How-To: Use Ansible to Find Linux Boxes That Are Behind on Security Updates

With 470-CVE months becoming normal, I want one command that tells me which servers are behind. Here’s the shape of my Ansible check, with no inventory details.

1. Group by family: put Debian/Ubuntu and RHEL-family hosts in separate inventory groups.
2. Debian/Ubuntu: run apt list --upgradable with the command module (changed_when: false) and register the output.
3. RHEL family: run dnf -q updateinfo list --security the same way.
4. Reboot check: look for /var/run/reboot-required with the stat module, or needs-restarting -r on dnf systems.
5. Report: use debug or a template to print host, pending count and reboot status in one table.
6. Then patch: a separate playbook with serial: 1 applies updates and reboots one host at a time.

Keep the check read-only so it’s safe to run any time. Patch on purpose, not by accident.

God Bless, and May the Source Be with You!

References & Further Reading

• Azure Linux 3.0.2022 ships with more than 470 security fixes (Phoronix)
• AlmaLinux shows advantages of ABI compatibility (Slashdot)