1

Using unattended-upgrades to install security packages. Which runs daily. However I've noticed for the last week or so that security packages haven't been installed. After some investigation I found that these updates require user interaction. (IE they have an interactive prompt during update)

How can I get unattended-upgrades to assume no on these prompts ?

I tried using APT::GET::ASSUME-NO but that doesn't appear to work.

Seems there has to be some way to get around this as I manage many servers and updating security for each one would be rather time consuming.

/etc/apt/apt.conf.d/50unattended-upgrades file looks as so

Unattended-Upgrade::Origins-Pattern {
      "origin=${distro_id},archive=${distro_codename}";
      "origin=${distro_id},archive=${distro_codename}-security";
  };

Unattended-Upgrade::Package-Blacklist {
};
Unattended-Upgrade::Mail "root";
Unattended-Upgrade::MailOnlyOnError "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Upon logging in I see

22 updates are security updates.

EDIT: Running Ubuntu-Server 18.04.4 LTS (GNU/Linux 5.4.0-1035-aws x86_64)

The package that is requires interaction during update is php7.0-fpm.

Adding

DPkg::Options {
        "--force-confold";
        "--force-confdef";
};

does appear to stop conffile prompts. However running sudo unattended-upgrades -d gives me the message.

dpkg is configured not to cause conffile prompts
No packages found that can be upgraded unattended and no pending auto-removals

So maybe this is just something I will have to deal with. But I am hoping someone out there has found a way around this.

We manage 100's of servers. So as you can imagine doing this manually on each one would be rather time consuming.

4
  • Which version of Linux? Is it a desktop or a server? Please edit your question and add the new information in the question. – user68186 Jan 11 at 18:12
  • Updated to include details to the version. and OS type (Server) not Desktop – DupeTroop Jan 11 at 18:17
  • If it requires interaction, then there's a reason. Don't try to outsmart apt's question; simply answer it. – user535733 Jan 11 at 19:00
  • Appreciate the reply. That's fine if this was one or two servers. But to manually do it across hundreds of servers isn't really a simply "answer it" solution. – DupeTroop Jan 12 at 16:01
2

What question is triggering the user-interaction?

I include these settings in my apt configuration for unattended-upgrades. They will answer dpkg prompts for configuration file changes

DPkg::Options {
        "--force-confold";
        "--force-confdef";
};

More information at https://debian-handbook.info/browse/stable/sect.automatic-upgrades.html

EDIT

I don't know how the update-notifier code differentiates between security updates and other updates. The MOTD output may use different criteria than unattended-upgrades.

If you are looking specifically at php7.0-fpm, check the output of apt-cache policy php7.0-fpm. That will tell you what the candidate version is and what repository the version comes from.

One of the potential sources of confusion with unattended-upgrades is the default config does not install updates from the updates repository. Here is another apt config I use to install updates from the updates repository (as well as the ESM repositories).

#clear Unattended-Upgrade::Allowed-Origins;
Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-updates";
        "${distro_id}:${distro_codename}-security";
        "${distro_id}ESM:${distro_codename}";
        "${distro_id}ESM:${distro_codename}-updates";
        "${distro_id}ESM:${distro_codename}-security";
};

The package php7.0-fpm indicates another potential problem. You say you are using 18.04.4, but that package only exists in the official repositories for 16.04. If you installed this from an unofficial repository, then unattended-upgrades won't update the package unless the Origins-Pattern matches it.

2
  • php7.0-fpm was the package that was triggering the user-interaction. It looks like that setting will help in some cases. However after updating my conf file for unattended-upgrades, and then manually triggering unattended-upgrades I still don't get the updates. But I do see this "dpkg is configured not to cause conffile prompts No packages found that can be upgraded unattended and no pending auto-removals" So it's a step in the right direction. – DupeTroop Jan 12 at 19:25
  • I added a couple more tips based on the info provided in your edit – Andrew Lowther Jan 12 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.