Auto-update: Good idea for servers?

esasse · 12-02-2004, 04:44 AM

Is it a good idea to setup an auto update process, like running apt-get or yum every night to download and install updated packages in a server?

Crashed_Again · 12-02-2004, 05:05 AM

I would say no. On both my gentoo servers I have a script that checks for available updates and emails me the results daily. I only update packages if an exploit has been found in them. Otherwise I leave it.

In my opinion, the actual updating of packages should be done under the admin's supervision and not by some script.

Caysho · 12-02-2004, 05:10 AM

I second this.
You don't know what the update could potentially break, and if it's a heavy use server, and it does break, you can be a world of hurt if it's automated.

esasse · 12-02-2004, 09:14 AM

Thanks! Could you share your script that emails you with updates?

What's the best way to know if an update is important and if I should install it?
Check websites of every package?

Crashed_Again · 12-02-2004, 01:23 PM

Well the script is written for Gentoo but I'm sure you could replace the 'emerge sync' stuff with apt-get commands to get the same effect.

Code:

#!/usr/bin/perl -w

$date = `date`;
$hostname = `hostname`;
$text_file = "/root/email.txt";
$chk_file = "/root/chkrootkit_results.txt";

# CHKROOTKIT SECTION
system("echo 'Chkrootkit Results:\n' > $text_file");
system("chkrootkit > $chk_file");

open(CHK_IN, $chk_file);
while(<CHK_IN>) {
   push(@infected,$_) if (/INFECTED/);
}
close  CHK_IN;

if (@infected) {
   system("echo 'INFECTED LINES FOUND!\n\n' >> $text_file");
   system("echo '$_\n' >> $text_file") for @infected;
}
else {
   system("echo 'Nothing infected.\n' >> $text_file");
}

# SYNC TO CURRENT PORTAGE TREE
system("emerge sync > /dev/null 2> /dev/null");

# CHECK FOR AVAILABLE UPDATES
system("echo '\nAvailable Package Updates:\n' >> $text_file");
system("emerge -up world | grep ebuild >> $text_file");

# RUN GLSA-CHECK TO SEE IF ANY SECURITY UPDATES ARE AVAILABLE
system("echo '\nGlsa-Check Results:\n' >> $text_file");
system("glsa-check -ln 2> /dev/null >> $text_file");

# E-MAIL RESULTS
system("cat $text_file | mail -s \"Security Report For $hostname On $date\" security\@localhost");

# CLEAN UP TEMPORARY TEXT FILES
system("rm -f $text_file");
system("rm -f $chk_file");

# TO DO LIST
# ADD SUPPORT TO PARSE LOG FILES FOR DAILY LOGINS AND DAILY FAILED LOGINS VIA METALOG

By the way, I'm no perl expert as you can see.