Redoing auto-updates to reduce email

I've gotten a little tired about the amount of email I receive daily from my automatic daily package updates, particularly now that I've installed logwatch, which provides me with much of the same information.

I have two types of machines that I want to update:

1. Virtual machines that I just want to auto update and I don't want to hear about it unless there is an error. Yes, I understand I risk configuration problems, but so far this hasn't been a problem so I'm happy living on the edge.


2. My key server and my laptop. On these machines I do the conservative download the packages and once a week, on the weekend, I sit down and manually install them. (If some critical security update occurs, I assume I will hear about it via other channels and jump in manually).
   

On all systems: make cron-apt quiet
I started by editing cron-apt configuration on all my systems and configuring it so it only sends email on errors by changing the MAILON value to "error":

# vi /etc/cron-apt/config
# grep ^MAILON /etc/cron-apt/config
MAILON="error"

Key Server and Laptop
Then I turned to my server system and laptop. I want to run cron-apt daily and then once per week send me a reminder to update (assuming there is something to update, which generally there is). I could just run cron-apt weekly, but this way if there is a critical security update, it will already be downloaded and I just have to install it.

To run cron-apt dailly, I add it to /etc/cron.daily:

# ln -s /usr/sbin/cron-apt /etc/cron.daily/

Then I created the following script to send me a weekly reminder me to install the upgrades (based on the script from this page):

# vi /etc/cron.weekly/show-upgrades
# chmod +x show-upgrades

And here is the script:

#!/bin/sh
tmpFile=`mktemp`
apt-get --simulate dist-upgrade > $tmpFile 2>&1
if test $? -ne 0 ; then
   echo "Error running apt-get --simulate dist-upgrade:"
   cat $tmpFile
   rm -f $tmpFile
   exit 1
fi
grep Inst $tmpFile > /dev/null
if test $? -eq 0; then
   echo "Upgrades are pending. Run 'apt-get dist-upgrade' to install."
   grep Inst $tmpFile
   echo
   echo "Full output:"
   cat $tmpFile
fi
rm -f $tmpFile
exit 0

Virtual Machines
Now, turning to my virtual machines. What I wanted here was automatically daily upgrade of all new packages with no output unless there was an error. This involved editing to the auto-update script I had created previously:

# vi /etc/cron.daily/auto-update

Here is the script:

#!/bin/bash
/usr/sbin/cron-apt
tmpFile=`mktemp`
/usr/bin/apt-get -y dist-upgrade > $tmpFile 2>&1
if test $? -ne 0 ; then
     echo "Error doing '/usr/bin/apt-get -y dist-upgrade':"
     cat $tmpFile
fi
rm -f $tmpFile

Using cronic to reduce "cram" (cron spam)

I'm working on reducing the about of email I'm getting from my cron jobs. One thing I stumbled across is cronic. I used it as following to quiet my cron jobs.

First, to install it:

# wget -O /usr/local/bin/cronic http://habilis.net/cronic/cronic
...
# chmod 755 /usr/local/bin/cronic

Now to use it, edit your cron scripts to use cronic as a wrapper. Before:

# cat /etc/cron.daily/backup-web-server
#!/bin/sh
/usr/local/bin/backup-web-server.py /etc/backup-web-server.conf

And after:

# vi /etc/cron.daily/backup-webserver
# cat /etc/cron.daily/backup-web-server
#!/bin/sh
/usr/local/bin/cronic /usr/local/bin/backup-web-server.py /etc/backup-web-server.conf

That's it. Now unless your cron job either has output to stderr or returns non-zero, it will produce no output.

Cron-apt and reboot needed...

I've noticed that when cron-apt upgrades the kernel and I don't get around to rebooting the system that day, it will keep "reinstalling" the new kernel each night it runs until I reboot the system.

Not sure what to do about this at the moment. Guess it doesn't really hurt anything. Since there doesn't seem to be any way of automatically detecting if a reboot is needed, the only option would seem to be always reboot nightly.

Going to think about this for a while. If anyone has any suggestions, please comment away.

sbackup without GUI

I recently wanted to install and run sbackup without using the GUI interface (this was on my mythbuntu system and I didn't want to interrupt my show). Not that the sbackup package unfortunately requires X11 and Gnome, so you can't use it on a lean server system.

Start by installing it:

# apt-get install sbackup

The configuration is in /etc/sbackup.conf, edit this file. Basically you want to set your target and then under [dirconfig] set what paths you want backed up.

# cp /etc/sbackup.conf /etc/sbackup.conf.orig
# vi /etc/sbackup.conf
# diff /etc/sbackup.conf.orig /etc/sbackup.conf
8,9c8,9
< target=/var/backup
< #target=ssh://user:pass@example.com/home/user/backup/
---
> #target=/var/backup
> target=ssh://casey-backup@file-server/mnt/backups/casey
37,38c37,38
< /usr/local/=1
< /var/=1
---
> /usr/local/=0
> /var/=0

You can test your configuration by running /usr/sbin/sbackupd (this returns nothing for me, which apparently indicates success):

# /usr/sbin/sbackupd

Now install a cron job to run it (this one runs it every night at 12:30):

# cat /etc/cron.d/sbackup
30 12 * * * root test -x /usr/sbin/sbackupd && /usr/sbin/sbackupd

Auto-updates under mythbuntu

Seems like mythbuntu doesn't install any sort of auto-update process, so I did the following to set one up.

First, I installed cron-apt:

# apt-get install cron-apt

Then, I created the following cron job:

# crontab -e
# crontab -l | tail -1
0 1 * * * /usr/bin/cron-apt && /usr/bin/apt-get -y dist-upgrade

mythtv-status missing config errors

The following cron job, running as root, kept emailing me output complaining about "No config found":

[ -x /etc/init.d/mythtv-status ] && /etc/init.d/mythtv-status reload > /dev/null

Replicating it from the commandline worked:

# mythtv-status > /dev/null
No config found; attempting to find mythbackend via UPnP.

After playing around a bit, I figured out it was coming from the MythTV Perl module:

# perl -e "require MythTV"
No config found; attempting to find mythbackend via UPnP.
No backends found. Please copy /root/.mythtv/config.xml from a working MythTV installation instead.
Compilation failed in require at -e line 1.

Copying ~/.mythtv/config.xml from the mythtv account to the root account solved the problem.

Locking, but not expiring, root

I don't want to allow direct root login (not just via ssh as described here but via console or any other way. Basically I want to make it so everything has to go through sudo. (Why? Because I like the fact everything is traceable back to given user.)

I had previously tried using 'passwd -l' as root to lock that account, but that seems to have the unwanted side effect of causing root's cron jobs to fail, as I see the following message in syslog whenever a roon cron job comes time to run:

CRON[11591]: User account has expired

The solution I found is as follows. Before you do this you want to make sure you have the ability to do things as root via sudo, or you will lock yourself out (see here for directions on this).

First, I undid what I did before and unlock the account (skip this if you didn't previously lock the root account):

# passwd -u root
Password changed.

Then edit /etc/shadow by hand and change root's password field to "!", e.g.:

# grep root /etc/shadow
root:!:14145:0:99999:7::1:

Just to make sure test the setup by running 'ssh -l root localhost' and try logging in. You shouldn't be able to.

Fixing the auto-updating

A while ago I set up automatic updating of patches. Well, today I took a look and it didn't look like things were working (running 'apt-get dist-upgrade' produced a big, long list of stuff that needed to be installed).

I added "-y" to the "apt-get" command in /etc/cron.daily and that seemed to fix things:

# vi /etc/cron.daily/auto-update
# cat /etc/cron.daily/auto-update
#!/bin/bash
/usr/sbin/cron-apt
/usr/bin/apt-get -y dist-upgrade

Updated mythfilldatabase cron job

Based on this post I changed my crontab entry to:

0 6 * * * /usr/bin/mythfilldatabase --refresh-all --quiet

Updating Guide information

I let my zap2it subscription lapse and then my MythTV PC was off for a few days (power glitch while I was traveling) and I noticed that it was completely out of guide information. So I started by renewing my zap2it subscription (and noticed that after September 29th, another source would need to be found for guide information).

But still I wasn't getting new guide information after a couple days, so I wondered how to manually pull down new guide information. Poking around the net I found this link which gave the following command:

/usr/bin/mythfilldatabase --no-delete

Which I went ahead and added to the mythv crontab:

crontab -u mythtv -e
0 6 * * * /usr/bin/mythfilldatabase --no-delete --quiet