Home / server / Questions / 914830
In Process
Buno
Asked: 2018-06-02 12:35:42 +0800 CST

unattended-upgrades doesn't find any upgrade despite correct Allowed Origins

  • 772

I'm running a server under Ubuntu 16.04 and am trying to find a way to manually launch all the available security upgrades when I want to. I found numerous posts about unattended-upgrades, however it doesn't seem to give me any upgrades available..

When I try to get the upgrades, I get:

ubuntu@server:~$ sudo unattended-upgrades --download-only -v -d
Allowed origins are: ['o=Ubuntu,a=xenial', 'o=Ubuntu,a=xenial-security', 'o=Ubuntu,a=xenial-security', 'o=UbuntuESM,a=xenial']
pkgs that look like they should be upgraded:
Fetched 0 B in 0s (0 B/s)
fetch.run() result: 0

Yet, if do seem to have pending security upgrades :

ubuntu@server:~$ apt-show-versions | grep upgradeable | grep security
isc-dhcp-client:amd64/xenial-security 4.3.3-5ubuntu12.9 upgradeable to 4.3.3-5ubuntu12.10
isc-dhcp-common:amd64/xenial-security 4.3.3-5ubuntu12.9 upgradeable to 4.3.3-5ubuntu12.10
libgcrypt20:amd64/xenial-security 1.6.5-2ubuntu0.3 upgradeable to 1.6.5-2ubuntu0.4
libgd3:amd64/xenial-security 2.1.1-4ubuntu0.16.04.8 upgradeable to 2.2.5-4+ubuntu16.04.1+deb.sury.org+2

etc...

The allowed origins include "xenial-security" so I don't understand why U-U finds nothing..

If you have a clue I'd be grateful...

ubuntu

1 Answers

  1. I was unable to reproduce this in dev environment using the following AutomaticSecurityUpdates documentation.

    REPO STEPS: 

    dev-user@ubuntu-security-update:~$ sudo dpkg-reconfigure --priority=low unattended-upgrades

    Under the interactive dialog you will see a message similar to this:

    Configuring unattended-upgrades

    Applying updates on a frequent basis is an important part of keeping systems secure. By default, updates need to be applied manually using package management tools. Alternatively, you can choose to have this system automatically download and install important updates.

    Automatically download and install stable updates?

    Select Yes and "enter" then you will see another page with the following content.

    Configuring unattended-upgrades

    Please specify a value for the unattended-upgrades Origins-Pattern.
    A package will be upgraded only if its metadata values match all the supplied keywords in the origin line. Origins-Pattern that packages must match to be upgraded: 

    "origin=Debian,codename=${distro_codename},label=Debian-Security";

    Choose "OK" and that will create /etc/apt/apt.conf.d/20auto-upgrades with the following contents:

    APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

    Details about what these values mean may be found in the header of the /etc/cron.daily/apt file. See the Ubuntu Community doc for more details on this.

    --download-only -v -d output

    dev-user@ubuntu-security-update:~$ sudo unattended-upgrades --download-only -v -d
Initial blacklisted packages: 
Initial whitelisted packages: 
Starting unattended upgrades script
Allowed origins are: ['o=Ubuntu,a=xenial', 'o=Ubuntu,a=xenial-security', 'o=UbuntuESM,a=xenial']
adjusting candidate version: 'cloud-guest-utils=0.27-0ubuntu24'
adjusting candidate version: 'cloud-init=0.7.7~bzr1212-0ubuntu1'
adjusting candidate version: 'grub-common=2.02~beta2-36ubuntu3'
adjusting candidate version: 'grub-pc=2.02~beta2-36ubuntu3'
adjusting candidate version: 'grub-pc-bin=2.02~beta2-36ubuntu3'
adjusting candidate version: 'grub2-common=2.02~beta2-36ubuntu3'
adjusting candidate version: 'ifupdown=0.8.10ubuntu1'
adjusting candidate version: 'libplymouth4=0.9.2-3ubuntu13'
adjusting candidate version: 'open-vm-tools=2:10.0.7-3227872-2ubuntu1'
adjusting candidate version: 'plymouth=0.9.2-3ubuntu13'
adjusting candidate version: 'plymouth-theme-ubuntu-text=0.9.2-3ubuntu13'
adjusting candidate version: 'python3-update-manager=1:16.04.12'
adjusting candidate version: 'snapd=2.0.2'
adjusting candidate version: 'ubuntu-core-launcher=1.0.27.1'
adjusting candidate version: 'update-manager-core=1:16.04.12'

    You can then use cron-apt to handle automatic updating

    • 0