A Complete Guide to Easy Linux Patch Management

What is patch management?

Patch management is the process of distributing and applying updates to software, such as operating systems (OS), platforms, and applications. It involves identifying out-dated software within your infrastructure, applying patches to that software, and validating the installation of those patches. These patches are often necessary to fix errors in the software, which are often referred to as vulnerabilities or bugs. 

Why is patch management important?

Patch management is important for three main reasons:

• Security: Patch management fixes vulnerabilities in your software (OS, platform, application) that are susceptible to exploitation. It helps your organization to reduce the risk of cyberattacks.
• Compliance: Organizations are often required by regulators to follow strict guidelines because of the constant increase in cyberattacks. Patch management is a necessary part of complying to certain standards, such as PCI-DSS, HIPAA, SOC2, ISO27001, or BSI. 
• System uptime: Patch management ensures your software is kept up-to-date and running smoothly without errors causing system downtime.

Finding missing patches with Mondoo

As a part of its full-stack security solution, Mondoo identifies what important patches are missing from your systems. For this blog post, I set up some vagrant Linux machines with out-of-date operating systems. I’ll use them to walk through some different ways that Mondoo shows you the patches needed.  

config.vm.define "debian9" do |debian9|

  debian9.vm.box = "bento/debian-9"
 
  debian9.vm.network :private_network, ip: "192.168.56.237"

 end

config.vm.define "ubuntu2004" do |ub2004|

  ub2004.vm.box = "ubuntu/focal64"

  ub2004.vm.box_version = "20211021.0.0"

  ub2004.vm.network :private_network, ip: "192.168.56.251"

 end

config.vm.define "rhel8" do |rhel8|

  rhel8.vm.box = "generic/rhel8"

  rhel8.vm.box_version = "3.6.13"

  rhel8.vm.network :private_network, ip: "192.168.56.242"

 end

Prerequisite: Please create a free account on console.mondoo.com. 

Mondoo offers different options for scanning a Linux vagrant system:

Option 1: Install Mondoo Client on the Linux system

Option 2: Use vagrant transporter

Option 3: Use SSH transporter

Option 1: Find missing patches with Mondoo

1. Login to the vagrant Debian 9 system:

atomic111:..vagrant-test-boxen ∅> vagrant ssh debian9
Linux debian-9 4.9.0-17-amd64 #1 SMP Debian 4.9.290-1 (2021-12-12)
x86_64

This system is built by the Bento project by Chef Software
 
More information can be found at https://github.com/chef/bento

The programs included with the Debian GNU/Linux system are free 
software; the exact distribution terms for each program are 
described in the individual files in /usr/share/doc/*/copyright.

config.vm.define "ubuntu2004" do |ub2004|

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent 
permitted by applicable law.
vagrant@debian-9:~$ sudo -i
root@debian-9:~#

2. Install Mondoo Client:

A. Log into your account at console.mondoo.com

B. Go to the Integrations tab and select Ubuntu/Debian

C. Copy the CLI commands provided and paste them in the Debian 9 root shell.

D. After the Mondoo Client installation, type mondoo status to verify that Mondoo Client is registered and working. It should look like this:

root@debian-9:~# mondoo status
→ loaded configuration from /etc/opt/mondoo/mondoo.yml using source 
--config
→ Hostname:     debian-9
→ IP:           10.0.2.15
→ Platform:     debian
→ Release:      9.13
→ Time:         2022-07-01T08:38:09Z
→ Version:      6.4.0 (API Version: 6)
→ API ConnectionConfig: https://us.api.mondoo.com
→ API Status:   SERVING
→ API Time:     2022-07-01T08:38:09Z
→ API Version:  6
→ Space:        //captain.api.mondoo.app/spaces/keen-kowalevski-169528
→ Client:       //agents.api.mondoo.app/spaces/keen-kowalevski-169528/
agents/2BKpZTDtSZFz0xOpHxWGMo5afz1
→ Service Account:      //agents.api.mondoo.app/spaces/keen-kowalevski
-169528/serviceaccounts/2BKpZTQlGtWgoCHNyhjaPIa5PjG
→ client is registered
→ client authenticated successfully

E. Quickly verify that the following policies are enabled for your space:

• Platform End-of-Life Policy by Mondoo
• Platform Vulnerability Policy by Mondoo

Your Policy Hub should look like this:

To scan the vagrant debian 9 system, just type mondoo scan local. Mondoo Client connects to the Mondoo backend and downloads the enabled policies. After the scan, Mondoo Client reports results back to the Mondoo backend:

Now you can see the outdated packages on the machine and which package version you must install to fix the specific vulnerability. You can view results in the Mondoo Dashboard:

In the system overview, the Mondoo Dashboard highlights that the Debian 9 operating system is end-of-life. By default there is also a Linux Security Baseline enabled. Select Platform Vulnerabilities to see the vulnerable packages. Mondoo shows:

• Outdated packages
• CVEs that belong to the package
• Which package version you must install to fix the vulnerability
• How critical the vulnerability is 
• An overview of the advisories and CVEs

Option 2: Scan a Linux vagrant machine via vagrant transporter

Install and register Mondoo Client on your host system running the vagrant Debian 9 system and then run the following command: 

Scan other operating systems

You can also scan the Red Hat 8 and Ubuntu 20.04 systems I set up for this blog post. Use the installed Mondoo Client, ssh transporter, or vagrant transporter:

Scan via vagrant transporter: 

mondoo scan vagrant rhel8
mondoo scan vagrant ubuntu2004

Scan via ssh transporter:

mondoo scan ssh vagrant@192.168.56.242 -p 'vagrant' --sudo --insecure 
-i .vagrant/machines/rhel8/virtualbox/private_key

mondoo scan ssh vagrant@192.168.56.251 -p 'vagrant' --sudo --insecure 
-i .vagrant/machines/ubuntu2004/virtualbox/private_key

Don’t stop at scanning the machines I set up for this exercise! You can follow the same steps to scan your own infrastructure.

Mondoo’s full-stack security solution identifies vulnerabilities and provides steps to fix the problems. Keep scanning! If you have questions, we’d love to help you on Slack.