# PatchMon — Linux Patch Management and Automation Platform

> Automate patch management across Linux servers with vulnerability scanning, CIS benchmarks, and a web dashboard for tracking compliance.

## Install

Save in your project root:

# PatchMon — Linux Patch Management and Automation Platform

## Quick Use
```bash
# Install the PatchMon server
docker compose up -d
# Register a Linux host with the agent
curl -sL https://patchmon.example.com/install.sh | bash
```

## Introduction
PatchMon is an open-source platform for managing patches across fleets of Linux servers. It provides automated vulnerability scanning, CIS benchmark compliance checks, and a web dashboard that gives operations teams visibility into the patch status of every machine.

## What PatchMon Does
- Scans Linux hosts for available security and system updates via apt, yum, and dnf
- Runs CIS benchmark checks against server configurations
- Provides a centralized web dashboard showing patch compliance across all hosts
- Schedules automated patch deployment with approval workflows
- Generates compliance reports for security audits

## Architecture Overview
PatchMon is written in Go and uses a client-server architecture. A lightweight agent runs on each managed Linux host, reporting available updates and system state back to the central server. The server aggregates this data, runs compliance analysis, and exposes a web UI and API. Data is stored in a PostgreSQL database.

## Self-Hosting & Configuration
- Deploy the server with Docker Compose or a single Go binary
- Install the lightweight agent on each managed Linux host
- Configure scanning schedules via the web dashboard or API
- Set up approval rules for automatic versus manual patch deployment
- Integrate with notification systems (Slack, email) for patch alerts

## Key Features
- Multi-distro support covering Debian, Ubuntu, CentOS, RHEL, and derivatives
- CIS benchmark scanning for security hardening compliance
- Scheduled scans with configurable patch windows and maintenance policies
- Role-based access control for team-based patch approval workflows
- CVE scanning and tracking tied to available package updates

## Comparison with Similar Tools
- **Ansible** — general-purpose automation; PatchMon is purpose-built for patch visibility and compliance
- **Spacewalk/Foreman** — full lifecycle management; PatchMon is lighter and patch-focused
- **WSUS** — Windows-only patch management; PatchMon covers Linux distributions
- **Landscape** — Canonical's Ubuntu management tool; PatchMon is multi-distro and open-source
- **Puppet/Chef** — configuration management tools; PatchMon specializes in patch tracking and CIS benchmarks

## FAQ
**Q: Which Linux distributions are supported?**
A: Debian, Ubuntu, CentOS, RHEL, and their derivatives. Support for Alpine and SUSE is planned.

**Q: Can PatchMon apply patches automatically?**
A: Yes. You can configure automatic patching with approval rules, maintenance windows, and rollback policies.

**Q: Does it support air-gapped environments?**
A: The agent communicates with the PatchMon server, not directly with the internet. Mirror repositories can serve updates in air-gapped setups.

**Q: How lightweight is the agent?**
A: The agent is a single Go binary consuming minimal CPU and memory, designed to run without impact on production workloads.

## Sources
- https://github.com/PatchMon/PatchMon

---
Source: https://tokrepo.com/en/workflows/asset-5a4f0fe9
Author: AI Open Source