Shell Script for Apt-Get Security Based Updates

I’ve been slowly working this script into a cheap method of notifying me of updates available for Linux instances (Ubuntu specific) instead of purchased product or managed solution. It’s not fancy, flashy, API driven, cloud hosted, OAuth authenticating, or any other buzzwords. It does work though…

#!/bin/bash

#-------------------------------------------------------------------------------------------------#
#- Name....: checkSecurityupdates.sh
#- Notes...:
#-------------------------------------------------------------------------------------------------#

# create fresh securities file each run
grep "-security" /etc/apt/sources.list | sudo grep -v "#" > /etc/apt/security.sources.list
echo "created security specific source list"


# Create the security file list
echo 'n' | apt-get upgrade -o Dir::Etc::SourceList=/etc/apt/security.sources.list >> /root/securities-to-update.txt
echo "created list of security updates"



# What's the mimetype
get_mimetype(){
  # warning: assumes that the passed file exists
  file --mime-type "$1" | sed 's/.*: //'
}


# some variables

from="SecUpdates-Report@example.com"
to="monitor-this-mailbox@example.com"
subject=`hostname`
boundary="ZZ_/afg6432dfgkl.94531q"
body="Please see attached"
declare -a attachments
attachments=( "securities-to-update.txt" )

# Build headers
{

printf '%s\n' "From: $from
To: $to
Subject: $subject
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary=\"$boundary\"

--${boundary}
Content-Type: text/plain; charset=\"US-ASCII\"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

$body
"

# now loop over the attachments, guess the type
# and produce the corresponding part, encoded base64
for file in "${attachments[@]}"; do

  [ ! -f "$file" ] && echo "Warning: attachment $file not found, skipping" >&2 && continue

  mimetype=$(get_mimetype "$file")

  printf '%s\n' "--${boundary}
Content-Type: $mimetype
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=\"$file\"
"

  base64 "$file"
  echo
done

# print last boundary with closing --
printf '%s\n' "--${boundary}--"

} | sendmail -t -oi   
echo "sent security updates list"



# cleanup security files
rm /etc/apt/security.sources.list
rm /root/securities-to-update.txt

Oracle Java Chef Recipe

There are a number of Java recipes out there that are quite good but I really had a need for a lightweight one with minimal fuss and for Ubuntu only. I would wrap this up as a solo cookbook but there really isn’t a point since it’s a grand total of 45 lines and requires 1 attribute defined. Check it out and see what you think.

#
# Cookbook Name:: opsworks
# Recipe:: jdk-install
#
# Author:: John Lawson
# Email:: jlawson@scriobha.im
#
#

log "...::: opsworks::jdk-install :::..."

# Install JDK repo
execute "apt-get install -y software-properties-common; add-apt-repository -y ppa:webupd8team/java;" do
    user "root"
    action :run
    not_if { ::File.exists?("/tmp/configured.jdk") }
end

# Update apt-get now that we have the JDK repo added
execute "apt-get update;" do
    user "root"
    action :run
    not_if { ::File.exists?("/tmp/configured.jdk") }
end

# Set our debconf settings for oracle license
execute "echo debconf shared/accepted-oracle-license-v1-1 select true | debconf-set-selections; echo debconf shared/accepted-oracle-license-v1-1 seen true | debconf-set-selections;" do
    user "root"
    action :run
    not_if { ::File.exists?("/tmp/configured.jdk") }
end

#- Install JDK version based on the jdk_version attribute from attributes/default.rb
if ! node['java']['jdk_version'].nil?
    execute "apt-get install -y oracle-java#{node['java']['jdk_version']}-installer;" do
        user "root"
        action :run
        not_if { ::File.exists?("/tmp/configured.jdk") }
    end
else
    log "!!!! No JDK Version set in attributes !!!!";
end

#- A Guard to ensure we only execute this once
file '/tmp/configured.jdk'

Vagrant AWS Template

This took me a bit to gather all the details together so I wanted to document this and maybe provide some usefulness to others. There are a number of plugins, features, configurations tricks that I’ve found extremely useful over the last several years for working with Vagrant and Chef. Below is a sample Vagrantfile that can be used as a template and is hopefully commented enough to be self explanatory. You’ll need the following plugins installed:

vagrant plugin install vagrant-berskhelf
vagrant plugin install vagrant-omnibus
vagrant plugin install vagrant-cachier
vagrant plugin install vagrant-vbguest
vagrant plugin install vagrant-hostmanager

Vagrant File:

#-----------------------------------------------------#
#- Project: vagrant-based
#- Author.: john.lawson@scriobha.im
#- Date...: 2015-03-16
#- Notes..: Base template should be usable with a dual scenario
#-----------------------------------------------------#

#- Defaults
VAGRANTFILE_API_VERSION = "2"

Vagrant.configure(VAGRANTFILE_API_VERSION) do |c|

    #- Caching section to speed local dev/usage don't remove! -#
    if Vagrant.has_plugin?("vagrant-cachier")
        #- Configure scope
        c.cache.scope = :box

        # Enable Apt cache
        c.cache.enable :apt

        # Disable this for actual development use as this will cause issues in file refresh
        #c.cache.enable_nfs = true
    end
    #- END Caching ------------------------------------------ -#

    #- Configure vagrant-hostmanager plugin ----------------- -#
    #- Use this for managing multiple instances, mimics
    #- AWS OpsWorks DNS by hostname functionality
    if Vagrant.has_plugin?("vagrant-hostmanager")
        c.hostmanager.enabled = true
        c.hostmanager.manage_host = true
        c.hostmanager.ignore_private_ip = false
        c.hostmanager.include_offline = true
    end

    #- Define our primary instance as app1
    c.vm.define "app1", primary: true do |app1|

        #- Instance Details
        app1.vm.box = "[name of instance here - this will be the name listed in Virtual Box GUI]"

        #- Pull down an Ubuntu 14.04 base box from Amazon
        app1.vm.box_url = "https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box"

        #- Set the hostname and alias (used in conjunction with the host manager plugin
        app1.vm.hostname = "dev-app1.local.vm"
        app1.hostmanager.aliases = %w(dev-app1.localdomain dev-app1)

        #- Network & Network Shares
        app1.vm.network(:forwarded_port, {:guest=>80, :host=>8001})
        app1.vm.network(:forwarded_port, {:guest=>443, :host=>8443})
        app1.vm.network(:private_network, {:ip=>"199.10.0.2"})
        app1.vm.synced_folder ".", "/vagrant", disabled: true

        #- Setup a mount point for Apache docroot (not in /var/www/) and we'll mount it later with Chef recipe
        app1.vm.synced_folder "~/vm-mounts/project-folder", "/mnt/app-www/", create: true, :nfs=> { :mount_options=> ['rw', 'vers=3', 'tcp', 'fsc'] }

        #- Instance Customizations
        app1.vm.provider :virtualbox do |p|
            p.name = app1.vm.box
            p.customize ["modifyvm", :id, "--memory", "1024"]
            p.customize ["modifyvm", :id, "--cpus", "1"]
        end

        #- Chef Solo Configurations & Details
        app1.berkshelf.enabled = true
        app1.omnibus.chef_version = '11.14.2'
        
        app1.vm.provision :chef_solo do |chef|
            chef.cookbooks_path = ['.']
            chef.add_recipe 'recipe[opsworks::_local_init]'
            chef.add_recipe 'recipe[opsworks::apache2]'
            chef.json = {
                #- used locally to mimic auto DNS resolution by hostname done by AWS OpsWorks
                opsworks: {
                    local_dev: true
                },
                # Mimic Hash provided by OpsWorks
                deploy: {
                    webapp: {
                        environment: {
                            #- 10.0.2.2 is most likely your host (this allows you to keep a central DB)
                            main_dbhost: "10.0.2.2",
                            main_dbname: "dbname",
                            totara_dbuser: "dbuser",
                            totara_dbpwd: "dbpwd"
                        }
                    }
                }
            }
        end
    end

    #- Define a secondary instance, could be used as NFS server, jobs server, other? Will not start unless you specifically call it
    c.vm.define "file1", autostart: false do |file1|
        #- Instance Details
        file1.vm.box = "[name of instance here - this will be the name listed in Virtual Box GUI]"

        #- Pull down an Ubuntu 14.04 base box from Amazon
        file1.vm.box_url = "https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_ubuntu-14.04_chef-provisionerless.box"

        #- Set the hostname and alias (used in conjunction with the host manager plugin
        file1.vm.hostname = "dev-file1.local.vm"

        #- Network & Network Shares
        file1.vm.network(:private_network, {:ip=>"199.10.0.4"})
        file1.vm.synced_folder ".", "/vagrant", disabled: true

        #- Instance Customizations
        file1.vm.provider :virtualbox do |p|
            p.customize ["modifyvm", :id, "--memory", "512"]
            p.customize ["modifyvm", :id, "--cpus", "1"]
        end
        file1.vm.provision :chef_solo do |chef|
            chef.cookbooks_path = ['.']
            chef.add_recipe 'recipe[opsworks::_local_init]'
            chef.add_recipe 'recipe[opsworks::nfs-config]'
            chef.json = {
                #- used locally to mimic auto DNS resolution by hostname done by AWS OpsWorks
                opsworks: {
                    local_dev: true
                }
            }
        end
    end
end