update && apt-get upgrade (or aptitude, or something). The machine will hit the network to get the new package list, but when it comes to download the packages for upgrade, it'll find it already has them in its cache, and just install them.

  5. For maximum bandwidth conservation, just install the new .deb's with dpkg -i <files.

Obviously, it's slightly more complicated if you have a mix of 32 and 64-bit boxes, diff't architectures, etc. But you'd still have to download all the updated packages anyway.

  • Yeah. It seems like one of the options. As you said, this will add the overhead of nominating a machine for each arch, version, etc. Also, this will be a measure of just blindly keeping each of the machines to the latest. I am looking for an option which sort-of gets the security updates list on my windows machine. And, selecting & deploying particular updates to the required machines. (Not completely air-gapped. But, identical as far as patching is concerned) Jul 30 '15 at 9:44
  • Get docker for windows, and run the upgrade machine in a docker container on the windows machine. Jul 30 '15 at 19:59
  • I had a look at docker. But, am looking for more of an automated option. Maybe some APIs or other ways to list the packages along with its dependencies. On a different note, I came across this repository from yum http://in.archive.ubuntu.com/.. & a little bit about its documentation at https://help.ubuntu.com/community/... I know that this contains all the latest packages. Is there any way to determine the dependencies resolution as well? Can this be somehow linked to the Security Updates given at USN. Jul 31 '15 at 13:06
  • What's not automated about docker? Shell scripts and cron jobs, bro. You can automate anything. Jul 31 '15 at 20:47
  • I'm not entirely well versed with Docker, so correct me if I'm wrong. From what I have read, its like mounting an Ubuntu OS VM. So, if I want to achieve my mentioned goals, I would have to mount one of each Version, Arch, etc. & run scripts and cron jobs on each separately.. If this is the case, I would like to know if there are easier ways like the repo URLs I mentioned above in order to get the list of packages for all Versions, Arch at one fetch.. Aug 3 '15 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.