Automatic security updates on Debian squeeze server

Question

For a production Debian squeeze server, what are the best practices or recommendations for handling security updates? I have seen various articles on cron-apt, apticron, unattended-updates, apt cron jobs, etc. that download and/or install security updates as they are released.

It seems like there are two philosophies on this:

1. Download all security updates and notify with an email, and then have an admin come in and manually apply the updates.

2. Download and install all security updates as they are released, sending an email notification letting the admin know what packages were upgraded.

For these two cases, what is the recommended way to configure automatic security upgrades on a Debian server?

Answer 1

I prefer the first scenario. I personally use apticron on my system to notify me of new updates. Since I am online a lot during the day and evening I read these mails quite fast and I apply the updates myself. This for the reason that sometimes packets conflict, and I do not want to take any risk that my server goes down because of an automatic update.

But this is a personal view. It depends how much time you have to update your servers. Some people perfer automatic updating, and never have any trouble with it.

Answer 2

I went with the second scenario using unattended-upgrades using these instructions.

It's important to note the options available to you with unattended-upgrades. I only install security updates automatically, and if anything goes wrong during the updating process it halts and I get an e-mail about it.