Skip to main content

AutomaticSecurityUpdates


Introduction

This is a simple tutorial that will teach you to configure your system to automatically install security updates. There are always some security risks involved in running software upgrades without supervision, but there are also benefits. If you believe it's important to stay up to date with the latest security patches, then you should follow this simple tutorial.
There are several options for enabling automatic updates:
  • Use the GNOME Update Manager
  • Use the unattended-upgrades package
  • Write your own cron script that calls aptitude
  • Use cron-apt

Using GNOME Update Manager

If you are using GNOME, go to the "System" menu, then "Administration", then "Update Manager", then "Settings".
Open up the "Updates" tab and in the "Automatic updates" section select "Install security updates without confirmation".

Using the "unattended-upgrades" package

Install the unattended-upgrades package if it isn't already installed (sudo apt-get install unattended-upgrades).
To enable it, do:
sudo dpkg-reconfigure -plow unattended-upgrades
(it's an interactive dialog) which will create /etc/apt/apt.conf.d/20auto-upgrades with the following contents:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
Details about what these values mean may be found in the header of the /etc/cron.daily/apt file. Note:
  • When the apt job starts, it will sleep for a random period between 0 and APT::Periodic::RandomSleep seconds. The default value is "1800" so that the script will stall for up to 30 minutes (1800 seconds) so that the mirror servers are not crushed by everyone running their updates all at the same time. Only set this to 0 if you use a local mirror and don't mind the load spikes. Note that while the apt job is sleeping it will cause the execution of the rest of your cron.daily jobs to be delayed.
  • If you want the script to generate more verbose output set APT::Periodic::Verbose "1";
  • If you want the script to automatically reboot when needed, you not only need to set Unattended-Upgrade::Automatic-Reboot "true", but you also need to have the "update-notifier-common" package installed. On minimal installations this is not installed by default and without it the automatic updater will never reboot and will not even tell you that you need to reboot manually if you have email notifications configured!
And /etc/apt/apt.conf.d/50unattended-upgrades:
// Automatically upgrade packages from these (origin, archive) pairs
Unattended-Upgrade::Allowed-Origins {    
    // ${distro_id} and ${distro_codename} will be automatically expanded
    "${distro_id} stable";
    "${distro_id} ${distro_codename}-security";
    "${distro_id} ${distro_codename}-updates";
//  "${distro_id} ${distro_codename}-proposed-updates";
};

// List of packages to not update
Unattended-Upgrade::Package-Blacklist {
//  "vim";
//  "libc6";
//  "libc6-dev";
//  "libc6-i686";
};

// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you 
// have a working mail setup on your system. The package 'mailx'
// must be installed or anything that provides /usr/bin/mail.
//Unattended-Upgrade::Mail "root@localhost";

// Do automatic removal of new unused dependencies after the upgrade
// (equivalent to apt-get autoremove)
//Unattended-Upgrade::Remove-Unused-Dependencies "false";

// Automatically reboot *WITHOUT CONFIRMATION* if a 
// the file /var/run/reboot-required is found after the upgrade 
//Unattended-Upgrade::Automatic-Reboot "false";

Using cron and aptitude

To begin, press Alt+F2 and create a new file:
gksudo gedit /etc/cron.weekly/apt-security-updates
If you're using KDE, use this command instead:
kdesudo kate /etc/cron.weekly/apt-security-updates
Copy the following text into this new file, save, and exit:
echo "**************" >> /var/log/apt-security-updates
date >> /var/log/apt-security-updates
aptitude update >> /var/log/apt-security-updates
aptitude safe-upgrade -o Aptitude::Delete-Unused=false --assume-yes --target-release `lsb_release -cs`-security >> /var/log/apt-security-updates
echo "Security updates (if any) installed"
Recently (since Ubuntu 7.10), the aptitude action 'upgrade' is deprecated. There are now two ways to upgrade, a safe one (conservative, if an update needs to add or remove dependencies, it won't update) and a full one (it will always upgrade even though it impacts other packages by adding them or removing them, previously called 'dist-upgrade'). The actions are now 'safe-upgrade' or 'full-upgrade'. See the manual page of aptitude (man aptitude) for more details.
Once you are complete, you want to make the file executable. So, via the terminal, type the following line:
sudo chmod +x /etc/cron.weekly/apt-security-updates
This script will run once weekly and it installs all available packages from the security repository. It also generates a log in /var/log/apt-security-updates for later inspection in case something goes wrong.
This script will output information to a log file, so to prevent this log file from getting too large we need to make sure it gets rotated out. To do this, we'll use the logrotate utility, which comes with Ubuntu. Press Alt+F2 and type this command:
gksudo gedit /etc/logrotate.d/apt-security-updates
For KDE, use this command instead:
kdesudo kate /etc/logrotate.d/apt-security-updates
Paste this into the editor, save, and exit:
/var/log/apt-security-updates {
        rotate 2
        weekly
        size 250k
        compress
        notifempty
}
This will rotate the log file every week (weekly), or if it's over 250kB in size (size 250k), compressing old versions (compress). The previous two log files will be kept (rotate 2), and no rotation will occur if the file is empty (notifempty).

Using cron-apt to handle automatic updating

Updating can be also done automatically by using package called cron-apt. Please read man page before doing anything.

CategorySecurity

Popular posts from this blog

Hidden Wiki

Welcome to The Hidden WikiNew hidden wiki url 2015 http://zqktlwi4fecvo6ri.onion Add it to bookmarks and spread it!!!
Editor's picks Bored? Pick a random page from the article index and replace one of these slots with it.
The Matrix - Very nice to read. How to Exit the Matrix - Learn how to Protect yourself and your rights, online and off. Verifying PGP signatures - A short and simple how-to guide. In Praise Of Hawala - Anonymous informal value transfer system. Volunteer Here are five different things that you can help us out with.
Plunder other hidden service lists for links and place them here! File the SnapBBSIndex links wherever they go. Set external links to HTTPS where available, good certificate, and same content. Care to start recording onionland's history? Check out Onionland's Museum Perform Dead Services Duties. Introduction PointsAhmia.fi - Clearnet search engine for Tor Hidden Services (allows you to add new sites to its database). DuckDuckGo - A Hidden S…

[SOLVED] IDM WAS REGISTERED WITH A FAKE SERIAL NUMBER

[SOLVED] IDM WAS REGISTERED WITH A FAKE SERIAL NUMBER
Good News [May 08, 2015]: IDM developers got smarter, but the crackers are always a step ahead. Follow this article and send an email to uglyduckblog@gmail.com if you are desperate. I can NOT post any crack here for legal reasons. Happy Downloading with IDM. ;) *********** first tip is to use latest crack for idm from  onhax.net idm universal web crack and make sure u are using all latest vers I am sure many of us are too much dependent on Internet Download Manager a.k.a. IDM. The main reason didn’t permanently switch to linux was IDM. I mainly use it for batch downloading and download streaming videos. Till yesterday, IDM was working fine with me (of course with fake serial numbers, keygen, crack, patch etc. which could be found with little effort). But few days ago, with the latest update version 6.18 build 7 (released on Nov 09, 2013) Internet Download Manager was literally had a breakthrough and crushed all the serial numbers, …

Mouse, touchpad, and keyboard problems in Windows

Mouse, touchpad, and keyboard problems in Windows Introduction This tutorial is designed to help you identify and fix common mouse, touchpad, and keyboard problems in Windows. It doesn't cover device problems related to specific programs. Mouse, touchpad, and keyboard problems can have a number of causes: Cables that aren't connected properly Incorrect device settings Missing updates Corrupted or incompatible drivers Hardware problems Check hardware Many mouse, touchpad, and keyboard problems are caused by hardware that isn't set up properly. Here's some information about how to check your device, make sure cables are connected properly, make sure the hardware has power, and check the settings. Make sure cables are connected properly Check that all cables are plugged in to the correct locations. This can include mouse and keyboard, PS2 and USB cables, and, in some cases, external USB touchpad cables. Disconnect USB cables and wait for a short time for the device drive…