Ubuntu Server 8.04 Post Install Tip #1: Auto Updating

On a headless server that you have at home or for testing I like to make sure that all security updates and trivial updates are done automatically. A good sys admin will shy away from this practice for a good reason, updates can mess things up. In a production environment or where the server setup is very complex I can understand the need to manually run updates. For me, well I’m lazy when it comes to my home machines and generally don’t have too complex of setups. Also, in my experience, I’ve hardly ever seen an apt security or trivial update cause any harm (desktop linux I have seen issues though). That being said, I like to force security and trivial updates to happen daily.

You have a few ways to do this, you can setup a custom script to run the upgrades or you can use apt-cron. I’ve done both and am now using apt-cron for my needs as it supports syslog logging which is good for logwatch daily updates. The default setup of apt-cron doesn’t do much so I’ll cover a more complex setup in a bit. But if you just want to setup your own script here it is:

sudo nano /usr/local/sbin/auto-update.sh

Paste all of this:

``#!/bin/bash # #(modified from: http://ubuntuforums.org/showthread.php?t=100803)

simple script which does automatic security updates!

Daniel

# function warning () { echo | mail -s “uname -n:$0: error [$1].” user@localhost } apt-get update > /dev/null 2>&1 || warning update apt-get upgrade -y -t lsb_release -cs-security » /var/log/apt/security.log 2>&1 || warning upgrade.security apt-get upgrade -y –trivial-only » /var/log/apt/trivial.log 2>&1 || warning updade.trivial apt-get autoclean -y > /dev/null 2>&1 exit ``

sudo chmod +x /usr/local/sbin/auto-update.sh

Test your script:

sudo /usr/local/sbin/auto-update.sh less /var/log/apt/security.log 

Now make it run daily

sudo ln -s /usr/local/sbin/auto-update.sh /etc/cron.daily/auto-update 

The cron-apt way

Install cron-apt, remove the default cron-apt schedule and set it to run daily instead. Also remove the default download-only action file as we don’t need it, we are going to install stuff instead.

sudo apt-get install cron-apt ln -s /usr/sbin/cron-apt /etc/cron.daily/cron-apt sudo mv /etc/cron.d/cron-apt ~/oldffiles/cron-apt sudo mv /etc/cron-apt/action.d ~/oldfiles/

create your install action file. Note that I have hardy-security in here as I was not able to get lsb_release -cs to work in the config file properly, you may have a different distro and will have to change accordingly. In /etc/apt/sources.list you can see the different types that you can use by looking at the following part of the source line.

deb http://security.ubuntu.com/ubuntu hardy-security main restricted

sudo nano /etc/cron-apt/action.d/2-install

Insert the following:

upgrade -y -t hardy-security upgrade -y --trivial-only autoclean -y 

Change the default configuration to do no mailing or debugging. Also error out on errors and always dump all actions to syslog.

nano /etc/cron-apt/config 

You will have to uncomment and change the lines noted.

ERROR="/var/log/cron-apt/error" DEBUG="" MAILON="" SYSLOGON="always"

Test by running cron-apt

sudo cron-apt

Then take a look in syslog

less /var/log/syslog