1

We want to perform only critical security updates on our Ubuntu Systems. We found two effective ways for upgrading security systems

One is using the apt-get upgrade and then use grep to filter security packages

root@vagrant-ubuntu-trusty-64:/etc/apt# sudo apt-get upgrade -s| grep -i security | wc -l
0
root@vagrant-ubuntu-trusty-64:/etc/apt#

The other is using unattended upgrades

root@vagrant-ubuntu-trusty-64:/home/vagrant# sudo unattended-upgrade --dry-run -d 2> /dev/null | grep 'Checking' | awk '{ print $2 }' | wc -l
32
root@vagrant-ubuntu-trusty-64:/home/vagrant#

As you can see the both are showing different result for packages, what is the correct way to update the security packages ?

2

You can use apt-check, which is used to generate the messages in the motd,

/usr/lib/update-notifier/apt-check --human-readable
7 packages can be updated.
7 updates are security updates.
| improve this answer | |
0

Another command to see list:

apt list --upgradable | grep security

| improve this answer | |
0

Why unattended-updates is not (always) the correct way for this: It only does what is configured in /etc/apt/apt.conf.d/50unattended-upgrades. This should reflect security updates of the current distro.

Further it only upgrades packages, that don't need manual intervention.

And last it's not the fastest tool for checking if there are upgrades pending.

For Ubuntu the (already marked) answer from Iain is the best choice.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.