Patch Management

Know how Patch Management helps in deploying and managing the patches.

What is Patch Management?

A patch is a piece of software code applied after the software program is installed to rectify an issue within it. Generally, the software applications roll out several patches after their initial release and keep on releasing the versions to fix any vulnerabilities or bugs in an application. Patch management is the process of managing a network of endpoints by regularly distributing and applying the updates to software. These patches are often necessary to correct errors.

Benefits

For organizations owning multiple servers and endpoints, updating patches manually can be both time-consuming and challenging. It can also increase business risks if any critical vulnerability is left unforeseen. The following are the few reasons why Patch Management should be considered:

1. Security: It fixes vulnerabilities on software and applications that are susceptible to cyber-attacks, helping the organization reduce its security risk.
2. System Reliability: It ensures that software and applications are updated and run smoothly.
3. Feature and Functional Improvements: It can go beyond application fixes by providing updates in its feature or functionality.
4. Compliance: With the continuous rise in cyber-attacks, organizations require to maintain a certain level of compliance. Patch management is a necessary piece of adhering to compliance standards.

Working

The working of Patch Management depends on whether a patch is being applied to a stand-alone system or to a multiple endpoint network. While the system is in stand-alone mode, the OS and the applications, will periodically perform an automatic check to see if any patches are available. If found any, the patches will be downloaded and installed automatically.

In contrast to the above, in organizations with huge IT Infrastructure, checking for patches and deploying them on individual endpoint is a complicated and time-consuming process. In order to overcome this, the larger organizations undergo a centralized patch management rather than manually allowing each endpoint to download its own patches. Also, conducting centralized patching helps to conserve the Internet bandwidth. Instead of downloading individual patches across all the endpoints, the server can download, and distribute the patch to all the endpoints available on the network. This saves the bandwidth consumption.

For security purpose,

When patches (updates or fixes for software) are applied to Red Hat or CentOS systems, it's crucial to ensure the integrity and authenticity of these patches.

The process involves:

1. Downloading the Patch: The system downloads the patch file from the official source (e.g., Red Hat repositories).

2. Generating a Checksum: Once the patch file is downloaded on the motadata file server, the Motadata Serviceops application generates a checksum for the file using the SHA-256 algorithm.

   note

   SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that takes an input (or 'message') and returns a fixed-size, 256-bit hash value. It is widely used to ensure data integrity because even a small change in the input will produce a drastically different hash.

3. Checksum Comparison: Red Hat provides a checksum (hash value) for each patch file they release. This checksum is published alongside the patch file itself.

   The generated checksum of the downloaded patch file is compared with the checksum provided by Red Hat. If the checksums matches, it means the file is authentic and has not been tampered with or corrupted during the download process. If they do not match, it indicates a potential issue, such as corruption or tampering, and the patch should not be applied.

Motadata ServiceOps streamlines the process through a centralized patch management repository. This retrieves patches available through third-party application websites and distributes them to the endpoints on the organization's network.

Deployment Architectures

Motadata ServiceOps Patch Management supports the following deployment architectures:

1. Main Server hosted on Cloud and File Server on Premise
2. Main Server and File Server hosted on Premise
3. Main Server and File Server hosted on Cloud
4. Remote Office

a. Main Server hosted on Cloud and File Server on Premise

The architecture mainly consists of the following components:

1. Central Patch Repository
2. ServiceOps Main Server (Cloud)
3. File Server (On Premise)

As shown above, the Motadata Central Patch Repository checks the Internet repeatedly to draw latest patch information from the third-party application websites and stores it. The local patch database regularly updates itself by pulling the updated patch details from the central repository.

The ServiceOps Main server, located in the cloud, synchronizes with the central repository. It periodically downloads the updates and vulnerabilities available in the database.

The scan will automatically determine which updates are needed on each client system, taking into account the operating system, build version, application, and update dependencies. Resulting to this, the missing patch details along with the respective severity for individual endpoint will be identified and installed into the database.

The entire process of information gathering, patch analysis, and publishing the latest vulnerability database occurs periodically. The updated patches are available for access once the Central Patch Repository and the ServiceOps server both are synchronized. ServiceOps also supports manual sync for patch updates. Comprehensive views of Patch-wise Systems and System-wise patches with installation status can be viewed on the ServiceOps portal.

After the missing and installed patches are listed, an approval is needed for updating the missing patches into the system. Approved patches are then downloaded from the third-party website on File Server and stored. These patches are then pushed on to the targeted systems for installation as per the deployment policy. Installed patches and service packs are verified and deployed on the systems. These can effectively generate reports for the purpose of monitoring and security compliance.

b. Main Server and File Server hosted on Premise

The architecture mainly consists of the following components:

1. Central Patch Repository
2. ServiceOps Main Server (On Premise)
3. File Server (On Premise)

As shown above, the Motadata Central Patch Repository checks the Internet repeatedly to draw latest patch information from the third-party application websites and stores it. The local patch database regularly updates itself by pulling the updated patch details from the central repository.

The ServiceOps Main server synchronizes with the central repository. It periodically downloads the updates and vulnerabilities available in the database.

The scan will automatically determine which updates are needed on each client system, taking into account the operating system, build version, application, and update dependencies. Resulting to this, the missing patch details along with the respective severity for individual endpoint will be identified and installed into the database.

The entire process of information gathering, patch analysis, and publishing the latest vulnerability database occurs periodically. The updated patches are available for access once the Central Patch Repository and the ServiceOps server both are synchronized. ServiceOps also supports manual sync for patch updates. Comprehensive views of Patch-wise Systems and System-wise patches with installation status can be viewed on the ServiceOps portal.

After the missing and installed patches are listed, an approval is needed for updating the missing patches into the system. Approved patches are then downloaded from the third-party website on File Server and stored. These patches are then pushed on to the targeted systems for installation as per the deployment policy. Installed patches and service packs are verified and deployed on the systems. These can effectively generate reports for the purpose of monitoring and security compliance.

c. Main Server and File Server hosted on Cloud

The architecture mainly consists of the following components:

1. Central Patch Repository
2. ServiceOps Main Server (Cloud)
3. File Server (Cloud)

As shown above, the Motadata Central Patch Repository checks the Internet repeatedly to draw latest patch information from the third-party application websites and stores it. The local patch database regularly updates itself by pulling the updated patch information from the central repository.

The ServiceOps Main server, located in the cloud, synchronizes with the central repository. It periodically downloads the updates and vulnerabilities available in the database.

The scan will automatically determine which updates are needed on each client system, taking into account the operating system, build version, application, and update dependencies. Resulting to this, the missing patch details along with the respective severity for individual endpoint will be identified and installed into the database.

The entire process of information gathering, patch analysis, and publishing the latest vulnerability database occurs periodically. The updated patches are available for access once the Central Patch Repository and the ServiceOps Main server get synchronized. ServiceOps also supports manual sync for patch updates. Comprehensive views of Patch-wise Systems and System-wise patches with installation status can be viewed on the ServiceOps portal.

After the missing and installed patches are listed, an approval is needed for updating the missing patches into the system. Approved patches are then downloaded from the third-party website on the File Server and stored in the cloud. These patches are then pushed on to the targeted systems for installation as per the deployment policy. Installed patches and service packs are verified and deployed on the systems. These can effectively generate reports for the purpose of monitoring and security compliance.

d. Remote Office

In the Remote Office setup, the Distribution Server is installed as a component. It synchronizes the missing patch details from the ServiceOps server and downloads the missing patches. The downloaded patches are further distributed to the clients for patch deployment. On completion of the successful deployment, the status is updated to the server.

Prerequisites

Review the prerequisites below before configuring Patch Management. Requirements are grouped into platform components, storage, connectivity, and OS-specific conditions.

1. Platform Components

Component	Requirement
File Server	Stores downloaded patches and distributes them to managed endpoints. Refer to the File Server Installation Guide. The File Server is required when the Allow agent to download patch directly from internet option is disabled in the Agent Preference. If this option is enabled, agents download patches directly from the internet and a File Server is not required.
Agent	Agent must be installed on the end machine.
License	An active Patch Management subscription is required.

2. Storage

The File Server must have sufficient free disk space for the patch binaries you intend to download. The space required scales with the number of operating systems, the number of third-party applications enabled, and the retention period configured.

Include periodic disk space checks and cleanup of superseded patches in your maintenance schedule.

3. Connectivity

Patch metadata and patch binaries originate from the Motadata Central Patch Repository and from vendor or third-party sources. ServiceOps supports four connectivity models. Choose the one that matches your network policy.

Model	How patches reach ServiceOps	Use when
Direct Internet	The Main Server fetches the patch URLs from the Motadata Central Patch Repository.	Cloud or on-premises deployments where outbound Internet access is permitted.
Proxy / DMZ	Outbound traffic is routed through a configured proxy or DMZ server. Configure it from Admin > Patch Management. A proxy or DMZ server can also be assigned per Remote Office.	Supports environments with restricted Internet access.
Air Gap (Closed Network)	The Patch Management Utility runs on a separate Internet-connected machine. The patch database and binaries are transferred to the ServiceOps server using physical media.	Fully isolated networks. Refer to Patch Management for Air Gap Networks.
Air Gap: RHEL via Satellite	The RHEL Patch Management Utility exports Red Hat Satellite metadata and patch binaries for offline transfer to the ServiceOps server.	Isolated networks running Red Hat Satellite. Refer to RHEL Patch Management for Air Gap Networks.

Endpoints must be able to reach the File Server, or the Distribution Server assigned to their Remote Office. Endpoints do not require Internet access.

Network Access Requirements

For the Direct Internet and Proxy/DMZ models, the following must be reachable from the Main Server:

• https://patchcatalog.motadataserviceops.com/: the Motadata patch catalog.
• OS and third-party application source URLs.

For the complete and up-to-date allowlist, contact Motadata Support.

4. OS-Specific Requirements

Windows

• The Windows Update service must not be disabled on the target endpoints.
• Microsoft Office patching is supported only when Click-to-Run (C2R) is enabled. To verify, open Task Manager > Processes and look for OfficeClickToRun.exe. If it is not present, the installation may be MSI-based, which is not supported for patching.
• For Microsoft Office patching, the Main File Server must run on a Windows OS when the Allow agent to download patch directly from internet option is disabled in the Agent Preference page. If the option is enabled, patches are downloaded directly by the agent and a File Server is not required. DMZ and proxy servers are not supported.

Linux

Red Hat / CentOS

ServiceOps supports two methods to fetch Red Hat patches:

• Agent Nomination: Requires a valid Red Hat subscription on respective end machine, server, and workstation with Internet connectivity.
• Red Hat Satellite Server: Requires a valid Red Hat subscription on one server with relevant patches synced.

SUSE Enterprise Linux

• A valid SUSE subscription (Desktop or Server) is required. Obtain your Registration Code from SUSE Customer Center.
• The Registration Code must be entered under the Action column for the Desktop or Server subscription in ServiceOps before running patch scans.

macOS

• Patching must be performed using a root user or local administrator account.
• The patch management agent must be configured to run with elevated (root/admin) privileges on the target endpoint.
• For macOS OS upgrade deployments, the local administrator password must be entered within 15 minutes of deployment initiation, or the upgrade fails.

Third-Party Application Limitations

• Patches installed at custom path locations are not supported.
• Notepad++ patching is supported only for versions 8.5.6 and above. Installing or detecting versions lower than 8.5.6 may result in patching issues due to version formatting discrepancies.

Supported Devices

Windows Client OS	Windows Server OS	Linux Client OS
Windows 8 Windows 10 Windows 11	Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025	Ubuntu CentOS RedHat Mint openSUSE SUSE Debian Oracle Linux Rocky Linux Alma Linux Pardus

Supported Linux OS Version List:

Linux OS	Version
Ubuntu	v26.04 LTS v24.10 v24.04 LTS 23.04 (Lunar Lobster) 22.10 ( Kinetic ) (For All Desktop and Server versions) 22.04 ( Jammy ) (For All Desktop and Server versions) 21.04 (For All Desktop and Server versions) 20.04, 20.10 (For All Desktop and Server versions) 18.04 (For All Desktop and Server versions) 16.04 (For All Desktop and Server versions)
CentOS	10 Stream, 9 Stream, 9
RedHat	10, 9.6, 9.5, 9, 8, 7
Mint	21, 22, and its sub-versions
openSUSE	15.6
Debian	13, 12, 11
Oracle Linux	9, 8, 7
Alma Linux *	9.8, 10.2
Rocky Linux *	9.8, 10.2
SUSE	15.6, 15.7, 16 server 15.6 and 15.7 Desktop

Linux Patch Scan on Debian-Based Endpoints (v8.7.5)

After upgrading to v8.7.5, patch scans on Debian, Ubuntu, Linux Mint, or Pardus endpoints may fail with the reason APT engine is corrupted. Run the APTEngineFix.sh script on the affected endpoint before re-running the scan.

See Linux Patch Scan Troubleshooting for the fix.

note

* Support for older versions of Alma Linux and Rocky Linux is discontinued upon the release of a newer version. Ensure your systems are updated to the latest supported version.

For version lifecycle details, refer to:

• Alma Linux end-of-life schedule
• Rocky Linux versioning terminology

note

To sync the Ubuntu and Mint OS Patches with the Central Repository, kindly upgrade the server to the latest ServiceOps v8.5.0. Backward compatibility is not supported.

Supported Client macOS Upgrade Version List:

mac OS Version Number	Version Name
26	Tahoe
15.x	Sequoia
10.15	Catalina
10.16	Big Sur
12	Monterey
13	Ventura
14	Sonoma

Supported Windows Third-Party Patch Applications:

View the applications

Application	Remarks
Hugin	Panorama photo stitcher.
Accessibility Insights for Windows	Helps developers find and fix accessibility issues.
Colour Contrast Analyser	Tool for checking color contrast.
Double Commander	Cross-platform open source file manager.
FrostWire	Free and open source BitTorrent client.
CrystalDiskInfo	HDD/SSD utility.
Hale Studio	Open-source data transformation tool.
CellProfiler	Open-source software for quantitative analysis of biological images.
GanttProject	Free project scheduling and management tool.
Cloudflared	Cloudflare Daemon for Argo Tunnel.
FontBase	Cross-platform font manager.
UltraViewer	Remote desktop support software.
Visual Studio Code	Popular code editor.
GIMP	Image manipulation program.
Fiddler Everywhere	Web debugging proxy.
Opera	Web browser.
DBeaver	Universal database tool.
Gpg4win	Encryption software for files and emails.
DAX Studio	Tool for working with DAX queries.
CMake	Cross-platform build system generator.
grepWin	Powerful search tool for Windows.
Graphviz	Graph visualization software.
GitHub CLI	Command line interface for GitHub.
Sejda PDF Desktop	PDF editor.
Archi	ArchiMate modelling tool.
Cyberduck	FTP, SFTP, WebDAV, Amazon S3, OpenStack Swift, Backblaze B2, Microsoft Azure & Google Drive browser.
HeidiSQL	Free client for MySQL, MariaDB, PostgreSQL, MS SQL, SQLite, and InterBase/Firebird.
DB Browser for SQLite	Visual tool to create, design, and edit SQLite database files.
Geany	Lightweight IDE.
Cherrytree	Hierarchical note-taking application.
Draw.io	Diagramming software.
GlobalProtect	VPN client.
Graylog Sidecar	Collector for Graylog.
GLPI Agent	Inventory agent for GLPI.
Audacity	Audio editor.
Bambu Studio	Slicer software for Bambu Lab 3D printers.
HandBrake	Video transcoder.
Darktable	Photography workflow application and raw developer.
Google Chrome	Supported on Windows & Windows Server v2019/2022. Widely used browser, regular updates.
Mozilla Firefox	Open-source browser.
WinSCP	Secure file transfer client.
Adobe Acrobat Reader	For PDF viewing and editing.
Adobe Acrobat DC	For PDF viewing and editing.
Adobe Acrobat Reader DC MUI	For PDF viewing and editing.
Docker Desktop	Virtualization software for containerized applications.
WinRAR	Supported on 64-bit machines only. Popular compression tool.
7-Zip	Free and open-source compression software.
Microsoft Office	Essential productivity suite. This also consists of Office LTSC Standard 2024 patches.
LibreOffice	Free and open-source office suite.
Notepad++	Lightweight source code editor. Supports various programming languages.
Node.js	JavaScript runtime environment.
VLC Media Player	Open-source multimedia player. Supports a wide range of audio and video formats.
Wireshark	Network protocol analyzer.
Zoom	Video conferencing tool for meetings, webinars, and collaboration.
Git for Windows	Version control system for developers.
PuTTY	Lightweight SSH and telnet client for remote access and management.
PeaZip	Free compression utility. Supports over 150 archive formats.
Thunderbird	Open-source email client with calendar and chat integration.
OBS Studio	Free and open-source software for video recording and live streaming.
OpenVPN	Secure VPN client for private and encrypted internet connections.
Slack	Messaging app for teams. Enables real-time collaboration and file sharing.
Brave Browser	Privacy-focused browser with built-in ad and tracker blocking.
Chocolatey GUI	Graphical interface for Chocolatey. Simplifies Windows package management.
TightVNC	Remote desktop control software. Lightweight and easy to use.
TortoiseSVN	A Subversion client for Windows.
NCPA	Nagios Cross-Platform Agent for system monitoring.
AnyBurn	Lightweight disc burning and image file processing software.
Delinea Connection Manager	Secure remote desktop connection manager for privileged access.
DisplayCAL	Open-source display calibration and profiling software.
Doxygen	Documentation generation tool for annotated source code.
Bandicut	Fast video cutter and splitter.
Bandicam	Screen recorder and video capture software.
Banyan	Zero trust network access platform.
Bitfocus Companion	Control software for Stream Deck and compatible controllers.
CatDV Pro	Media asset management software (Pro edition).
CatDV Server	Media asset management server component.
CatDV Worker	Media asset management worker node.
Communicator	Supported via .EXE installer only.
Crypt-o	Supported via MSI installer only. Encrypted password and data manager.
Go Programming Language	Open-source programming language by Google.
Hamachi	Virtual private networking tool by LogMeIn.
HomeBank	Free personal finance and accounting software.
Icinga 2	Open-source IT infrastructure monitoring system.
IdeaMaker	3D printing slicer software by Raise3D.
Ocenaudio	Supported via .EXE installer only. Cross-platform audio editor.

Not Supported Windows Patch Categories:

• Drivers Patches
• BIOS Patches

Supported Patch Categories:

Tools	Feature Packs	Service Packs
Update Rollups	Definition Updates (Antivirus Definition Updates)	Critical Updates
Updates	Hotfix	Security Updates

The steps required to be carried out in the ServiceOps portal for Windows and Linux Patch Management would be the same. The user just needs to change the OS specific field and related application as shown in the Automatic Patch Test and Automatic Patch Deployment.