Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want my server to notify me about pending security updates. But I don't want to get notifications about all available updates. How can I do this?

share|improve this question

To answer my own question: I wrote a small ruby script, which scans the text file than is shown on login containing the security update info: 5 updates are security updates

It can even log into other machines via ssh and check that machine as well for security updates. A ssh key without passphrase is required, though. Would be a good idea to limit the rights of that user as much as possible.

It's written as simple as possible, so even without ruby knowledge it should be understandable.

#!/usr/bin/env ruby
# (c) 2013, Johannes Barre,
# License: MIT

update_file = '/var/lib/update-notifier/updates-available'
conf = {
  mail_to: '',
  servers: {
    name: :localhost, # name -> Server name for the mail
    other_server: '', # log in to using user updatecheck
    third_server: ''

def get_security_updates(str)
  str[/([0-9]+) updates are security updates/, 1].to_i

out = {}
conf[:servers].each do |name, host|
  if host == :localhost
    out[name] = get_security_updates(
    out[name] = get_security_updates(`ssh #{host} 'cat #{update_file}'`)

out.delete_if { |_, v| v == 0 }
unless out.empty?
  IO.popen(%|mail #{conf[:mail_to]} -s "Security updates pending"|, 'r+') { |io| io.print { |host, updates| "#{host} has #{updates} security updates pending" }.join("\n") + "\n" }

Set up a cron job to run once per day. I run this script now for several months and it's working fine. If Debian shows the same login message, it should work for Debian systems as well.

Not this is written for Ruby 1.9. I recommend upgrading, as there are no security updates for 1.8 anymore, but it should run if you change the Hash syntax back to the old style (:key => 'value' instead of key: 'value')

share|improve this answer
Under Debian you can use debsecan, unfortunately it's useless under Ubuntu. – zorlem Apr 3 '13 at 9:05

Similar solution as sh script


if [ ! -f ${FLAG} ] 
  touch ${FLAG}

diff ${FLAG} ${UPDATEFILE} > /dev/null
if [ $? -eq 1 ]; then
  COUNT=`grep -c "0 updates are security updates" ${UPDATEFILE}`
  if [ ${COUNT} -eq 0 ]; then
    sendmessage "`hostname`: `cat ${UPDATEFILE}`" # choose how to send message
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.