search

mvo5 / unattended-upgrades

Automatic installation of security upgrades on apt based systems
GNU General Public License v2.0
278 stars 78 forks source link

readme

Unattended upgrades

This script upgrades packages automatically and unattended.

If you would prefer to disable it from the command line, run "sudo dpkg-reconfigure -plow unattended-upgrades".

It will not install packages that require dependencies that can't be fetched from allowed origins, and it will check for conffile prompts before the install and holds back any package that requires them.

Setup

By default unattended-upgrades runs an update every day.

The main way to specify which packages will be auto-upgraded is by means of their "origin" and "archive". These are taken respectively from the Origin and Suite fields of the repository's Release file, or can be found in the output of:

$ apt-cache policy

in the "o" and "a" fields for the given repository.

The default setup auto-updates packages in the main and security archives, which means that only stable and security updates are applied.

This can be changed either with the "Unattended-Upgrade::Allowed-Origins" or the "Unattended-Upgrade::Origins-Pattern" apt configuration lists, which are listed in /etc/apt/apt.conf.d/50unattended-upgrades. Also in this file are a range of other options that can be configured.

To override the configuration it is recommended to create an other APT configuration file fragment which overrides the shipped default value because updates to to shipped configuration file may conflict with the local changes blocking updating unattended-upgrades itself. The new file should sort later than 50unattended-upgrades to be parsed later than the one shipping the default values, it can be e.g. 52unattended-upgrades-local.

Allowed-Origins is a simple list of patterns of the form "origin:archive".

Origins-Pattern allows you to give a list of (glob-style) patterns to match against. For example:

 Unattended-Upgrade::Origins-Pattern {
        "origin=Google\, Inc.,suite=contrib";
        "site=www.example.com,component=main";
 };

will upgrade a package if either the origin is "Google, Inc." and suite is "contrib" or if it comes from www.example.com and is in component "main". The apt-cache policy short identifiers (e.g. "o" for "origin") are also supported.

If you already configure what to install via apt pinning, you can simply use "origin=*", e.g.:

 Unattended-Upgrade::Origins-Pattern {
        "origin=*";
 };

All operations are logged in /var/log/unattended-upgrades/. This includes the dpkg output as well. The file /etc/logrotate.d/unattended-upgrades controls how long logfiles are kept, and how often they are rotated. See the logrotate manpage for details.

If you want mail support you need to have a mail-transport-agent (e.g postfix) or mailx installed.

Debugging

If something goes wrong, or if you want to report a bug about the way the script works, it's a good idea to run:

$ sudo unattended-upgrade --debug --dry-run

and look at the resulting logfile in: /var/log/unattended-upgrades/unattended-upgrades.log It will also contain additional debug information.

Manual Setup

To activate this script manually you need to ensure that the apt configuration contains the following lines (this can be done via the graphical "Software Source" program or via dpkg-reconfigure as well):

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

This means that it will check for updates every day, and install them (if that is possible). If you have update-notifier installed, it will setup /etc/apt/apt.conf.d/10periodic. Just edit this file then to fit your needs. If you do not have this file, just create it or create/edit /etc/apt/apt.conf - you can check your configuration by running "apt-config dump".

Plugin support

Plugin support is available to integrate with webhooks or other custom tools that need to read u-u run results. Check the example plugin in the git repository for more details.

Supported Options Reference

If automatic reboot is enabled and needed, reboot at the specific time instead of immediately.

Example - reboot at 02:00:

Unattended-Upgrade::Automatic-Reboot-Time "02:00";