RedHat Closed Network Patching

Red Hat systems operating in a closed network do not have direct internet access to download latest patches. To keep these systems up to date, an internet-connected server is used to download the latest vulnerability database and required patches, which are then transferred to the closed network server. This enables you to identify missing patches and deploy the required updates to Red Hat systems within the isolated network.

To manage patches for Red Hat systems in a closed network, you must set up two servers running the same product build version: one in an internet-connected network and the other in the closed network.

Follow the steps below to configure the servers and manage patches in the closed network:

Set up the internet-connected server

Follow these steps to configure the internet-connected server:

• Enable Red Hat closed network support in Patch Internal Settings.
• Navigate to: <hostname>/webclient#/uems/patch-mgmt/internal-settings
• Specify the following key and payload values in Patch Internal Settings:
  Key: RedhatSettings
  Payload: {"param": "CNSupportServer", "option": true}

• Navigate to Admin -> Agent Settings -> Linux Agent Settings.
• Select the domain to group Linux computers and specify the credentials required to automate agent installation.
• Click Save Changes.

• Perform a vulnerability database sync by navigating to Patch Mgmt -> Update Now. This will take you to the Update Vulnerability DB and then click Update Now.

After installing a valid agent, navigate to the Red Hat Linux Settings page and ensure that the remark "Certificate upload and validation process have been completed successfully." is displayed.

• Download the Linux package manager files by navigating to Patch Mgmt -> Update Now -> Re-initiate Download.

Set up the closed network server

Perform the vulnerability database sync

Follow these steps to transfer the vulnerability database from the internet-connected server to the closed network server:

• On the internet-connected server, navigate to ManageEngine > <product name>_Server > updatedb and copy the entire updatedb folder.
• On the closed network server, navigate to ManageEngine > <product name>_Server > conf > CRSData and paste the folder copied from the internet-connected server.
• After the vulnerability database is synchronized, perform a patch scan on the closed network server to identify the missing patches.

Download and transfer the missing patches

After identifying the missing patches, follow these steps to download them using the internet-connected server and transfer them to the closed network server:

• On the closed network server, navigate to the Missing Patches view and click Export Missing Patches.
• Click Export to download the downloadUrlJson.txt file containing the details of the missing patches.
• Copy the downloaded downloadUrlJson.txt file from the closed network server to the internet-connected server.
• On the internet-connected server, navigate to Download Patches -> Download Missing Patches and upload the downloadUrlJson.txt file.
• The required patches will be downloaded to the internet-connected server. Navigate to the default Store location and copy the downloaded patch files.
• Transfer the copied patch files to the default Store location on the closed network server.
• On the closed network server, navigate to Patches -> Downloaded Patches -> Update Downloaded Patches and click Yes.
• The transferred patches will now be updated and displayed in the Downloaded Patches view.
• You can then deploy the required patches to the applicable computers in the closed network.