Linux Patchmanagement automatisieren, ohne den Betrieb zu stoppen

# RHEL / Rocky / Alma
dnf check-update --refresh          # Exitcode 100 = Updates offen, 0 = nichts zu tun
dnf updateinfo list --security
dnf needs-restarting -r             # Exitcode 1 = Neustart nötig

# Debian / Ubuntu
sudo apt-get update -qq
apt-get -s dist-upgrade | grep -c '^Inst'
[ -f /var/run/reboot-required ] && cat /var/run/reboot-required.pkgs

[commands]
upgrade_type = default
random_sleep = 3600
download_updates = yes
apply_updates = yes
reboot = never

[emitters]
emit_via = stdio

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer
sudo systemctl edit dnf-automatic.timer
# [Timer]
# OnCalendar=
# OnCalendar=Tue,Thu 02:30
# RandomizedDelaySec=1800

journalctl -u dnf-automatic.service -n 50 --no-pager

Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
};
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

// /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

all:
  children:
    ring1_kanarien:
      hosts:
        web01.example.internal:
    ring2_test:
      hosts:
        web02.example.internal:
        app01.example.internal:
    ring3_produktion:
      hosts:
        web03.example.internal:
        db01.example.internal:

---
- name: Patchlauf
  hosts: "{{ ziel_ring }}"
  become: true
  serial: "25%"
  max_fail_percentage: 0

  tasks:
    - name: Paketstand vorher sichern
      ansible.builtin.shell:
        cmd: set -o pipefail && rpm -qa | sort > /var/log/pakete-vorher.txt
      changed_when: false
      when: ansible_facts['os_family'] == 'RedHat'

    - name: Updates einspielen (RedHat)
      ansible.builtin.dnf:
        name: '*'
        state: latest
        security: true
      when: ansible_facts['os_family'] == 'RedHat'

    - name: Updates einspielen (Debian)
      ansible.builtin.apt:
        upgrade: dist
        update_cache: true
        cache_valid_time: 3600
      when: ansible_facts['os_family'] == 'Debian'

ansible-playbook patch.yml -e ziel_ring=ring1_kanarien --check --diff
ansible-playbook patch.yml -e ziel_ring=ring1_kanarien

# Erst nach der Freigabe und einer beobachteten Nacht:
ansible-playbook patch.yml -e ziel_ring=ring2_test
ansible-playbook patch.yml -e ziel_ring=ring3_produktion

- name: Neustartbedarf ermitteln (RedHat)
  ansible.builtin.command: dnf needs-restarting -r
  register: nr
  changed_when: false
  failed_when: nr.rc not in [0, 1]
  when: ansible_facts['os_family'] == 'RedHat'

- name: Neustartmarker prüfen (Debian)
  ansible.builtin.stat:
    path: /var/run/reboot-required
  register: rr
  when: ansible_facts['os_family'] == 'Debian'

- name: Neustart im Wartungsfenster
  ansible.builtin.reboot:
    reboot_timeout: 900
    post_reboot_delay: 30
    msg: "Neustart nach Patchlauf"
  when: (nr.rc | default(0)) == 1 or (rr.stat.exists | default(false))

# RHEL-Familie: Transaktionen sind nachvollziehbar und umkehrbar
dnf history list | head
dnf history info 42
sudo dnf history undo 42

# Einzelnes Paket bewusst festhalten
sudo dnf install -y python3-dnf-plugin-versionlock
sudo dnf versionlock add postgresql-server
dnf versionlock list

# Debian / Ubuntu
sudo apt-mark hold postgresql-16
apt-mark showhold

# LVM
sudo lvcreate -s -L 5G -n root_vor_patch /dev/vgsystem/root
sudo lvconvert --merge /dev/vgsystem/root_vor_patch   # wirkt beim nächsten Neustart
sudo lvremove /dev/vgsystem/root_vor_patch            # nach erfolgreichem Lauf

# Btrfs mit snapper
sudo snapper -c root create --description "vor Patchlauf"
sudo snapper -c root list

#!/usr/bin/env bash
set -euo pipefail

OUT=/var/lib/node_exporter/textfile_collector/patch.prom
TMP="$OUT.tmp"

if command -v dnf >/dev/null; then
  OFFEN=$(dnf -q check-update 2>/dev/null | grep -c . || true)
else
  OFFEN=$(apt-get -s dist-upgrade 2>/dev/null | grep -c '^Inst' || true)
fi

printf 'offene_updates %s\n' "$OFFEN" > "$TMP"
mv "$TMP" "$OUT"