Blog · 2026-10-29 · Gardience Engineering

WSUS for Linux: one update cache for Debian, Ubuntu, Rocky and Alma

Is there a WSUS for Linux? Not from Microsoft, but the idea works. How a local Linux update cache works, the open-source ways to build one, and a built-in cache that also carries into networks with no internet.

WSUS (Windows Server Update Services) does two things for Windows: it downloads each update once and serves it to every machine on the network, and it lets an admin decide what gets installed. There is no WSUS for Linux from Microsoft, and WSUS itself is deprecated. But both halves of the idea work on Linux, and the first half is simpler than on Windows.

Why Linux needs it less, and still benefits#

Linux machines already get updates from repositories over HTTP, and every package is signed by the distribution. So a local cache does not have to be trusted the way WSUS was: if it served a changed package, apt or dnf on the machine would refuse it because the signature would not match.

What a cache still gives you:

• Bandwidth. A hundred servers installing a 60 MB kernel download it once, not a hundred times.
• No internet on the servers. Machines reach only the cache, not the whole internet, which most security teams prefer and some networks require.
• Offline networks. A cache filled on a connected network can be carried into one with no internet at all.

The open-source ways to build one#

The trade-off is always the same: a caching proxy stores only what machines actually asked for, which is small and needs no upkeep, while a full mirror stores everything, which is large but complete. Any of them still leaves you to point each machine at it, and to put each machine back if you stop.

How Gardience does it#

Gardience 1.18 adds an update cache, Patching > Update cache, built into the server you already run:

• The official sources only. Debian, Ubuntu, Rocky Linux, AlmaLinux and EPEL, each fetched over HTTPS with its certificate checked. It serves package and index files only (no ISO images, nothing else), and only to machines in your own networks.
• Each package downloads once. Packages are kept for 90 days; package lists are refreshed every couple of minutes, and an old copy is served if the internet is down.
• Machines are pointed at it for you. Pick machines and choose Use the cache. Gardience keeps a copy of each source file it changes, points the official sources at the cache, leaves every other source alone (Docker's, a vendor's, a Red Hat subscription), and puts everything back at once if the first refresh fails. Back to their own sources restores exactly what it changed.
• One new trust, for one address. If the server's certificate is self-signed, machines trust it for the update address only, never in their system certificate store.
• Networks with no internet. Export the cache on a connected server, carry the file in, and import it on the offline one. The checksum is checked first. Signatures are still checked on every machine, so a bundle cannot slip in anything unsigned.

Patching then works as before: tested patch sets, rings, change windows, schedules and approvals, with every action in the audit log. We tested it on Debian 13, Ubuntu 24.04, Rocky Linux 9 with EPEL, and AlmaLinux 9: the first download came from the internet, the second from the cache, a wrong certificate was refused and rolled back, and "back to their own sources" left each machine identical to a fresh install.

What it does not cover#

• Red Hat Enterprise Linux and SUSE subscription repositories, which need each machine's own entitlement, and Amazon Linux. Those machines keep their sources as they are.
• Windows. Windows machines keep getting updates from Microsoft or your WSUS.
• Packages the cache never fetched. An offline network gets only what was installed through the cache before the export, so fill it with the same Linux versions you run offline.

Questions#

Is there a WSUS for Linux?#

Not from Microsoft. On Linux the same job is done by a local cache or mirror of the distribution's repositories: apt-cacher-ng, a web cache, a full mirror, or a tool like Pulp or Foreman. Gardience includes one for Debian, Ubuntu, Rocky, AlmaLinux and EPEL.

Can a cache install a tampered package?#

No. Debian, Ubuntu, Rocky, AlmaLinux and Fedora (for EPEL) sign their packages, and apt and dnf check those signatures on each machine, whatever server the file came from.

Does it work with no internet?#

Yes. A cache filled on a connected network can be exported and imported on a network with no internet. Debian's security list expires after about a week offline, so bring in a fresh export at least weekly for Debian security updates.