I'm doing a internship to setup a Linux patch management system. It's a IT infrastructure management company with focus on Microsoft systems. They currently have ~15 Linux servers to manage and variate from RHEL5 and 6, Centos 6, OEL5 and 6 to SLES 10 and 11. Most systems are geographically separated over different clients/custommers.
A few requirements:
- has to work over WAN behind a firewall/nat router (agent)
- a dashboard for update control (push updates, blacklist updates, alert when updates are available)
- support for RHEL5+6+derivatives, SLES10+11 and Ubuntu 12.04.
The commercial solutions only seem to support their own distributions (RHN Sattelite, SUSE Manager, Landscape)
I had a little test run with puppet and ansible. Ansible felt quite good but does not work behind nat/firewall because of it's agent-less design. Puppet seemed to be overcomplicated to get patch management working and the dashboard is lacking a good view.
Whenever i try to accomplish patch management with a CM system it does not feel right. It feels like working with the wrong tools.
What are your idea's/experiences about Linux patch management? Is their any solutions which does fit my needs?