RHEL 9 fleet tooling · over SSH

linux-patch

Staged dnf patching for a RHEL 9 fleet. Discover what is pending, apply with live re-validation, reboot on your terms.

$ git clone https://github.com/vikozs/linux-patch

lfp.kosir.info — example run

linux-patch discover -H hosts.txt -u sa.vko --ask-ssh-pass --sudo-pass-same-as-ssh
web01.zav-mb.loc         5 updates (4 security)  reboot-required
db01.zav-mb.loc          0 updates
app02.zav-mb.loc         FAILED: Connection timed out
Plan:   patch_plan.json
Report: patch_report.xlsx
Totals: 5 updates, 4 security, 1 need reboot

How it works

discover

collect pending updates + advisories

review

read the report, decide

apply

install, re-validated live

What it does

Security-aware

Every update is tagged with its advisory and severity, so you can patch security fixes first.

Never blind

apply re-runs dnf check-update and installs only what is still pending. A stale plan can't cause surprise installs.

Reboots on your terms

Report-only by default. --reboot is serialized: one host at a time, each verified back up before the next, so a bad kernel never drops the fleet.

Rollback

Undo a host's transaction with dnf history undo.

Output

A report you can hand to anyone

A formatted Excel workbook plus a machine-readable JSON plan. Sheets:

SummaryPending UpdatesSecurity AdvisoriesReboot RequiredErrorsAbout

Safety

GUARDED

Reboots are opt-in and serialized. apply re-validates against live state before installing anything.

The rest of the family

linux-auditlinux-patchlinux-certslinux-userslinux-driftlinux-firewalllinux-applylinux-diskspace