I want my Server to run unattended-upgrades regularly and keep my server auto updated and install only security updates.

But I don't want to update the main versions of several packages.

For Example:
I want my server to have PHP 5.4 running I am OK with minor updates such as:

  • 5.4.30 to 5.4.37 or 5.4.xx to 5.4.yy

But I don't want to change the main version updates, such as:

  • 5.4.48 to 5.5.1 or 5.x.a to 5.y.a

Can this be done with unattended-upgrades?

Right now what I have done is exclude PHP5-* from being auto updated by unattended-upgrades. Is there a better way to do this?

Or is there a standard on Ubuntu Security Updates, like they do not upgrade the main version of an application, such as 5.4.48 to 5.5.1 or 5.x.a to 5.y.a, etc

  • 1
    I don't know much when it comes to servers, but if I had one running anything even slightly critical, I would want to verify I had a working backup, take it out of service, then run the update and make sure it works and only then would I let it loose on the world. As a desktop user, most updates are harmless, but every so often, one breaks something and I have to spend time figuring out what happened and how to fix it. I wouldn't want to be in that position with data getting corrupted or users breathing down my neck about a service which is broken. – Joe Feb 27 '15 at 0:15
  • Thanks For the advice, I have few AWS EC2 Instances, which has LAMP and LEMP running on them. They are being used to host Magento instances. So I have to make sure that version which the server has is always the version recommended by vendor. So in this case I will make sure to take a Snapshot before doing the update. But for that I have to do the Update manually. I am trying to make this an automated one - using unattended updates. – fFace Mar 3 '15 at 3:28
  • Got this via: ubuntu forum; ubuntuforums.org/showthread.php?t=2266595 – fFace Mar 3 '15 at 7:05

I found this post on Ubuntu Forums somewhat helpful. thought its worth sharing:

Your system isn't smart enough to know if a particular update includes a new feature, a bugfix, or a security patch. It only knows the software's repository. Happily, you can tell (and filter) based on the repository.

If the upstream project releases a security patch for a CVE, the Ubuntu Security Team applies it to the current version, and it goes into the *-security repository.

*-security does not include updates. CVE patches only. The upstream version number does not change, the Debian or Ubuntu version number does change: Foo 1.2.3-1ubuntu2 becomes Foo 1.2.3-1ubuntu3

You can easily enable automatic updates for *-security repos in /etc/apt/apt.conf.d/50unattended-upgrades or in Ubuntu's Software & Updates control panel.

Also: If you enable the *-updates repository, then you will get those minor improvements you don't mind. But the system has no way to determine if an update is too much for your comfort...it's not psychic...so perhaps you should disable that repository.

Finally: Some users get confused when a famous vulnerability gets discovered, and the upstream project seems to recommend upgrading to the latest version to fix it. Follow the CVE number at security.ubuntu.com instead of following the hype.

  • 2
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Please take a look here too: askubuntu.com/help/deleted-answers – bummi Mar 3 '15 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.