Posted by joe on Tue 14 Jun 2005 at 01:19
I've seen cron-apt mentioned a few times here so I thought I would post a little introduction to it incase anyone was curious as to how to use it, or hadn't heard of it before.
Basically, cron-apt is a very flexible program that can manage automating apt via cron (I suppose thats how it got its name...). You can install it like so:
apt-get install cron-apt
You can configure cron-apt in the /etc/cron-apt directory and you can specify when it runs in the /etc/cron.d/cron-apt file. Personally, I just have everything set to default except for one line in /etc/cron-apt/config:
MAILON="always"
Just as it would imply, it will email me the results of the nightly run no matter what.
By default, cron-apt will only download updates -- it will not install them. I know other packages for other distributions like up2date will automatically install the updates for you, but I've learned to like this and that in the long run, automatically installing updates is a Bad Thing. Why? Well when I was experimenting with auto-installs, I ran into problems:
Bottom line: Yes, it can be very tedious to manually review each update batch -- especially if you have several servers -- but that is part of your job when you are running a server. Deal with it!
OK, with that rant done with, lets get back to cron-apt.
So right now we have cron-apt downloading updates for us every day and emailing us about them. Each morning I review the updates to see if there's anything critical that needs updated (like if I've seen a security advisory on BugTraq or something). If not, I usually wait until I have time on the weekend to do the update. If anything, the daily emails serve as a nagging reminder to update your server.
I simply run:
apt-get dist-upgrade
I do one final review and then install the packages and clean up any config file conflict during installation.
That's really it. As mentioned before, cron-apt is very flexible. If you read over the example config in /usr/share/doc/cron-apt/examples, you'll get a better understanding for this flexibility.
For example, you can specify a different package repository to download from at night than when you use apt daily on the command line. Or you can add different arguments or even use completely different programs to do the actual downloading. Out of the box, it works just fine, but if you have some weird special need, it can do it for you.
Questions, comments, and flames are more than welcomed!
That's a very similar idea to the script I presented in the Keeping unstable machines up to date easily article.
Steve
-- Steve.org.uk
[ Parent ]
Yes, it can be very tedious to manually review each update batch -- especially if you have several servers
I believe that the cfengine package is supposed to help with this, but I haven't had any experience of it. If someone could post a guide to it on d-a, I'm sure plenty of people would find it interesting.
[ Parent ]
[ Parent ]
[ Parent ]
#!/bin/bash /usr/local/sbin/apt-fw start test -x /usr/sbin/cron-apt && /usr/sbin/cron-apt /usr/local/sbin/apt-fw stop/usr/local/sbin/apt-fw.sh
#!/bin/bash
IPTABLES=/sbin/iptables
GREP=/bin/grep
AWK=/usr/bin/awk
TAIL=/usr/bin/tail
CHAIN="aptChain"
function d_start() {
$IPTABLES -N $CHAIN
$IPTABLES -A $CHAIN -p udp --dport 53 -j ACCEPT
$IPTABLES -A $CHAIN -p tcp -m multiport --dport 21,80 -j ACCEPT
$IPTABLES -A $CHAIN -j REJECT
for APT in `$GREP ^deb /etc/apt/sources.list | $AWK '{print $2}' | uniq`; do
APT=`echo $APT | $AWK '{sub (/[fht]*p:\/\//,"",$1); print}'`
APT=`echo $APT | $AWK '{sub (/\/[a-zA-Z0-9\-_/]*\/?/,"",$1); print}'`
$IPTABLES -A OUTPUT -d $APT -j $CHAIN
done
}
function d_stop() {
$IPTABLES -F $CHAIN
I=`$IPTABLES -L OUTPUT -n --line-number | $GREP $CHAIN | $TAIL -n 1 | $AWK '{print $1}'`
while [ "$I" != "" ]; do
$IPTABLES -D OUTPUT $I
I=`$IPTABLES -L OUTPUT -n --line-number | $GREP $CHAIN | $TAIL -n 1 | $AWK '{print $1}'`
done
$IPTABLES -X $CHAIN
}
case "$1" in
start)
d_start
;;
stop)
d_stop
;;
*)
echo "Usage: $0 {start|stop}" >&2
exit 1
;;
esac
exit 0
The advantage of splitting the process in two seperate files is, that you can call apt-fw.sh manually, when executing aptitude update or the like. For comments, please drop me a mail. :-)[ Parent ]
[ Parent ]
[ Parent ]
[ Parent ]
[ Parent ]
[ Parent ]
#!/bin/bash # # Cron Script - run from /etc/crontab or /etc/cron.daily # # Runs "apt-get update" and prints the output of a simulated # dist-upgrade if new packages are found. if [[ `apt-get update 2>&1 | grep Get` ]]; then if [[ `apt-get --simulate dist-upgrade 2>&1 | grep Inst` ]]; then apt-get --simulate dist-upgrade fi fiIt can also be found on my website. Cheers! Mattias[ Parent ]