0

As we have pointed out here, we can quickly update Ubuntu system by executing the piled commands

sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade

My question is how can I put in the parameters that make it more automatical by asnwering yes all asked confirmations during this execution?

2 Answers 2

3

There are always some security risks involved in running software upgrades without supervision, but there are also benefits.


Content


  1. Using the "unattended-upgrades" package
  2. Using cron and aptitude
  3. Using cron-apt to handle automatic updating


Using the "unattended-upgrades" package


Install the unattended-upgrades package if it isn't already installed

sudo apt-get install unattended-upgrades

To enable it, do:

sudo dpkg-reconfigure -plow unattended-upgrades

(it's an interactive dialog) which will create /etc/apt/apt.conf.d/20auto-upgrades with the following contents:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Details about what these values mean may be found in the header of the /etc/cron.daily/apt file.

Note:

  1. When the apt job starts, it will sleep for a random period between 0 and APT::Periodic::RandomSleep seconds. The default value is "1800" so that the script will stall for up to 30 minutes (1800 seconds) so that the mirror servers are not crushed by everyone running their updates all at the same time. Only set this to 0 if you use a local mirror and don't mind the load spikes. Note that while the apt job is sleeping it will cause the execution of the rest of your cron.daily jobs to be delayed.

  2. If you want the script to generate more verbose output set APT::Periodic::Verbose "1";

  3. If you want the script to automatically reboot when needed, you not only need to set Unattended-Upgrade::Automatic-Reboot "true", but you also need to have the "update-notifier-common" package installed. On minimal installations this is not installed by default and without it the automatic updater will never reboot and will not even tell you that you need to reboot manually if you have email notifications configured!

And /etc/apt/apt.conf.d/50unattended-upgrades:

// Automatically upgrade packages from these (origin, archive) pairs
Unattended-Upgrade::Allowed-Origins {    
    // ${distro_id} and ${distro_codename} will be automatically expanded
    "${distro_id} stable";
    "${distro_id} ${distro_codename}-security";
    "${distro_id} ${distro_codename}-updates";
//  "${distro_id} ${distro_codename}-proposed-updates";
};

// List of packages to not update
Unattended-Upgrade::Package-Blacklist {
//  "vim";
//  "libc6";
//  "libc6-dev";
//  "libc6-i686";
};

// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you 
// have a working mail setup on your system. The package 'mailx'
// must be installed or anything that provides /usr/bin/mail.
//Unattended-Upgrade::Mail "root@localhost";

// Do automatic removal of new unused dependencies after the upgrade
// (equivalent to apt-get autoremove)
//Unattended-Upgrade::Remove-Unused-Dependencies "false";

// Automatically reboot *WITHOUT CONFIRMATION* if a 
// the file /var/run/reboot-required is found after the upgrade 
//Unattended-Upgrade::Automatic-Reboot "false";


Using cron and aptitude


Install aptitude:

sudo apt-get install aptitude

Create a new file:

sudo nano /etc/cron.weekly/apt-security-updates

Copy the following text into this new file, save, and exit:

echo "**************" >> /var/log/apt-security-updates
date >> /var/log/apt-security-updates
aptitude update >> /var/log/apt-security-updates
aptitude safe-upgrade -o Aptitude::Delete-Unused=false --assume-yes --target-release `lsb_release -cs`-security >> /var/log/apt-security-updates
echo "Security updates (if any) installed"

Recently (since Ubuntu 7.10), the aptitude action 'upgrade' is deprecated. There are now two ways to upgrade, a safe one (conservative, if an update needs to add or remove dependencies, it won't update) and a full one (it will always upgrade even though it impacts other packages by adding them or removing them, previously called 'dist-upgrade'). The actions are now 'safe-upgrade' or 'full-upgrade'. See the manual page of aptitude (man aptitude) for more details.

Once you are complete, you want to make the file executable. So, via the terminal, type the following line:

sudo chmod +x /etc/cron.weekly/apt-security-updates

This script will run once weekly and it installs all available packages from the security repository. It also generates a log in /var/log/apt-security-updates for later inspection in case something goes wrong.

This script will output information to a log file, so to prevent this log file from getting too large we need to make sure it gets rotated out. To do this, we'll use the logrotate utility, which comes with Ubuntu. Press Alt+F2 and type this command:

sudo nano /etc/logrotate.d/apt-security-updates

Paste this into the editor, save, and exit:

/var/log/apt-security-updates {
        rotate 2
        weekly
        size 250k
        compress
        notifempty
}

This will rotate the log file every week (weekly), or if it's over 250kB in size (size 250k), compressing old versions (compress). The previous two log files will be kept (rotate 2), and no rotation will occur if the file is empty (notifempty).



Using cron-apt to handle automatic updating


cron-apt is a program that automatically updating software packages by using a cron job apt-get , aptitude or apt-file can take over.

Install aptitude:

sudo apt-get install aptitude

Install cron-apt:

sudo apt-get install cron-apt

Configuration can be done by editing /etc/cron-apt/config and by adding rules to /etc/cron-apt/action.d/. The variables that you can set in /etc/cron-apt/config is documented in the configuration example in /usr/share/doc/cron-apt/examples/config

Two files are created:

/etc/cron-apt/action.d/0-update
/etc/cron-apt/action.d/3-download

Open 3-download in a terminal:

sudo nano /etc/cron-apt/action.d/3-download

The content

dist-upgrade -d -y -o APT::Get::Show-Upgraded=true

means that a dist-upgrade is performed, but only the packages are downloaded and not be installed.

If you want to install with a sledge-hammer everything, then remove the "-d" parameters.


Source

2

You can do

sudo apt-get -y upgrade

this will assume yes to most things. In some cases where yes may be undesirable the command will abort.

A more risky option is

sudo apt-get --force-yes

this is not recommended as it could say yes to something that will break your system. For more details on these options you can run the command

man apt-get

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .