senn-techPatch Management Without SCCM: Updates in SME Daily Operations
Unpatched systems are the most common entry point for attackers; not zero-days, but known vulnerabilities from six months ago. NIS2 requires patch management as a mandatory measure. Here’s how we do it without significant licensing costs.
Linux VMs: unattended-upgrades
Ubuntu and Debian come with unattended-upgrades. Once enabled, it automatically pulls and installs security patches overnight.
apt install unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades
Important: This only applies to security updates from the official repositories; no major version jumps, no kernel panics on production systems. The configuration allows precise control over which package sources are automatically updated.
Proxmox Hosts
Proxmox includes its own update mechanism. Without a subscription (for non-production systems) or with a subscription (for serious operation). It’s not self-running; we set a monthly maintenance window on the first Sunday, 6:00–8:00 AM.
apt update && apt dist-upgrade
# Check if reboot is needed
[ -f /var/run/reboot-required ] && reboot
In an HA cluster, we update one host at a time. VMs migrate via live migration to the remaining nodes. The service continues running while patching occurs.
Docker Containers: The Underestimated Maintenance Task
Container images become outdated. Not the code, it still works, but the underlying base image accumulates CVEs. Docker updates replace the image entirely:
docker compose pull
docker compose up -d
No one automates this blindly. A Watchtower can do it, but we prefer manual triggering with a prior VM snapshot on which the containers run. To see which image is actually vulnerable, we run a vulnerability scan with Trivy: trivy image <name> lists known CVEs before deciding how urgent the pull is.
Windows: Yes, It Still Exists
Winline, NoSpamProxy, Translogica clients; they run on Windows. Patch management there means: WSUS or simply monthly maintenance windows, defining Active Hours, enabling automatic updates, but delaying them by a week (to wait for potential Microsoft rollbacks).
NIS2: Documentation Is Half the Battle
Having patched is good. Being able to prove that and when patching occurred is NIS2-compliant. A log file, a markdown log entry, a screenshot; the main thing is being able to show in an audit that updates are applied regularly.
Conclusion
Patch management doesn’t require SCCM or an enterprise budget. It needs a maintenance window, safe automations, and a checklist checked off every month. The biggest enemy of patch management isn’t the technology, it’s procrastination.
Further Reading
Can we auto-patch Linux VMs without endangering production systems?+
Yes. Ubuntu and Debian ship unattended-upgrades, which pulls security patches from the official repositories automatically overnight. This covers only security updates, no major version jumps, and can be precisely scoped to specific package sources. That keeps the VMs current without a kernel leap risking the stability of a production system.
How do we patch Proxmox hosts in an HA cluster without downtime?+
We set a monthly maintenance window and update one host at a time. The VMs migrate via live migration to the remaining nodes, so the service keeps running while patching occurs. Afterward we check whether a reboot is needed and roll that out in a controlled way. The cluster stays available while the hosts are still patched on a regular schedule.
Is that enough to satisfy the NIS2 documentation duty?+
NIS2 demands not just patching but proof of that and when patching occurred. Having patched is good; being able to demonstrate that updates run regularly is the real obligation. A log file, a markdown log entry, or a screenshot is enough, as long as you can show in an audit that updates are applied continuously. Structured maintenance windows deliver exactly that evidence.