# RedHat Closed Network Patching

Red Hat systems operating in a closed network do not have direct internet access to download latest patches. To keep these systems up to date, an internet-connected server is used to download the latest vulnerability database and required patches, which are then transferred to the closed network server. This enables you to identify missing patches and deploy the required updates to Red Hat systems within the isolated network.

To manage patches for Red Hat systems in a closed network, you must set up two servers running the same product build version: one in an internet-connected network and the other in the closed network.

Follow the steps below to configure the servers and manage patches in the closed network:

## Set up the internet-connected server

Follow these steps to configure the internet-connected server:

- Enable Red Hat closed network support in Patch Internal Settings.
- Navigate to: **<hostname>/webclient#/uems/patch-mgmt/internal-settings**
- Specify the following key and payload values in Patch Internal Settings:
  - Key: RedhatSettings
  - Payload: {"param": "CNSupportServer", "option": true}

![Patch Internal Settings](https://manageengine.com/sites/meweb/images/desktop-central/help/patch-management/patchinternalsettings.png)

- Navigate to **Admin -> Agent Settings -> Linux Agent Settings**.
- Select the domain to group Linux computers and specify the credentials required to automate agent installation.
- Click **Save Changes**.

![Linux Agent Settings](https://manageengine.com/sites/meweb/images/desktop-central/help/patch-management/linuxagentsettings.png)

- Perform a vulnerability database sync by navigating to **Patch Mgmt -> Update Now**. This will take you to the **Update Vulnerability DB** and then click **Update Now**.

**Note:** A valid Red Hat agent must be installed for each applicable edition (Server/Workstation) on the internet-connected server.

After installing a valid agent, navigate to the **Red Hat Linux Settings** page and ensure that the remark "Certificate upload and validation process have been completed successfully." is displayed.

![Red Hat Linux Settings](https://www.manageengine.com/sites/meweb/images/desktop-central/help/patch-management/rhlsettings.png)

- Download the Linux package manager files by navigating to **Patch Mgmt -> Update Now -> Re-initiate Download**.

![Vulnerability DB Sync](https://manageengine.com/sites/meweb/images/desktop-central/help/patch-management/vuldbsync.png)

## Set up the closed network server

### Configure proxy settings

- Navigate to **Admin -> Patch Settings -> Proxy Settings**.
- Select **No connection to Internet**.
- Click **OK** to save the changes.

### Configure Linux Agent Settings

- Navigate to **Admin -> Agent Settings -> Linux Agent Settings**.
- Select the domain to group Linux computers and specify the credentials required to automate agent installation.
- Click **Save Changes**.

## Perform the vulnerability database sync

Follow these steps to transfer the vulnerability database from the internet-connected server to the closed network server:

- On the internet-connected server, navigate to **ManageEngine > <product name>_Server > updatedb** and copy the entire updatedb folder.
- On the closed network server, navigate to **ManageEngine > <product name>_Server > conf > CRSData** and paste the folder copied from the internet-connected server.
- After the vulnerability database is synchronized, perform a patch scan on the closed network server to identify the missing patches.

## Download and transfer the missing patches

After identifying the missing patches, follow these steps to download them using the internet-connected server and transfer them to the closed network server:

- On the closed network server, navigate to the **Missing Patches** view and click **Export Missing Patches**.
- Click **Export** to download the **downloadUrlJson.txt** file containing the details of the missing patches.
- Copy the downloaded **downloadUrlJson.txt** file from the closed network server to the internet-connected server.
- On the internet-connected server, navigate to **Download Patches -> Download Missing Patches** and upload the **downloadUrlJson.txt** file.
- The required patches will be downloaded to the internet-connected server. Navigate to the default **Store** location and copy the downloaded patch files.
- Transfer the copied patch files to the default **Store** location on the closed network server.
- On the closed network server, navigate to **Patches -> Downloaded Patches -> Update Downloaded Patches** and click **Yes**.
- The transferred patches will now be updated and displayed in the **Downloaded Patches** view.
- You can then deploy the required patches to the applicable computers in the closed network.