You've already forked auto-update-ubuntu
234 lines
4.9 KiB
Markdown
234 lines
4.9 KiB
Markdown
|
# Unattended Upgrades Policy for Ubuntu 24.04 Server
|
|||
|
|
|
|||
|
|
|
|||
|
|
[](#)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Install unattended upgrades on Ubuntu 24.04 server — with **explicit OPS control**.
|
|||
|
|
|
|||
|
|
> **Production notice**
|
|||
|
|
> This script configures automatic updates and optional automatic reboots.
|
|||
|
|
> Read and understand the policy modes before applying it on production systems.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Why this installer exists
|
|||
|
|
|
|||
|
|
Ubuntu already ships with unattended upgrades — but the defaults are a bear trap.
|
|||
|
|
|
|||
|
|
This installer exists to give **OPS full control** over:
|
|||
|
|
|
|||
|
|
- what gets updated
|
|||
|
|
- when updates run
|
|||
|
|
- whether systems reboot automatically
|
|||
|
|
- how users are impacted
|
|||
|
|
|
|||
|
|
No hidden timers.
|
|||
|
|
No silent defaults.
|
|||
|
|
No surprises.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## What this installer does
|
|||
|
|
|
|||
|
|
✔ Installs required packages (`unattended-upgrades`, `update-notifier-common`)
|
|||
|
|
✔ Disables Ubuntu’s automatic APT timers
|
|||
|
|
✔ Enforces **one explicit update policy (mode 1–4)**
|
|||
|
|
✔ Configures unattended-upgrades accordingly
|
|||
|
|
✔ Creates a controlled cron job
|
|||
|
|
✔ Backs up original configuration files **once**, in-place
|
|||
|
|
✔ Can be safely re-run to switch policies
|
|||
|
|
✔ Does **NOT** enable automatic package removal (`apt autoremove`)
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## What this installer does NOT do
|
|||
|
|
|
|||
|
|
It won’t stop you from running the script without reading the documentation like there’s no tomorrow.
|
|||
|
|
Skip the README, and whatever happens next is your headache, not a bug report.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Supported systems
|
|||
|
|
|
|||
|
|
- Ubuntu **24.04 Server**
|
|||
|
|
- Designed for **servers**, not desktops
|
|||
|
|
- Not intended for containers or Docker images
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Before you run the script
|
|||
|
|
|
|||
|
|
Update package metadata **manually**:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
apt update
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
This is intentionally not done by the script.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Installation
|
|||
|
|
|
|||
|
|
Clone the repository:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
git clone https://git.x-files.dk/server/auto-update-ubuntu.git
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Change into the directory:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
cd auto-update-ubuntu
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Usage
|
|||
|
|
|
|||
|
|
The script is **non-interactive** and **argument-driven**.
|
|||
|
|
|
|||
|
|
You must select **exactly one mode**:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
sudo ./auto-update-ubuntu <mode>
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Example:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
sudo ./auto-update-ubuntu 1
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Available modes
|
|||
|
|
|
|||
|
|
**Mode 1**
|
|||
|
|
- Security **and** software updates
|
|||
|
|
- Automatic reboot
|
|||
|
|
- Reboot happens even if users are logged in
|
|||
|
|
|
|||
|
|
**Mode 2**
|
|||
|
|
- Security **and** software updates
|
|||
|
|
- No automatic reboot
|
|||
|
|
- Users are notified on next login if a reboot is required
|
|||
|
|
|
|||
|
|
**Mode 3**
|
|||
|
|
- Security updates only
|
|||
|
|
- Automatic reboot
|
|||
|
|
- Reboot happens even if users are logged in
|
|||
|
|
|
|||
|
|
**Mode 4**
|
|||
|
|
- Security updates only
|
|||
|
|
- No automatic reboot
|
|||
|
|
- Users are notified on next login if a reboot is required
|
|||
|
|
|
|||
|
|
Running the script again with a different mode will **overwrite the previous policy**.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Cron schedule
|
|||
|
|
|
|||
|
|
Updates are executed via cron:
|
|||
|
|
|
|||
|
|
- **Every Friday at 03:00**
|
|||
|
|
- Command executed:
|
|||
|
|
```
|
|||
|
|
apt update && unattended-upgrade -v
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
The cron file is managed at:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/etc/cron.d/updatesystem
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Re-running the script will always reassert this schedule.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Backups and rollback
|
|||
|
|
|
|||
|
|
### Full rollback (restore Ubuntu defaults)
|
|||
|
|
|
|||
|
|
This rollback **fully returns the system to Ubuntu’s default unattended-upgrades behavior**.
|
|||
|
|
|
|||
|
|
It restores the original configuration files, removes the OPS-controlled cron job, and hands scheduling control back to Ubuntu’s built-in APT timers.
|
|||
|
|
Partial rollback is **not recommended**.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### 1. Restore original configuration files
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
sudo cp /etc/apt/apt.conf.d/20auto-upgrades.orig /etc/apt/apt.conf.d/20auto-upgrades
|
|||
|
|
sudo cp /etc/apt/apt.conf.d/50unattended-upgrades.orig /etc/apt/apt.conf.d/50unattended-upgrades
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Restart unattended-upgrades:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
sudo systemctl restart unattended-upgrades.service
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### 2. Re-enable Ubuntu’s default APT timers (important)
|
|||
|
|
|
|||
|
|
This script disables and masks Ubuntu’s automatic APT timers to ensure OPS-controlled scheduling.
|
|||
|
|
|
|||
|
|
To restore Ubuntu defaults:
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
sudo systemctl unmask apt-daily.service apt-daily-upgrade.service
|
|||
|
|
sudo systemctl enable --now apt-daily.timer apt-daily-upgrade.timer
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### 3. Remove the OPS-controlled cron job
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
sudo rm -f /etc/cron.d/updatesystem
|
|||
|
|
sudo systemctl restart cron.service
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### Important note about collisions
|
|||
|
|
|
|||
|
|
Do **not** run Ubuntu’s APT timers **and** this cron job at the same time.
|
|||
|
|
|
|||
|
|
Doing so may result in:
|
|||
|
|
- concurrent APT locks
|
|||
|
|
- unpredictable update timing
|
|||
|
|
- reboots outside approved maintenance windows
|
|||
|
|
|
|||
|
|
Choose **one scheduling mechanism only**.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Operational notes
|
|||
|
|
|
|||
|
|
- The script is silent on success
|
|||
|
|
- Invalid or missing arguments cause a hard failure
|
|||
|
|
- No defaults are assumed
|
|||
|
|
- All configuration is **authoritative**, not incremental
|
|||
|
|
|
|||
|
|
This is a **policy tool**, not a wizard.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### More Information
|
|||
|
|
|
|||
|
|
More guides and documentation can be found on [wiki.x-files.dk](https://wiki.x-files.dk)
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### License
|
|||
|
|
|
|||
|
|
Licensed under the MIT License.
|
|||
|
|
Licensed under the [MIT License](./LICENSE).
|
|||
|
|
|
|||
|
|
---
|