2

I understand that the question should one perform automated and unattended system upgrades is highly debatable, but let us assume that I for one, never had any issues with that concept so far.

The setup is the following: stripped down Debian based server system, running, for example Apache and SSH servers, properly protected with very strict iptables rules and behind a HW firewall. There is a daily cron job that does the following:

apt-get update &&
apt-get upgrade -y &&
apt-get dist-upgrade -y &&
apt-get autoremove -y &&
service apache restart &&
service ssh restart

The idea behind this is: if there is an update to the software that is the only attack surface to the outer world, install it and restart that software. (The restart occurs even if Apache and SSH weren't upgraded, and the service downtime at that point is less than a second).

Now, my problem is, when there is an update to Apache and SSH, dpkg asks whether one should keep the original configuration or replace it with the generic, default one. Unfortunately this is a menu-based prompt and one cannot use simple pipe to yes to select the proper answer. Any ideas how can this be scripted?

1

You could try '-qq -y', but it is not recommended.

-q, --quiet Quiet. Produces output suitable for logging, omitting progress indicators. More q's will produce more quiet up to a maximum of two. You can also use -q=# to set the quiet level, overriding the configuration file. Note that quiet level 2 implies -y, you should never use -qq without a no-action modifier such as -d, --print-uris or -s as APT may decided to do something you did not expect.

I guess it would be best to simulate the upgrade first, and then decide if it is 'safe' to force an upgrade or not, that is if force is necessary.

Simulate:

# apt-get -qq -s upgrade

Force upgrade:

# apt-get -qq -y upgrade

Reference;

apt-get man

| improve this answer | |
0

According to the debian handbook you can avoid the configuration file questions by adding the following line :

DPkg::options { "--force-confdef"; "--force-confold"; }

To your /etc/apt/apt.conf.d/local file (create the local file before )

Or include the above option in the apt command :

apt -o DPkg::options::="--force-confdef" -o DPkg::options::="--force-confold" full-upgrade

GOING FURTHER Avoiding the configuration file questions

dpkg handles configuration file updates, but, while doing so, regularly interrupts its work to ask for input from the administrator. This makes it less than enjoyable for those who wish to run updates in a non-interactive manner. This is why this program offers options that allow the system to respond automatically according to the same logic: --force-confold retains the old version of the file; --force-confnew will use the new version of the file (these choices are respected, even if the file has not been changed by the administrator, which only rarely has the desired effect). Adding the --force-confdef option tells dpkg to decide by itself when possible (in other words, when the original configuration file has not been touched), and only uses --force-confnew or --force-confold for other cases.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.