System: cron-apt update notification and security upgrades in Wheezy

 Tweet6 Shares0 Tweets0 Comments

The cron-apt program in Debian allows you to automate various apt-get commands to either just notify you of updates or to actually download and install updates for you.

Our requirements are to:

1. update the package list (apt-get update);
2. run a download and simulated upgrade (apt-get -d dist-upgrade); and
3. automatically download and install any security updates.

Actually the first two items are enabled by default, as you can see below, so it's only the last requirement that needs our attention.

Obviously it's always good to carry out package mangement manually, but that's not always an option, and the security updates at least are usually safe to install.

Configuration in Wheezy

First make sure that the latest version is installed:

In Debian 7.0 "Wheezy" the configuration has been changed from a single file /etc/cron-apt.conf to a confusing array of directories and files. We will focus on just the most important ones:

After a default install the action.d directly contains two files which are numbered to define the execution order. They are run in sequence when cron-apt is executed. All other config files are empty.

/etc/cron-apt/action.d/0-update

/etc/cron-apt/action.d/3-download

Together these scripts will update the local package list and download any new packages ready for installation, but not install them. The list of packages ready to be upgraded is then emailed (to the root user), assuming the script is being called via cron.

To make debugging easier, we've also added to the config file the following lines:

This means that an email is sent whenever any output is generated, and everything is logged. The default values are "error" and "output" respectively. You can consult the README file to see all possible values.

Logging output appears at /var/log/cron-apt/log.

Enabling security upgrades

Any configuration settings added to the main config file will apply to all 'actions'. That's not useful if we want to use different configurations for different actions, as we do here for installing only security upgrades.

The trick is to create separate configuration files under config.d with filenames matching the respective files in action.d.

To enable automatic security updates we create a new action and matching configuration file:

/etc/cron-apt/action.d/5-security

The -d here is only required for testing (see below).

/etc/cron-apt/config.d/5-security

You'll notice that this specifies an alternative sources.list /etc/apt/sources.list.d/security.list. To create this file take any 'security' references from the default sources.list and move them to this new file. This will look something like:

/etc/apt/sources.list.d/security.list

Just like cron-apt the configuration for apt has evolved to allow for settings to be split into multiple files. All files under sources.list.d will be read by default during an update or upgrade, but with cron-apt we are able to specify a specific file to use.

Don't forget to update this file when moving to a new distribution!

Running a test

To test that the configuration is correct you can add -d to action.d/5-security and watch for output in the logfile when you call cron-apt from the command line.

Sample output:

The highlighted sections show the apt-get commands that have been executed. Notice in the last highlighted line -d (--download-only) still appears. That needs to be removed after checking the test output to enable the automatic security upgrades.

Again, it is usually ok to install security updates automatically, but there is always some risk. You should also check the official documentation found at /usr/share/doc/cron-apt/README.gz

CRON scheduling

Like cron-apt, the cron system is also moving to a new structure, with various /etc/cron.d/* files being used now in preference to cron.daily et al.

The default setting for cron-apt is to run nightly at 4:00 AM:

/etc/cron.d/cron-apt

If you have any comments or questions, or if we've missed anything or made a mistake, please get in touch using the Feedback form below.

Seeing the code in action

When an update is available any new package/s are downloaded by the 3-download action and security updates are automatically installed by 5-security as you can see below. In this case it's just the fail2ban package that's receiving a security update:

expand code box

Any non-security updates are downloaded by 3-download, but not installed. They are more likely to require human intervention and a premature upgrade of one package can break other dependencies.

< System