Please enable JavaScript.
Coggle requires JavaScript to display documents.
Not Usefull Enterprise Linux Centralized Patch Management using Ansible…
Not Usefull Enterprise Linux Centralized Patch Management using Ansible (Ubuntu + VMware)
Overview
Purpose
Centralize operating system patching
Reduce manual administration
Maintain security compliance
Automate updates
Reduce downtime
Generate patch reports
Standardize Linux server management
Benefits
Central management
Automated patch deployment
Compliance
Faster vulnerability remediation
Consistent server configuration
Easy rollback planning
Scheduling
Reporting
Scalability
Enterprise Architecture
VMware Infrastructure
ESXi Hosts
vCenter Server
Ubuntu Server VMs
Snapshot before patching
Clone templates
Resource Pools
Datastores
VM Networks
Management Server
Ubuntu Server LTS
Static IP
Ansible Installed
SSH Keys Configured
Git Installed
Cron Jobs
Email Notifications
Logging Enabled
Managed Nodes
Ubuntu Servers
Web Servers
Database Servers
Application Servers
Monitoring Servers
DNS Servers
Bastion Hosts
Network
Management VLAN
Production VLAN
Firewall Rules
DNS Resolution
NTP Synchronization
Internet Repository
Local Repository (Optional)
Hardware Requirements
CPU
4-8 vCPU
RAM
8-16 GB
Storage
100 GB+
Network
Gigabit
Software Requirements
Ubuntu Server LTS
OpenSSH
Python3
Ansible
Git
rsync
apt
cron
mailutils
unzip
Install Management Server
Update System
sudo apt update
sudo apt upgrade -y
Install Ansible
sudo apt install ansible -y
Verify
ansible --version
Install Git
sudo apt install git -y
Install SSH
sudo apt install openssh-server
Enable SSH
sudo systemctl enable ssh
sudo systemctl start ssh
SSH Authentication
Generate SSH Key
ssh-keygen
Copy Key
ssh-copy-id
user@server
Verify
ssh
user@server
Benefits
Passwordless login
Automation
Better security
Inventory Management
Inventory File
/etc/ansible/hosts
Groups
Production
Web Servers
Database Servers
Application Servers
Development
Testing
DMZ
Example
[web]
web01
web02
[db]
db01
db02
[all_linux:children]
web
db
Verify
ansible all -m ping
Ansible Configuration
File
/etc/ansible/ansible.cfg
Configure
inventory
remote_user
host_key_checking=False
forks
timeout
log_path
retry_files_enabled=False
Patch Workflow
Step 1
Check connectivity
Step 2
Collect facts
Step 3
Check disk space
Step 4
Verify repository
Step 5
Backup configuration
Step 6
VMware Snapshot
Step 7
Update package cache
Step 8
Upgrade packages
Step 9
Remove obsolete packages
Step 10
Reboot if required
Step 11
Validate services
Step 12
Generate report
Playbook Structure
inventory
ansible.cfg
playbooks
patch.yml
reboot.yml
rollback.yml
verify.yml
roles
common
patch
reboot
verify
group_vars
host_vars
templates
logs
Basic Commands
Test Connectivity
ansible all -m ping
Gather Facts
ansible all -m setup
Check Uptime
ansible all -a uptime
Check OS
ansible all -a "cat /etc/os-release"
Update Cache
ansible all -m apt -a "update_cache=yes"
Upgrade Packages
ansible all -m apt -a "upgrade=dist"
Reboot
ansible all -m reboot
Check Services
ansible all -a "systemctl status ssh"
Enterprise Patch Playbook Logic
Gather Facts
Verify Internet
Verify Disk Space
Verify Package Repository
Create Backup
VMware Snapshot
Update apt Cache
Install Security Updates
Install Bug Fixes
Upgrade Packages
Autoremove
Clean Cache
Check Reboot Required
Reboot
Wait for SSH
Validate Services
Send Report
Scheduling
Cron
Daily
Weekly
Monthly
AWX
Scheduled Jobs
Reporting
Save Logs
Email Report
Success Report
Failure Report
Patch Summary
Server Status
Reboot Status
Monitoring
Check SSH
Check CPU
Check Memory
Check Disk
Check Services
Verify Application
Verify Database
Verify Web Server
Rollback Strategy
VMware Snapshot Restore
Configuration Backup
Package Downgrade
Restore Service Configuration
Verify Server
Security
SSH Keys Only
Disable Password Authentication
Least Privilege
Sudo Access
Vault for Secrets
Firewall
Logging
Audit
Best Practices
Patch Development First
Patch Test Environment
Patch Production Last
Maintenance Window
Notify Users
Snapshot Before Patch
Backup Important Data
Validate Applications
Monitor After Patch
Keep Playbooks in Git
Document Changes
Common Problems
SSH Failure
Check SSH
Firewall
Keys
Repository Failure
apt update
DNS
Internet
Disk Full
df -h
Clean Cache
Package Lock
Remove Lock File
Python Missing
Install Python3
Reboot Failure
Wait for SSH
Verify Boot
Enterprise Workflow
Administrator
Create Playbook
Commit to Git
Review
Approve
Test Environment
Connectivity Test
Patch
Validation
Production
Snapshot
Patch
Reboot
Health Check
Reporting
High Availability
Multiple Ansible Control Nodes
Git Repository
Backup Inventory
Backup Playbooks
Configuration Backup
Interview Questions
What is centralized patch management?
Why use Ansible?
Why passwordless SSH?
Difference between apt upgrade and dist-upgrade?
What is idempotency?
What is an inventory?
Difference between static and dynamic inventory?
What are playbooks?
What are roles?
What are handlers?
What are facts?
What is Ansible Vault?
How do you reboot only when required?
How do you patch 1000 servers safely?
How do you roll back a failed patch?
How do you schedule patching?
How do you secure Ansible?
Why use VMware snapshots before patching?
How do you validate application health after reboot?
Enterprise Folder Structure
/opt/ansible
inventories
production
testing
development
playbooks
roles
group_vars
host_vars
templates
files
scripts
logs
reports
backups
collections
requirements.yml
ansible.cfg
README.md
Enterprise Patch Lifecycle
Asset Discovery
Inventory Management
Vulnerability Assessment
Patch Approval
Snapshot Creation
Backup
Patch Deployment
Reboot Management
Service Validation
Application Testing
Compliance Verification
Reporting
Documentation
Continuous Improvement
Enterprise Centralized Linux Patch Management (VMware + Ubuntu + Ansible)
Overview
Purpose
Centralized Linux patch management
Automate security updates
Reduce manual administration
Standardize patch deployment
Improve compliance
Minimize downtime
Enterprise Benefits
Centralized management
Consistent configuration
Faster patch deployment
Audit trail
Rollback capability
Scheduled maintenance
Compliance reporting
Enterprise Architecture
VMware Infrastructure
ESXi Host 1
Ubuntu Ansible Controller VM
Ubuntu Apt Mirror VM
Ubuntu Monitoring VM
ESXi Host 2
Production Servers
Web Servers
Application Servers
Database Servers
File Servers
ESXi Host 3
Development Servers
QA Servers
Staging Servers
Shared Storage
Datastore
ISO Repository
VM Snapshots
VMware Network
Management VLAN
Production VLAN
DMZ VLAN
Backup VLAN
Main Components
Ansible Controller
Purpose
Central automation server
Packages
ansible
git
openssh-server
python3
Responsibilities
Inventory Management
Playbooks
Roles
Automation
Reporting
Logging
Managed Nodes
Ubuntu Servers
Debian Servers
RHEL Servers
Rocky Linux
AlmaLinux
SSH
Passwordless Authentication
SSH Keys
Port 22
Secure Communication
Inventory
Hosts
Groups
Variables
Host Variables
Group Variables
Playbooks
Patch Deployment
Reboot
Health Check
Cleanup
Reporting
Roles
Common
Patch
Reboot
Monitoring
Security
Logging
Syslog
Ansible Logs
Audit Logs
Enterprise Server Layout
ansible-controller
192.168.10.10
apt-mirror
192.168.10.20
monitoring
192.168.10.30
web01
192.168.20.11
web02
192.168.20.12
app01
192.168.20.21
app02
192.168.20.22
db01
192.168.20.31
backup01
192.168.20.40
Hardware Requirements
Controller
4 vCPU
8 GB RAM
100 GB SSD
Managed Servers
2 vCPU
4 GB RAM
40 GB SSD
Apt Mirror
4 vCPU
8 GB RAM
500 GB Storage
Installation
Ubuntu Installation
Install Ubuntu Server
Configure Static IP
Configure Hostname
Update System
Commands
sudo apt update
sudo apt upgrade -y
sudo hostnamectl set-hostname ansible-controller
ip addr
hostnamectl
Install Ansible
Commands
sudo apt install software-properties-common -y
sudo add-apt-repository universe
sudo apt update
sudo apt install ansible -y
ansible --version
Install Required Packages
sudo apt install git -y
sudo apt install sshpass -y
sudo apt install python3-pip -y
sudo apt install vim -y
sudo apt install curl -y
Directory Structure
/etc/ansible/
ansible.cfg
inventory/
playbooks/
roles/
group_vars/
host_vars/
files/
templates/
logs/
Configure Inventory
/etc/ansible/hosts
[web]
web01
web02
[application]
app01
app02
[database]
db01
[production]
web01
web02
app01
app02
db01
SSH Configuration
Generate SSH Key
ssh-keygen
Copy Key
ssh-copy-id
user@server
Verify
ssh
user@server
Test Connectivity
Ping
ansible all -m ping
Gather Facts
ansible all -m setup
Uptime
ansible all -a uptime
Disk
ansible all -a "df -h"
Patch Management Workflow
Step 1
Inventory Validation
Step 2
Connectivity Check
Step 3
Gather Facts
Step 4
Update Package Cache
Step 5
Download Packages
Step 6
Install Updates
Step 7
Check Reboot Required
Step 8
Reboot if Needed
Step 9
Wait for Server
Step 10
Verify Services
Step 11
Generate Report
Ansible Modules
apt
package
reboot
ping
setup
command
shell
service
copy
template
lineinfile
file
stat
wait_for
fetch
cron
Important Commands
ansible all -m ping
ansible all -m setup
ansible-playbook patch.yml
ansible-playbook reboot.yml
ansible-playbook healthcheck.yml
ansible-inventory --list
ansible-config dump
ansible-galaxy init patch
Sample Patch Tasks
Update Cache
apt
update_cache=yes
Upgrade Packages
apt
upgrade=dist
Autoremove
apt
autoremove=yes
Autoclean
apt
autoclean=yes
Reboot
reboot
Wait
wait_for_connection
Enterprise Patch Strategy
Development
Weekly
QA
Weekly
Staging
Before Production
Production
Monthly Maintenance Window
Emergency
Critical CVEs Immediately
Maintenance Window
Notify Users
Backup
VMware Snapshot
Patch
Reboot
Health Check
Verify Applications
Remove Snapshot
Health Checks
CPU
RAM
Disk
Network
SSH
Systemctl
Services
Application URL
Rollback
VMware Snapshot Restore
Package Rollback
Restore Backup
Verify Services
Security
SSH Keys
Disable Root Login
Sudo Users
Firewall
Fail2ban
Audit Logs
Least Privilege
Vault Encryption
Monitoring
Wazuh
Elastic Stack
Grafana
Prometheus
Zabbix
Email Alerts
Logging
/var/log/ansible.log
syslog
journalctl
Audit Reports
Scheduling
Cron
AWX
Ansible Automation Platform
Best Practices
Test in Development
Test in QA
Snapshot Before Patch
Backup Before Patch
Use Roles
Use Git
Use Vault
Separate Inventories
Tag Playbooks
Verify Health
Keep Reports
Enterprise Interview Questions
What is centralized patch management?
Why use Ansible?
Agentless vs Agent-based?
Why SSH keys?
What is inventory?
Difference between playbook and role?
What are handlers?
What is idempotency?
What is Ansible Vault?
What is dynamic inventory?
What is apt module?
What is reboot module?
How do you patch without downtime?
What is rolling update?
Why maintenance window?
Why VMware snapshots?
How do you rollback failed patches?
How do you secure Ansible?
Difference between apt upgrade and dist-upgrade?
How do you patch 1000 Linux servers?
Enterprise Best Practice Architecture
Users
SSH
Bastion Host
Optional
Ansible Controller
Inventory
Playbooks
Roles
Vault
Git
Apt Repository
Local Mirror
Internet Sync
Production Servers
Web
App
Database
File
Monitoring
Wazuh
Elastic
Grafana
Backup
VMware Snapshots
Backup Server
Reports
Email
HTML
CSV