How to notify about security updates only on Ubuntu (per mail)?

Question

I want my server to notify me about pending security updates. But I don't want to get notifications about all available updates. How can I do this?

Answer 1

To answer my own question: I wrote a small ruby script, which scans the text file than is shown on login containing the security update info: 5 updates are security updates

It can even log into other machines via ssh and check that machine as well for security updates. A ssh key without passphrase is required, though. Would be a good idea to limit the rights of that user as much as possible.

It's written as simple as possible, so even without ruby knowledge it should be understandable.

#!/usr/bin/env ruby
# (c) 2013, Johannes Barre, [email protected]
# License: MIT

update_file = '/var/lib/update-notifier/updates-available'
conf = {
  mail_to: '[email protected]',
  servers: {
    name: :localhost, # name -> Server name for the mail
    other_server: '[email protected]', # log in to other-server.com using user updatecheck
    third_server: '[email protected]'
  }
}

def get_security_updates(str)
  str[/([0-9]+) updates are security updates/, 1].to_i
end

out = {}
conf[:servers].each do |name, host|
  if host == :localhost
    out[name] = get_security_updates(File.read(update_file))
  else
    out[name] = get_security_updates(`ssh #{host} 'cat #{update_file}'`)
  end
end

out.delete_if { |_, v| v == 0 }
unless out.empty?
  IO.popen(%|mail #{conf[:mail_to]} -s "Security updates pending"|, 'r+') { |io| io.print out.map { |host, updates| "#{host} has #{updates} security updates pending" }.join("\n") + "\n" }
end

Set up a cron job to run once per day. I run this script now for several months and it's working fine. If Debian shows the same login message, it should work for Debian systems as well.

Not this is written for Ruby 1.9. I recommend upgrading, as there are no security updates for 1.8 anymore, but it should run if you change the Hash syntax back to the old style (:key => 'value' instead of key: 'value')

Answer 2

Similar solution as sh script

#!/bin/sh

FLAG=/tmp/updates_available.flag
UPDATEFILE=/var/lib/update-notifier/updates-available
if [ ! -f ${FLAG} ] 
then 
  touch ${FLAG}
fi

diff ${FLAG} ${UPDATEFILE} > /dev/null
if [ $? -eq 1 ]; then
  COUNT=`grep -c "0 updates are security updates" ${UPDATEFILE}`
  if [ ${COUNT} -eq 0 ]; then
    sendmessage "`hostname`: `cat ${UPDATEFILE}`" # choose how to send message
  fi
  cp ${UPDATEFILE} ${FLAG}
fi