One of the main reasons for building this device, it to make sure the software is updated (patched) regularly. I have a multifaceted strategy to do that.
Before we go further, it is a good time to decide if you want XWindows (or simply X) on your firewall. X makes, using the machine and configuring it more friendly. Just like anything else though, the more software you have installed, the more software can be exploited. If you wish to remove X and all its components it is easiest to run the following at the command line, then get a cup of coffee, this will take a while.
sudo apt-get purge libx11.* libqt.* libgd3 -yIf this fails because libgd3 isn’t installed repeat the command without it.
If you choose to keep X, it is helpful to be able to get to it remotely, you can do this via the Microsoft Remote Desktop Protocol, or VNC by adding a single package. To install this package, “xrdp”, run the following command
sudo apt-get install xrdp -yNow lets update all the software on the machine. Updating the software on an Ubuntu or Debian machine is really easy.
Make sure your machine is connected to the internet. Get to a command line, like the console, via SSH, or using something like xterm or terminal. Then type the following command and hit enter, then put in your password, so you get root access.
sudo apt-get update;sudo apt-get dist-upgrade -y;sudo -y --purge autoremove;sudo rebootSo lets explain this a little bit. The semicolons separate the commands. In Debian based systems, apt-get is the basic command to work with software packages. There is a huge library of available software available for free, and like the Google Play store, they are able to be installed, removed, and updated using this command, or one of the many wrappers over it.
apt-get updateUpdates the local copy of what is available, and versions.
apt-get dist-upgrade -y“dist-upgrade” tells apt-get to install all software updates, and the “-y” says, “just answer yes”.
apt-get -y --purge autoremove
“autoremove” tells apt-get to remove all software packages that are no longer needed. “-y” again means answer yes “–purge” says to remove all associated config files, leaving the system squeaky clean.
sudo reboot
For the most part, this isn’t necessary, only a kernel upgrade truly requires a reboot.
But what about automating the updates, so they happen in timely basis, it is a pain to login every day, run these commands, and reboot if necessary. There is a package in Debian systems that will automatically install all security updates called “unattended-upgrades”, so lets install it. Go to the command line again, and install the package by typing the following command.
sudo apt-get install unattended-upgrades -y
Hopefully, you will get a message that says it is already installed, then, use the following command to configure the package to automatically install all the updates, with this command
sudo dpkg-reconfigure -plow unattended-upgradesHowever, this will neither reboot the machine when an updates requires it, nor will it remove unused packages, nor will it install non-security updates. Also, “autoremove” isn’t terribly efficient at removing unneeded software packages.
There is a package called “deborphan”, it will find unused packages, and can be used in combination with apt-get to help keep things clean. The following command, will show you all software packages that don’t really need to be installed, we will make more use of this in a moment.
deborphan --guess-all
So lets make some scripts to help keep things clean. Lets start with removing old kernels. Old kernels can take up a huge amount of space. However, we do not want to remove the kernel we are using, so borrowing from another page as a starting point, we get the following command. I did add the “grep -v `uname -r`” because the original command did have a problem of removing ALL kernels from the system (which is a great reason to have the backup OS installed on the eMMC). If you are not familiar with Unix editors like emacs, vim or vi, I suggest you use nano to create follow files. This first file will be “remove-old-kernels.sh”. To create it using nano, use the following command:
sudo nano /bin/remove-old-kernels.sh
then copy the following text into the file.
dpkg -l 'linux-image-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d' | grep -v `uname -r` | xargs sudo apt-get -y purgeA short explanation of the above command, is as follows. The “dpkg -l” portion lists all installed kernels. The two “sed” pipes grab the linux kernel versions from the installed list. The “grep -v” returns the list of installed kernels EXCEPT the one that is currently being used. “xargs” turns it all into an argument list, and finally “apt-get -y purge” removes everything in that argument list.
So our first cleanup script will be called “remove-old-kernels.sh” and, for lack of a better place, we will put it in the “/bin/” folder.
dpkg -l 'linux-image-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d' | grep -v `uname -r` | xargs sudo apt-get -y purge"
next we need to make our autoupdate.sh script, so create it like you did the remove-old-kernels.sh script
sudo nano /bin/autoupdate.shand again copy the code
apt-get update
apt-get dist-upgrade -y
apt-get autoremove -y --purge
apt-get autoclean
apt-get purge -y $(deborphan --guess-all)
Lastly, we need a script to run the first two, then reboot, we will call it ‘autoupdate-and-reboot.sh’.
sudo nano /bin/autoupdate-and-reboot.shhere is the code
/bin/remove-old-kernels.sh
/bin/autoupdate.sh
/sbin/reboot
Now, we have three scripts that can be used to keep the system squeaky clean, and updated. Of course, none of these neat little scripts will work until we tell linux that they should be able to be executed. So enter the following command which will do just that.
sudo chmod +x /bin/*.shYes, you could list out the files individually, but since there shouldn’t be any other .sh files in the freshly built machine, I am not worried about accidentally making a rogue script executable.
You can now run the “autoupdate-and-reboot.sh” script anytime you like, to update all the software, and reboot the machine. Or add it to a cron job, to make sure it is kept up-to-date.