🔁 Automatische Updates

Aktivieren Sie automatische Updates und lassen root Mails zukommen wie das so gelaufen ist.

Tutorial abgeleitet von https://wiki.debian.org/UnattendedUpgrades

root@client:~# apt install unattended-upgrades apt-listchanges powermgmt-base

In /etc/apt/apt.conf.d/50unattended-upgrades aktivieren wir alle Updates, nicht nur Security:

Unattended-Upgrade::Origins-Pattern {
    // Codename based matching:
    // This will follow the migration of a release through different
    // archives (e.g. from testing to stable and later oldstable).
    // Software will be the latest available for the named release,
    // but the Debian release itself will not be automatically upgraded.
    "origin=Debian,codename=${distro_codename}-updates";
    "origin=Debian,codename=${distro_codename}-proposed-updates";
    "origin=Debian,codename=${distro_codename},label=Debian";
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
    "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

    // Archive or Suite based matching:
    // Note that this will silently match a different release after
    // migration to the specified archive (e.g. testing becomes the
    // new stable).
    "o=Debian,a=stable";
    "o=Debian,a=stable-updates";
    "o=Debian,a=proposed-updates";
    "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports";
};

Und setzen Mail-Benachrichtungen für root:

// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. A package that provides
// 'mailx' must be installed. E.g. "user@example.com"
Unattended-Upgrade::Mail "root";
Unattended-Upgrade::Sender "HOST Upgrades from <upgrades@host.domain.tld>";

Wer mag kann sich permanent benachrichtigen lassen:

Unattended-Update::MailReport "always";

Unbenötigte Pakete automatisch entfernen

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

Oder die Server automatisch neustarten lassen (empfehle ich nur für root-server die nicht verschlüsselt sind!!)

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
# lets not wake up the admin at 2 am.
Unattended-Upgrade::Automatic-Reboot-Time "08:00";

Wer powermgmt-base nicht installieren will kann die Meldung es bitte zu installieren abschalten und Updates immer laufen lassen, auch im Batterie-Betrieb

Unattended-Upgrade::OnlyOnACPower "false";

Wie man System-Mails an einen lokalen Postboten-Server umleitet steht hier

Die Zeitschaltung für automatische Updates anschalten:

root@server:/etc/apt/apt.conf.d# dpkg-reconfigure unattended-upgrades

Mit Ja beantworten, dann /etc/apt/apt.conf.d/20-autoupgrades prüfen:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Mit systemctl list-timers kann man nun schon sehen, dass täglich Updates geholt und installiert werden:

root@server:/etc/apt/apt.conf.d# systemctl list-timers
NEXT             LEFT      LAST             PASSED       UNIT             ACTIVATES             
xxx xxxx-xx-xx xx:xx:xx xxxx 6h left       -                -        apt-daily.timer          apt-daily.service
xxx xxxx-xx-xx xx:xx:xx xxxx 13h left      -                -        apt-daily-upgrade.timer      apt-daily-upgrade.service

Einen Testlauf erledigt: unattended-upgrade -d