19

We have the unattended-upgrades package upgrading our servers with security upgrades every Monday and it works great. Today though, it upgraded all of our servers with a new version of PHP5. Because we have moved the default PHP5-FPM configuration file, apt complains that the file has been moved, and what would we like to do (Install new version, keep old version, show differences, start shell) about it. Since unattended-upgrades didn't know how to deal with this, it just aborted and we were left with dozens of machines down until PHP5-FPM was restarted by monitoring.

So the question is - How can we make sure unattended-upgrades can handle this situation when it happens next time? We'd like to keep our currently installed version always. I tried googling but came up empty.

8
  • It kind of shocks me that your distro has a package that encourages unattended upgrades. Whoever is your sysadmin should be attending to the upgrades so that such situations never happen. I am unfamiliar with the package, however, so I cannot offer much advice on working around having a responsible sysadmin.
    – HalosGhost
    Jun 23, 2014 at 16:34
  • 8
    The snide comment is unnecessary, don't you think? The package is very well known in the Debian community we use it on around 300 servers and have never had a problem until today. There is no reason to insult the administrator - You have no idea what policies, politics, and workloads he may be dealing with. THe package is configured to install only critical security updates, has NEVER had an issue, and worked great today as well, save for the fact that it didn't know what to do with that prompt. If you don't have anything to contribute except to insult the maintainer of the system, leave.
    – Kevin
    Jun 23, 2014 at 17:23
  • 4
    And the sysadmin is maintaining upgrades through the use of a well known, well maintained, debian endorsed upgrades package. Do you expect him to log in to each system individually and babysit the update each week? Across 300 servers? For this one client? That's ludicrous.
    – Kevin
    Jun 23, 2014 at 17:30
  • 3
    What if the changes are required? Like a config fix to a security issue. You don't want to silently changes like that.
    – Matt
    Jun 23, 2014 at 18:39
  • 2
    @HalosGhost Be shocked. Be awed. Automatic nightly security updates with unattended-upgrades are highly reliable, scalable and a great (human) time saver. In my matrix, I've got a greater risk of downtime or exploitation through a security flaw then I do from the very-rare possibility that the security update process itself will cause a problem (hasn't happened to me yet in using it 3+ years of using the process). Jun 8, 2018 at 14:30

1 Answer 1

26

I also want to keep original config files while doing automatic updates. You can add the following to /etc/apt/apt.conf.d/50unattended-upgrades

Dpkg::Options {
   "--force-confdef";
   "--force-confold";
};

See here for a good explanation of the options: http://raphaelhertzog.com/2010/09/21/debian-conffile-configuration-file-managed-by-dpkg/

3
  • 2
    Would that not potentially break packages? If an update introduces a new syntax, for example, but the configuration cannot be updated to the new syntax.
    – Rolf
    Mar 16, 2018 at 9:59
  • 3
    Be aware that this setting would not only apply to unattended-upgrades, but any operation that reads the configs in /etc/apt/apt.conf.d/. This may or may not be what you want. Mar 10, 2021 at 17:52
  • @Rolf: you are correct, that's a risk. Most people believe security intrusions are a greater risk on a -stable release. It's good that things are configurable. IMO being secure by default would be better than being insecure by default, but Debian currently disagrees. Breakage is why we have monitoring (I would rather fix a break than clean up after an intrusion). Apr 21 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.