Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want my server to notify me about pending security updates. But I don't want to get notifications about all available updates. How can I do this?

share|improve this question
add comment

2 Answers

To answer my own question: I wrote a small ruby script, which scans the text file than is shown on login containing the security update info: 5 updates are security updates

It can even log into other machines via ssh and check that machine as well for security updates. A ssh key without passphrase is required, though. Would be a good idea to limit the rights of that user as much as possible.

It's written as simple as possible, so even without ruby knowledge it should be understandable.

#!/usr/bin/env ruby
# (c) 2013, Johannes Barre, igel@igels.net
# License: MIT

update_file = '/var/lib/update-notifier/updates-available'
conf = {
  mail_to: 'obama@whitehouse.gov',
  servers: {
    name: :localhost, # name -> Server name for the mail
    other_server: 'updatecheck@other-server.com', # log in to other-server.com using user updatecheck
    third_server: 'updatecheck@third-server.com'
  }
}

def get_security_updates(str)
  str[/([0-9]+) updates are security updates/, 1].to_i
end

out = {}
conf[:servers].each do |name, host|
  if host == :localhost
    out[name] = get_security_updates(File.read(update_file))
  else
    out[name] = get_security_updates(`ssh #{host} 'cat #{update_file}'`)
  end
end

out.delete_if { |_, v| v == 0 }
unless out.empty?
  IO.popen(%|mail #{conf[:mail_to]} -s "Security updates pending"|, 'r+') { |io| io.print out.map { |host, updates| "#{host} has #{updates} security updates pending" }.join("\n") + "\n" }
end

Set up a cron job to run once per day. I run this script now for several months and it's working fine. If Debian shows the same login message, it should work for Debian systems as well.

Not this is written for Ruby 1.9. I recommend upgrading, as there are no security updates for 1.8 anymore, but it should run if you change the Hash syntax back to the old style (:key => 'value' instead of key: 'value')

share|improve this answer
    
Under Debian you can use debsecan, unfortunately it's useless under Ubuntu. –  zorlem Apr 3 '13 at 9:05
add comment

Similar solution as sh script

#!/bin/sh

FLAG=/tmp/updates_available.flag
UPDATEFILE=/var/lib/update-notifier/updates-available
if [ ! -f ${FLAG} ] 
then 
  touch ${FLAG}
fi

diff ${FLAG} ${UPDATEFILE} > /dev/null
if [ $? -eq 1 ]; then
  COUNT=`grep -c "0 updates are security updates" ${UPDATEFILE}`
  if [ ${COUNT} -eq 0 ]; then
    sendmessage "`hostname`: `cat ${UPDATEFILE}`" # choose how to send message
  fi
  cp ${UPDATEFILE} ${FLAG}
fi
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.