::Periodic::Download-Upgradeable-Packages "1"; APT::Periodic::AutocleanInterval "7"; APT::Periodic::Unattended-Upgrade "1"; Unattended-Upgrade::Mail "my_email@debian.cn"; // Automatically upgrade packages from these Unattended-Upgrade ::Package-Blacklist { // "vim"; // "libc6"; // "libc6-dev"; // "libc6-i686"; }; Unattended-Upgrade ::MailOnlyOnError "true"; Unattended-Upgrade::Automatic-Reboot "false"; 注意:如果您希望服务器在必要时重新启动,您可以将自动重新引导设置为 ,看看它是否正常工作: # unattended-upgrade -d Initial blacklisted packages: Initial whitelisted packages: Starting
50unattended-upgrades 将以下行取消注释(删除最前面的双斜杠 “//”),并将对应值改成true "${distro_id}:${distro_codename}-updates"; Unattended-Upgrade ::Mail"user@example.com"; Unattended-Upgrade::Remove-Unused-Kernel-Packages"true"; Unattended-Upgrade ::Remove-Unused-Dependencies"true"; Unattended-Upgrade::Automatic-Reboot"true"; 其中的Email地址改成自己的邮箱,这样在自动更新时候就会收到邮件通知 APT::Periodic::Download-Upgradeable-Packages"1"; APT::Periodic::AutocleanInterval"7"; APT::Periodic::Unattended-Upgrade "1"; 其中 Unattended-Upgrade 的1,表示每1天检查更新,也就是每天。
配置更新频率在 `/etc/apt/apt.conf.d/20auto-upgrades` 文件中,可以设置 `Unattended-Upgrade::Automatic-Reboot` 和 `Unattended-Upgrade ::Automatic-Reboot-Time` 来控制自动重启的行为:Unattended-Upgrade::Automatic-Reboot "true";Unattended-Upgrade::Automatic-Reboot-Time 配置自动重启你可以配置 `unattended-upgrades` 以在更新后不自动重启系统,或者在特定时间重启:Unattended-Upgrade::Automatic-Reboot "false" 配置邮件通知你可以设置 `unattended-upgrades` 发送邮件通知,以便在更新发生时获得通知:Unattended-Upgrade::Mail "your-email@example.com 配置更新日志你可以查看 `unattended-upgrades` 的日志,以了解哪些更新被应用:grep -i unattended-upgrade /var/log/syslog或者查看 `/var
::Periodic::Download-Upgradeable-Packages "1"; APT::Periodic::AutocleanInterval "7"; APT::Periodic::Unattended-Upgrade "1"; Unattended-Upgrade::Mail "**YOUR_EMAIL_HERE**"; // Automatically upgrade packages from these Unattended-Upgrade },label=Debian-Security"; }; // You can specify your own packages to NOT automatically upgrade here Unattended-Upgrade ::MailOnlyOnError "true"; Unattended-Upgrade::Automatic-Reboot "false"; 注意在最后一行,如果希望服务器在必要时重新启动,你可以将自动重新引导设置为 ,看看它是否正常工作 : # unattended-upgrade
从: //Unattended-Upgrade::Mail "root"; 修改为: Unattended-Upgrade::Mail "2daygeek@gmail.com"; 自动移除不用的依赖: 从: //Unattended-Upgrade::Remove-Unused-Dependencies "false"; 修改为: Unattended-Upgrade::Remove-Unused-Dependencies Unattended-Upgrade::Automatic-Reboot "true"; 启用特定时段的自动重启: 如果自动重启已启用,且你想要在特定时段进行重启,那么做出以下修改。 从: //Unattended-Upgrade::Automatic-Reboot-Time "02:00"; 到:取消注释并将时间改成你需要的时间。我将重启设置在早上 5 点。 Unattended-Upgrade::Automatic-Reboot-Time "05:00"; 如何启用自动化安全更新?
执行系统安全更新(或者所以包的更新),0 表示不执行该操作: APT::Periodic::Unattended-Upgrade "1"; 通过这些配置,我们可以控制自动更新的频率和行为。 unattended-upgrade 命令常见的用法之一是检查系统是否有更新: $ sudo unattended-upgrade --dry-run 另一种用法是安装更新: $ sudo unattended-upgrade 下面的配置在发生错误时给管理员发送邮件: Unattended-Upgrade::Mail "user@example.com"; Unattended-Upgrade::MailOnlyOnError 脚本同时调用了 apt-get 和 unattended-upgrade 等命令,所以相关的日志也分散在不同的地方。 apt-get 相关的日志在 /var/log/apt 目录下,unattended-upgrade 命令的日志在 /var/log/unattended-upgrades 目录下。
activate四、安全管理要求最小权限原则服务账户禁止使用root权限通过sudosudo细化权限分配更新维护策略定期执行安全更新:《Bash》sudo yum update --securitysudo unattended-upgrade
nano /etc/apt/apt.conf.d/20auto-upgrades把值改为0APT::Periodic::Update-Package-Lists "0";APT::Periodic::Unattended-Upgrade
unattended-upgrades dpkg-reconfigure unattended-upgrades # /etc/apt/apt.conf.d/50unattended-upgrades Unattended-Upgrade ::Allowed-Origins { "${distro_id}:${distro_codename}-security"; }; Unattended-Upgrade::Automatic-Reboot "false"; Unattended-Upgrade::Mail "admin@example.com"; 数据库,这块别马虎 MySQL 装完跑一下这个,按提示操作,能解决大部分默认配置的问题:
APT(Debian/Ubuntu)自动更新配置: 编辑 /etc/apt/apt.conf.d/50unattended-upgrades 文件,启用自动安全更新:Plaintext复制Unattended-Upgrade
APT(Debian/Ubuntu)自动更新配置: 编辑 /etc/apt/apt.conf.d/50unattended-upgrades 文件,启用自动安全更新:Unattended-Upgrade
$ sudo nano /etc/apt/apt.conf.d/50unattended-upgrades # 大约在21行 Unattended-Upgrade::Package-Blacklist
name: 设置自动更新配置 copy: content: | APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades # 关键配置项(示例配置节选,按需修改),生产服务器建议仅启用安全更新(-security): Unattended-Upgrade
配置软件包更新echoecho "1.2 软件包管理"if [ -f /etc/apt/apt.conf.d/50unattended-upgrades ]; then if grep -q "Unattended-Upgrade