freedomofpress/securedrop — pull request #717 by dolanjs (2014-11-03 08:44:57+00:00)
Title: Cron apt

Due to issues with getting unattended-upgrades to upgrade the securedrop packages changed the playbook to use the cron-apt instead of unattended-upgrades. [1] Cron-apt is configured to use a separate source.list file called `security.list`. Any updates to packages published to the repos contained in security.list will be installed at 4am daily. If a reboot is required it will occur at 5am.

Swapoff -a was also re-added to the common role's tasks.

## cron-apt details

The ubuntu security repos, fpf and tor main repo's are listed in `/etc/apt/security.list`

Every night at 4am the apt-get update for the repos listed in `security.list`

If a package requires a reboot it creates the /var/run/reboot-required file.

Every night at 5 am if that file exists the system will reboot.

Scheduling the upgrdes is done in `/etc/cron.d/cron-apt`. To test after running the playbook you can change the frequency that the commands run to once every 5 minutes so that you are not waiting around for the specific time of day.

The log file that ossec monitors for the monitor server and app server was changed from the unattended-upgrades log to cron-apt log.

[1] https://help.ubuntu.com/community/AutomaticSecurityUpdates