IT Solutions Technology Blog

PatchMon – provides centralized patch management across diverse server environments and agents communicate outbound only to the PatchMon server eliminating inbound ports on monitored hosts while delivering comprehensive visibility and safe automation ans supports a wide range of Linux versions including Ubuntu Debian CentOS RHEL and Fedora

Install Script

root@pve-PatchMon-01:~# curl -fsSL -o setup.sh https://raw.githubusercontent.com/PatchMon/PatchMon/refs/heads/main/setup.sh && chmod +x setup.sh && bash setup.sh

PatchMon instance deployed successfully!

Next steps:
• Visit your URL: http://pve-patchmon-01.fritz.box (ensure DNS is configured)
• Deployment information file: /opt/pve-patchmon-01.fritz.box/deployment-info.txt
• View deployment info: cat /opt/pve-patchmon-01.fritz.box/deployment-info.txt

root@pve-PatchMon-01:~#

Update Script (–update flag)

root@pve-PatchMon-01:~# curl -fsSL -o setup.sh https://raw.githubusercontent.com/PatchMon/PatchMon/refs/heads/main/setup.sh && chmod +x setup.sh && bash setup.sh –update
…
Service pve-patchmon-01.fritz.box is running
Updated to version: 1.3.6

Backup Information:
Code backup: /opt/pve-patchmon-01.fritz.box.backup.20251202_165823/code
Database backup: /opt/pve-patchmon-01.fritz.box.backup.20251202_165823/database_backup_20251202_165823.sql

To restore database if needed:
PGPASSWORD=“<password>“ pg_restore -h „localhost“ -U „pve_patchmon_01_fritz_box“ -d „pve_patchmon_01_fritz_box“ -c „/opt/pve-patchmon-01.fritz.box.backup.20251202_165823/database_backup_20251202_165823.sql“

root@pve-PatchMon-01:~#

root@pve-PatchMon-01:~#

root@rpi-patchmon-client-01:~# apt-get update && apt-get install unattended-upgrades
Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Hit:4 http://archive.raspberrypi.com/debian trixie InRelease
60 packages can be upgraded. Run ‚apt list –upgradable‘ to see them.
Installing:
unattended-upgrades

Installing dependencies:
python3-distro-info

Suggested packages:
bsd-mailx default-mta | mail-transport-agent needrestart powermgmt-base

Summary:
Upgrading: 0, Installing: 2, Removing: 0, Not Upgrading: 60
Download size: 74.6 kB
Space needed: 368 kB / 22.3 GB available

Continue? [Y/n] y
Get:1 http://deb.debian.org/debian trixie/main arm64 python3-distro-info all 1.13 [7,736 B]
Get:2 http://deb.debian.org/debian trixie/main arm64 unattended-upgrades all 2.12 [66.9 kB]
Fetched 74.6 kB in 1s (77.3 kB/s)
Preconfiguring packages …
Selecting previously unselected package python3-distro-info.
(Reading database … 120727 files and directories currently installed.)
Preparing to unpack …/python3-distro-info_1.13_all.deb …
Unpacking python3-distro-info (1.13) …
Selecting previously unselected package unattended-upgrades.
Preparing to unpack …/unattended-upgrades_2.12_all.deb …
Unpacking unattended-upgrades (2.12) …
Setting up python3-distro-info (1.13) …
Setting up unattended-upgrades (2.12) …
Creating config file /etc/apt/apt.conf.d/20auto-upgrades with new version
Creating config file /etc/apt/apt.conf.d/50unattended-upgrades with new version
Created symlink ‚/etc/systemd/system/multi-user.target.wants/unattended-upgrades.service‘ → ‚/usr/lib/systemd/system/unattended-upgrades.service‘.
Synchronizing state of unattended-upgrades.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable unattended-upgrades
Processing triggers for man-db (2.13.1-1) …

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# dpkg-reconfigure unattended-upgrades

root@rpi-patchmon-client-01:~# systemctl status unattended-upgrades
● unattended-upgrades.service – Unattended Upgrades Shutdown
Loaded: loaded (/usr/lib/systemd/system/unattended-upgrades.service; enabled; preset: enabled)
Active: active (running) since Wed 2025-12-03 18:14:42 CET; 3min 20s ago
Invocation: 0b9ddb99f3c146fe8425e8faeb056b6a
Docs: man:unattended-upgrade(8)
Main PID: 7310 (unattended-upgr)
Tasks: 2 (limit: 3913)
CPU: 376ms
CGroup: /system.slice/unattended-upgrades.service
└─7310 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown –wait-for-signal

Dec 03 18:14:42 rpi-patchmon-client-01 systemd[1]: Started unattended-upgrades.service – Unattended Upgrades Shutdown.

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# vi /etc/apt/apt.conf.d/50unattended-upgrades
…
// Within lines unattended-upgrades allows 2 macros whose values are
// derived from /etc/debian_version:
// ${distro_id} Installed origin.
// ${distro_codename} Installed codename (eg, „buster“)
Unattended-Upgrade::Origins-Pattern {
// Codename based matching:
// This will follow the migration of a release through different
// archives (e.g. from testing to stable and later oldstable).
// Software will be the latest available for the named release,
// but the Debian release itself will not be automatically upgraded.
„origin=Debian,codename=${distro_codename}-updates“;
// „origin=Debian,codename=${distro_codename}-proposed-updates“;
„origin=Debian,codename=${distro_codename},label=Debian“;
„origin=Debian,codename=${distro_codename},label=Debian-Security“;
„origin=Debian,codename=${distro_codename}-security,label=Debian-Security“;
// „o=Debian Backports,n=${distro_codename}-backports,l=Debian Backports“;
…
Unattended-Upgrade::Automatic-Reboot „true“;
Unattended-Upgrade::Automatic-Reboot-Time „04:00“;

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# vi /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists „1“;
APT::Periodic::Unattended-Upgrade „1“;
APT::Periodic::Download-Upgradeable-Packages „1“;
APT::Periodic::AutocleanInterval „1“;

root@rpi-patchmon-client-01:~# systemctl enable unattended-upgrades

root@rpi-patchmon-client-01:~# systemctl restart unattended-upgrades

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# cp /lib/systemd/system/apt-daily.timer /etc/systemd/system/
root@rpi-patchmon-client-01:~# vi /etc/systemd/system/apt-daily.timer
…
[Timer]
OnCalendar=*-*-* 03:00
RandomizedDelaySec=10m
Persistent=true
…

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# systemctl daemon-reload
root@rpi-patchmon-client-01:~# systemctl restart apt-daily.timer
root@rpi-patchmon-client-01:~# systemctl status apt-daily.timer
● apt-daily.timer – Daily apt download activities
Loaded: loaded (/etc/systemd/system/apt-daily.timer; enabled; preset: enabled)
Active: active (waiting) since Sat 2025-12-06 20:12:11 CET; 8min ago
Invocation: d34b95c8ca4b46ef9b39477dcb6e750a
Trigger: Sun 2025-12-07 03:00:05 CET; 6h left
Triggers: ● apt-daily.service

Dec 06 20:12:11 rpi-patchmon-client-01 systemd[1]: Started apt-daily.timer – Daily apt download activities.

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# cp /lib/systemd/system/apt-daily-upgade.timer /etc/systemd/system/
root@rpi-patchmon-client-01:~# vi /etc/systemd/system/apt-daily-upgade.timer
…
[Timer]
OnCalendar=*-*-* 3:30
RandomizedDelaySec=10m
Persistent=true
…

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# systemctl daemon-reload
root@rpi-patchmon-client-01:~# systemctl restart apt-daily-upgrade.timer
root@rpi-patchmon-client-01:~# systemctl status apt-daily-upgrade.timer
● apt-daily-upgrade.timer
Loaded: loaded (/etc/systemd/system/apt-daily-upgrade.timer; enabled; preset: enabled)
Active: active (waiting) since Sat 2025-12-06 20:14:12 CET; 10min ago
Invocation: 783c11ca079a4608bf103a0e82b8c6a4
Trigger: Sun 2025-12-07 03:34:14 CET; 7h left
Triggers: ● apt-daily-upgrade.service

Dec 06 20:14:12 rpi-patchmon-client-01 systemd[1]: Started apt-daily-upgrade.timer.

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# systemctl restart unattended-upgrades
root@rpi-patchmon-client-01:~# systemctl status unattended-upgrades
● unattended-upgrades.service – Unattended Upgrades Shutdown
Loaded: loaded (/usr/lib/systemd/system/unattended-upgrades.service; enabled; preset: enabled)
Active: active (running) since Sat 2025-12-06 20:32:41 CET; 10s ago
Invocation: 2442ca23f66d445aa8cbe46a6feb5970
Docs: man:unattended-upgrade(8)
Main PID: 15866 (unattended-upgr)
Tasks: 2 (limit: 3918)
CPU: 321ms
CGroup: /system.slice/unattended-upgrades.service
└─15866 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown –wait-for-signal

Dec 06 20:32:41 rpi-patchmon-client-01 systemd[1]: Started unattended-upgrades.service – Unattended Upgrades Shutdown.
root@rpi-patchmon-client-01:~#

To perform a dry run and see what actions would be taken run the commands

root@rpi-patchmon-client-01:~# unattended-upgrade -d
…
No packages found that can be upgraded unattended and no pending auto-removals
upgrade result: True No packages found that can be upgraded unattended and no pending auto-removals
Extracting content from /var/log/unattended-upgrades/unattended-upgrades-dpkg.log since 2025-12-04 13:51:05

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# journalctl –since yesterday -u apt-daily.service
— No entries —
root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# journalctl –since yesterday -u apt-daily-upgrade.service
Dec 07 03:39:25 rpi-patchmon-client-01 systemd[1]: Starting apt-daily-upgrade.service – Daily apt upgrade and clean activities…
Dec 07 03:39:33 rpi-patchmon-client-01 systemd[1]: apt-daily-upgrade.service: Deactivated successfully.
Dec 07 03:39:33 rpi-patchmon-client-01 systemd[1]: Finished apt-daily-upgrade.service – Daily apt upgrade and clean activities.
Dec 07 03:39:33 rpi-patchmon-client-01 systemd[1]: apt-daily-upgrade.service: Consumed 8.250s CPU time.

root@rpi-patchmon-client-01:~#

root@rpi-patchmon-client-01:~# unattended-upgrades -help
Usage: unattended-upgrades [options]

Options:
-h, –help show this help message and exit
-d, –debug print debug messages
–apt-debug make apt/libapt print verbose debug messages
-v, –verbose print info messages
–dry-run Simulation, download but do not install
–download-only Only download, do not even try to install.
–minimal-upgrade-steps
Upgrade in minimal steps (and allow interrupting with
SIGTERM) (default)
–no-minimal-upgrade-steps
Upgrade all packages together instead of in smaller
sets

root@rpi-patchmon-client-01:~# unattended-upgrades -v
Checking if system is running on battery is skipped. Please install powermgmt-base package to check power status and skip installing updates when the system is running on battery.
Starting unattended upgrades script
Allowed origins are: origin=Debian,codename=trixie-updates, origin=Debian,codename=trixie,label=Debian, origin=Debian,codename=trixie,label=Debian-Security, origin=Debian,codename=trixie-security,label=Debian-Security
Initial blacklist:
Initial whitelist (not strict):
No packages found that can be upgraded unattended and no pending auto-removals

root@rpi-patchmon-client-01:~#

AlmaLinux 10.1 – Release Notes