Skip to main content
PathMon
Platform: new in PatchMon 2.1.4

Univention Corporate Server
errata patching the UCS way.

PatchMon 2.1.4 adds Univention Corporate Server (UCS). Install the standard Linux agent and your UCS hosts appear with their release, patch level and errata level beside the rest of your fleet. Patch all runs Univention's own updater for the installed release, so release upgrades stay a deliberate decision in the Univention Management Console.

Read the UCS patching guide

How it works

Everything you need to know, at a glance.

Errata inventory from the host

UCS hosts show up as Univention Corporate Server with release, patch level and errata level, for example 5.2-7 errata606. Pending errata updates are read through apt, so the counts in PatchMon match what the host reports.

  • Standard Linux agent and install command: choose Linux in Add Host
  • Release, patch level and errata level on every host
  • Pending errata updates inventoried through apt
  • Tested on UCS 5.2-7 and 5.0-10 Primary Directory Nodes

Patch all through univention-upgrade

Patch all runs univention-upgrade --noninteractive --disable-app-updates, with --updateto pinned to the installed release. It installs every erratum for the release you are on and clears the updates available notice in the Univention Management Console (UMC).

  • Installs all errata for the installed release
  • Never starts a release upgrade, such as 5.0-10 to 5.1-0
  • Never updates App Center apps
  • Release upgrades and app updates stay a deliberate admin action in UMC

Patch selected, validated first

Choose individual packages and PatchMon upgrades only those, using apt-get --only-upgrade install. A dry run validates the selection before anything changes on the host.

  • Upgrade only the packages you choose
  • Dry run validation before the run
  • Patch history records the packages each run installed
  • Reboot required flagged when a new kernel is installed

Good to know

Domain join status was unchanged after patching in our testing. Univention ships fixes as errata rather than through a Debian-style security repository, so PatchMon cannot tell which UCS updates are security fixes.

  • Requires PatchMon server and agent 2.1.4 or later
  • UCS updates are not flagged as security updates
  • OpenSCAP CIS scans on UCS 5.2 use the Debian 12 content; UCS 5.0 has no current content
  • Same dashboards, alerts and reporting as the rest of your fleet

Ready to see it in action?

Start a free Cloud trial, or talk to us about Enterprise and MSP deployments.