Automatic security updates in Debian XFCE

[Post updated to reflect the fact that Unattended Upgrades will by default update all packages and not just security packages as of Debian Buster and later.]

Linux Mint has recently found that a lot of its users don't apply updates, according to The Register.  Why? "The idea of leaving something alone if it works seems attractive", suggests the article. The article also points out that some updates fix security vulnerabilities that "can be used to run attacker code and install software, requiring no user interaction beyond normal browsing." 

The Linux Mint Blog has a post on the importance of applying security updates, especially in web browsers like Firefox.

It is true that updates can cause problems. One option is for the system administrator to keep an eye on available security updates, research any potential issues, and monitor the system for any issues after installation.

Another option is to have your computer automatically apply security updates. This has been the default in Gnome on Debian since Debian 9 (Stretch).

This is the approach I have always taken, and in over ten years of using Debian, I have never noticed a security update cause a problem.

Firefox would occasionally update itself in the background and tell me that it needed to be restarted, and of course other security updates would be applied automatically too. I believe the default behaviour is for a Gnome notification of updates available to appear, before the updates are applied automatically. This is the behaviour I have observed anyway: there's sometimes a notification of updates available, then later on when you check the Gnome software centre reports the system is up to date. Other times the available updates remain until you take action to install them using APT, Synaptic or the Gnome software centre itself.

However, after a fresh install of Debian Bullseye with XFCE, I found that the system didn't do updates at all: not even notifications of available updates, let alone automatic installation.

In two previous posts I detailed two steps to take:

• Enable automatic package list update so the system is aware of available updates.
• Enable update notifications so the user is aware that updates are available. 

In this post I am going to describe how to enable installation of security updates.

The short answer is to install unattended-upgrades from the Debian repository, which will enable automatic package list update and automatically install security updates by default.

But what does it do?

As described in the first of the two posts above, on Debian Systemd runs a system scheduler which contains a timer called apt-daily.timer. By default it doesnt do anything, but installing apt-config-auto-update configures APT to check for updates when triggered by the timer.

unattended-upgrades installs a configuration file that tells APT to check for updates and automatically install security updates.

This file is 20auto-upgrades found in /etc/apt/apt.conf.d/.

The default contents are:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1"; 

unattended-upgrades also installs another configuration file called 50unattended-upgrades which tells APT what to update.

Unattended-Upgrade::Origins-Pattern {

//      "origin=Debian,codename=${distro_codename}-updates";
//      "origin=Debian,codename=${distro_codename}-proposed-updates";
        "origin=Debian,codename=${distro_codename},label=Debian";
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

The default is to apply security [stable] updates (whatever the Debian version), but it's also possible automatically install other updates by uncommenting the applicable lines.

Just be sure to have the Debian security repository enabled in the Debian sources list and don't worry about missing security updates again!

 

Notes: 

1) I believe the file 10periodic installed by apt-config-auto-update overrides 20auto-upgrades installed by unattended-upgrades.

2) You can add lines to 20auto-upgrades, for example  

APT::Periodic::AutocleanInterval "7";

to clean up APT's cache every week.

3) The Debian Unattended Upgrades page contains information about how to be notified or view logs of updates applied.

Edit: The default for Unattended Upgrades was changed in Debian Buster, and now allows "stable" updates. The Debian Wiki says that Unattended Upgrades installs "security (and other)" updates, which to me implies that "other" is optional, but I found a note in the "News" file (found in /usr/share/doc/unattended-upgrades) which states:

Unattended-upgrades in previous versions defaulted to install security updates only on Debian by using the label=Debian-Security origin pattern. Now it is changed to allow updates with label=Debian, which allows applying stable updates in stable releases and following all package updates in testing and unstable. 

In stable releases this unlocks installation of security updates depending on package versions present only in stable updates.

I am not entirely sure what the last paragraph means, but I will observe my Buster system to see what it is doing. On my Bullseye computer, (currently Testing), the default install of Unattended Upgrades is definitely installing all package updates automatically. 

Update: on Buster I have observed that the default setting installs security updates automatically, but point updates have to be installed manually.

 

 

 

 

A simple weather notification for the XFCE panel

[Update: New & Improved version available.]

This is a very minimalistic weather applet for the XFCE panel using data from OpenWeather via ansiweather, a terminal shell script.  The applet uses the XFCE Genmon plugin to run a simple script. XFCE does have a weather plugin for the panel, but this is a)much simpler and b)an excuse to play with writing scripts.

A bit chilly this morning, as you can see. (The orange icon, in case you wondered, is my previous adventure in scripting, an update notification for the XFCE panel.)

The tooltip shows a five day forecast. Clicking on the temperature in the panel can refresh the data, open a terminal to view the source data in a terminal, or go to the OpenWeather web page for your town where you can see an eight day forecast.

To use the applet:

1. install ansiweather, 

2. find your location at OpenWeather and replace <city,country code, eg London,UK> and the city code ******* in the URL as appropriate. Also find the right number to replace the * in  genmon-*, if you want a click to refresh the applet. The method is described in a comment in the script.

3. remove the # before the click command you want.

4. copy the script into a .sh file and make it executable.

5. add an instance of Genmon to the panel, enter the path to the .sh file and a refresh time in seconds, and save.

#!/bin/bash
temp=$(ansiweather -l <city,country code, eg London,UK> | awk '{print $6$7}')
forecast=$(ansiweather -l <city,country code, eg London,UK> -s true -a false -F | awk '{print $1 "\n\n" $4,$7,$8,$9 "\n" $11,$14,$15,$16 "\n" $18,$21,$22,$23 "\n" $25,$28,$29,$30 "\n" $32,$35,$36,$37 "\n" $38,$41,$42,$43}')

PANEL="<txt>$temp</txt>"
PANEL+="<txtclick>firefox --new-tab --url https://openweathermap.org/city/*******</txtclick>"
#replace ******* with the code number for your city
#PANEL+="<txtclick>xfce4-panel --plugin-event=genmon-*:refresh:bool:true</txtclick>"
#You will need to obtain the number in genmon-* by going to panel>preferences>items and hovering over the instance of Genmon
#PANEL+="<txtclick>xterm -hold -e  ansiweather -l <city,country code, eg London,UK> -s true -f 7</txtclick>"

TOOLTIP="<tool>"
TOOLTIP+="<span weight='bold' font='sans regular'>Forecast</span>\n\n"
TOOLTIP+="<span font= 'monospace regular'>$forecast</span>\n"
#TOOLTIP+="<span weight='bold' font='sans regular'>Click to update</span>"
TOOLTIP+="<span weight='bold' font='sans regular'>OpenWeather</span>"
#Change to suit the click action you choose
TOOLTIP+="</tool>"

echo -e "${PANEL}"
echo -e "${TOOLTIP}"

[Update: Here is an alternative script with a nicer column format:

NB the temperature column will accommodate six characters, so "-5/-10" would be OK, but "-15/-10" wouldn't. Change %6s (a six character string) to %7s if you live somewhere that never gets above minus double digits in the winter. If you live somewhere temperate that never gets into double-digit cold, %5s  will be OK and look better. Screenshot below is %6s.

#!/bin/bash
city=$(ansiweather -l london,uk | awk '{print $4}')
temp=$(ansiweather -l london,uk | awk '{print $6$7}')
forecast=$(ansiweather -l london,uk -s true -a false -F | awk '{printf "%s %6s%s %s\n%s %6s%s %s\n%s %6s%s %s\n%s %6s%s %s\n%s %6s%s %s\n", $4,$7,$8,$9,$11,$14,$15,$16,$18,$21,$22,$23,$25,$28,$29,$30,$32,$35,$36,$37}')

PANEL="<txt>$temp</txt>"
PANEL+="<txtclick>firefox --new-tab --url https://openweathermap.org/city/*******</txtclick>"
#PANEL+="<txtclick>xfce4-panel --plugin-event=genmon-*:refresh:bool:true</txtclick>"
#PANEL+="<txtclick>xterm -hold -e  ansiweather -l london,uk -s true -f 7</txtclick>"

TOOLTIP="<tool>"
TOOLTIP+="<span weight='bold' font='sans regular'>Forecast</span>\n"
TOOLTIP+="<span font= 'monospace regular'>$city</span>\n"
TOOLTIP+="<span font= 'monospace regular'>$forecast</span>\n"
#TOOLTIP+="<span weight='bold' font='sans regular'>Click to update</span>"
TOOLTIP+="<span weight='bold' font='sans regular'>OpenWeather</span>"
TOOLTIP+="</tool>"

echo -e "${PANEL}"
echo -e "${TOOLTIP}"

Replace london,uk and * as appropriate.]

[Edit: removed superfluous variable entries from script.]

Update notifications in Debian XFCE Part 2

XFCE in Debian does not notify the user of available updates. In this post I'm going to show two methods of getting update notifications. Before using either of these methods, it's necessary to configure Debian's package manager APT to check for available updates, as described in my previous post.

It's also necessary to install aptitude, which is a text-based terminal front end for APT.

Method 1: using Conky

Conky is a system monitor which can be used to output the result of a terminal command to the desktop. Here, it is writing the output of the following command to the desktop:

aptitude search "~U" | wc -l

Which tells aptitude to search APT for updatable packages, count and list them. (Found on the bunsenlabs forum.)

The line in my Conky config file is:

${color grey}Available updates:$color ${execi 3600 aptitude search "~U" | wc -l}

Which tells Conky to execute the command every hour. Add Conky to Application Autostart in XFCE. The command conky -d -p 12 runs Conky as a daemon with a 12 second delay - Conky can get buried if a non-system wallpaper is applied after the desktop starts.

The full Conky script is at the bottom of the post for reference.

Method 2: using Genom in the XFCE panel

The disadvantage of the first method is that many people don't see their desktop very often. With the second method, the notification is in the panel, so it's easy to notice.

Genmon is an XFCE plugin that monitors terminal commands and outputs the result to the XFCE panel. So in this case, Genmon is monitoring the output of the same command we used in Conky but showing the result in the panel, alongside an icon which only appears when updates are available.

Genmon can also use the XFCE tooltip to display a list of available updates from the output of this command:

aptitude -F%p search '~U'

Which returns the names of updatable packages.

The panel icon is also clickable and can be configured to update the system.

Credit for the Genmon script goes to alkusin.net, where an XFCE update script is mentioned, although I had to use waybackmachine to find it. 

I modified the script to work with Debian, and added the <iconclick> command, which was added to Genmon recently and allows the script to use system icons. Most icon themes have a software update icon in the Status folder somewhere, although the name may vary.

Here is the Genmon script:

#!/bin/bash
updates=$(aptitude search '~U' | wc -l)
details=$(aptitude -F%p search '~U')

PANEL="<icon>software-update-available</icon>"
PANEL+="<iconclick>./update-script.sh</iconclick>"
PANEL+="<txt><span size='6000' rise='8000'>$updates</span></txt>"

TOOLTIP="<tool>"
TOOLTIP+="<span weight='bold'>Available updates: $updates</span>\n"
TOOLTIP+="$details\n"
TOOLTIP+="<span weight='bold'>Click icon to update</span>"
TOOLTIP+="</tool>"

if [ $updates -gt 0 ]; then
  echo -e "${PANEL}"
  echo -e "${TOOLTIP}"
else
  echo ""
fi

The script has to be saved as a text file with the .sh suffix and made executable (Properties > Permissions in Thunar). Then enter the path to the script in Genmon properties:

Command: /path/to/your/genmon-script.sh

Label: unticked

Period (s): update interval in seconds - eg 3600 (1 hour)

I have put the <iconclick> actions in a separate script, so I could get the terminal to update the system and refresh Genmon so the icon disappears after updating - I don't think it's possible for an XML <click> command to do this.

So, if you want to update with a click, put something similar in an .sh executable file:

#!/bin/bash
xterm -e "pkcon update && sleep 5s && xfce4-panel --plugin-event=genmon-7:refresh:bool:true"

[Edit: You will need to change genmon-7 to the Genmon ID number in your panel. Go to Panel>Panel Preferences>Items and hover over the Genmon instance in the list - you will see the ID number for your panel.]

exo-open --launch TerminalEmulator works too, but I like the cute Xterm terminal.

I hope these methods are useful to somebody. If I have left out any necessary information, please let me know in the comments!

Here are the modifications to the Conky script. Get the default Conky script from etc/conky/conky.conf and copy to  ~/.config/conky/conky.conf and edit. 

gap_x = edit to suit
gap_y = your monitor
own_window_transparent = true,
own_window_argb_visual = true,

 
conky.text = [[
${execi 86400 lsb_release -sd}
$kernel${time %A %d %B %Y}
${color grey}Uptime:$color $uptime
${color grey}Available updates:$color ${execi 3600 aptitude search "~U" | wc -l}
]]

[Update: amended Conky script so it checks for Debian release information daily and not every second.]

Update notifications in Debian XFCE Part 1

I've been using XFCE in Debian Testing for a few weeks, so of course there have been a lot of updates - mostly bug fixes at this stage of the cycle. I've been updating manually every day to keep up to date and watch for fixes for any issues I have.

But when Bullseye becomes Stable, how will I know if updates are available? Updates in Stable are less frequent, so it's good to get a notification if they are available.

Unlike in Gnome, update notifications don't seem to happen in XFCE in Debian. However, there are ways to be notified of updates. One way is to install package-update-indicator, which basically installs the Gnome update system, with, it's own pop-up indicator.

However, there is a way to get notifications without installing the Gnome system, if we simply want to be notified of updates. (The Gnome system can install updates, automatically in the background if so configured.)

Here's how.

The first step is to enable the system to update its list of available packages so it knows if there are newer packages available. Manually, this would be done by this command:

#apt-get update

Fortunately in Bullseye, there is a way to get APT to update itself automatically. Systemd runs a system scheduler which contains a timer called (with admirable succinctness):

apt-daily.timer

This timer runs by default, but the default APT setting is to do nothing. We need to configure Apt to update its packages daily when its script is run by the timer.

This is done by creating a configuration file and adding some variables. The configuration file needs to be:

/etc/apt/apt.conf.d/10periodic

And the variable we need to add is:

APT::Periodic::Update-Package-Lists "1";

There is a package in the Debian repository which will do this automatically. It's called apt-config-auto-update and it will configure APT for automatic cache updates. Its default settings in /etc/apt/apt.conf.d/10periodic are:

APT::Periodic::Update-Package-Lists "1";

APT::Periodic::Download-Upgradeable-Packages "1";

APT::Periodic::AutocleanInterval "0";

These settings will check for updates and download upgradeable packages, if that's what you want. "1" means once a day apparently, so once a week would be "7". Autoclean can also be enabled.

To check up on automatic package list updates run:

# journalctl --since yesterday -u apt-daily.service

To check on Systemd's update schedule for APT (by default the time is randomised), run:

# systemctl edit apt-daily.timer

 # systemctl status apt-daily.timer                  

Debian Wiki.

If you would like to automatically install security updates, it is possible with unattended-upgrades, which creates a similar configuration file in the same location.

Now APT is doing a daily package list update, we just need a way of being notified of those available updates. But that will have to wait till the next post.

To be continued...

References:

Unix & Linux

Laurence's Blog

Ask Ubuntu

Ask Ubuntu

Debian Handbook

 

Edited to correct command to check update schedule, 28-12-2022.

 

 

 

 

 

Things that are broken but getting fixed in Bullseye

Bluetooth is currently broken for some adapters in Debian, but it looks like there is a fix coming in the 5.11 kernel.

Another bug report at kernel.org.This time the message is:

kernel: Bluetooth: hci0: don't support firmware rome 0x1020200

Technical details are here.

Patched kernel for testing at Canonical is 5.11.0.

Final release of 5.11 is expected sometime in mid-February, according to 9to5Linux.

Driverless printing in Debian Part II - Sharing printers over the network

Previously, I wrote about the idea of driverless printing: a common language shared between computers and printers that allows a printer to tell a computer "this is what I can print", and the computer to send the print job to the printer in a format it can print.

Thus removing the tedious necessity of installing drivers to use a printer, and allowing any device to print to any printer.

I also wrote about how my printers didn't have the common language required for driverless printing.

In this post I'm going to write about how it is possible to print from a Linux computer or Android device to printers connected to the network without installing drivers: by sharing printers over the network. (You do need one computer with the drivers installed.)

This is something I discovered by accident. I noticed when using my desktop PC running Debian Buster Gnome that the two wireless printers on my home network were listed twice in printer settings, the second listing being suffixed with the name of my laptop.

This confused me for a while until I realised that by default my laptop publishes network printers connected to it, and my desktop detects and adds the printers as shared network printers via the laptop.

And then I realised that it is possible to use the printers shared by the laptop even without the printer driver installed on a device. The printers appear on my Android phone, and I can print to them from it.

Which, of course, is useful.

So how does it work? Well, it seems the laptop has a system to publish printers connected to it so that they are available to other devices connected to the network, which can then use the common language I mentioned earlier - Internet Printing Protocol (IPP) - to pass the print job to the laptop, which can then pass it to the printer.

In an ideal world of course, my printers would have the version of the shared language that would allow any device to connect without a driver - IPP Everywhere™ - but at least this way phones and tablet on the home network can print without a driver.

The system that publishes printers in this way is a Zero-configuration networking (zeroconf) multicast DNS/DNS-SD service. Something that Apple implements with Bonjour (hello - understandable) and Linux with Avahi (a genus of woolly lemur - mkay).

Printers are discovered in Linux by cups-browsed.

Bonjour is built into printers so they can advertise themselves on the network, Debian has Avahi so it can advertise connected printers and cups-browsed so that it can discover them, and Android has Network service discovery (NSD) so it can discover connected printers.

Of course you may not want your computer to add every printer discovered on the network, especially if they are a duplicate of an already-installed printer. This could be seen as a bug not a feature.

However, it is possible to disable publishing of printers connected to the computer.

The option was ticked by default in XFCE in Debian Bullseye, but left unticked by default in Gnome in Debian Buster.

So, if you want to print from a Linux computer, or an Android device, but don't want to/can't install the driver, this is a way to do it. I think everything was installed by default in Debian, with the only difference being that sharing was enabled in one installation and not another. In other distributions it may be necessary to install Avahi or cups-browsed.

And of course this sort of thing is possible in Apple and Windows too, but I don't have Apple or Windows devices. If you do, this guide may be useful.

Driverless printing in Debian

I installed Debian Testing on my laptop recently, and had to reinstall my printer. Before heading to the Brother website to download the installation script they provide, I decided to check out the situation in Debian regarding printers. Previously I had tried an open source driver (which produced deformed text) before installing the proprietary drivers (via the installation script) from Brother.

I found the following on the Debian Wiki:

A proportion of the material on the Printing Portal pages is applicable to installing printer drivers (free and non-free) and PPDs and setting up a print queue for legacy printers. However, it is as well to be aware that drivers and PPDs are deprecated in CUPS and eventually they will not be catered for as they are now. This has been a long-term objective of the CUPS project for some time.

Users possessing a modern printer are urged to consider the following points and explore a driverless printing solution for their printing needs, whether or not the deprecation is a motivating factor.

• Driverless printing was introduced to CUPS and cups-browsed in Debian 9 (stretch). 
• Support for driverless printing with CUPS and cups-browsed is considerably extended in Debian 10 (buster) and Debian 11 (bullseye). 
• Printers sold in the last 10 years or so are almost always AirPrint devices and therefore would support driverless printing when the device is connected by ethernet or wireless.
  

(CUPS is the standards-based, open source printing system developed by Apple Inc. for macOS® and other UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.)

Well, I have a modern printer, so I set off to explore a driverless printing solution.

Here's what I learnt: computers used to need a driver to tell the computer how to format a print job so that a printer could print the job. Driverless printers tell the computer (or today, phone tablet or other mobile device) what their printing capabilities and requirements are over the network, and the device then sends the job to the printer using a common language to printer and device.  Debian Wiki.

Which should make using multiple devices on multiple printers very easy.

There are two "common languages" which devices can use to talk to enabled printers: IPP and AirPrint.

"Modern IPP printers are printers capable of driverless printing", says the Debian Wiki.

The instructions are as follows:

Open the web interface and choose Administration. Select Add Printer. 

Your printer will be under the Discovered network Printers, probably with more than one entry. Choose the entry that contains the word driverless and move on to Continue. 

Debian Wiki

Unfortunately,I couldn't find an entry containing the word driverless.

Although my printer can talk to my computer (it has IPP), it doesn't seem to have the version of that language that allows a device to send a job to a printer without a driver (IPP Everywhere™).

It doesn't appear in the database of IPP Everywhere™ printers.

Printers sold in the last 10 years or so are almost always AirPrint devices and therefore would support driverless printing when the device is connected by ethernet or wireless, says the Debian Wiki.

I suspected mine wasn't, because a guest had tried to use their iPhone to print a document from my HL-1212W, and it wasn't possible.

It doesn't appear on this list of Apple AirPrint enabled printers.

I guess that my printer despite being "modern" (it was released in 2014, apparently) is a budget item based on previous items in the range which seem to date back quite a while. A Windows XP driver is available. Did Brother supply a driver for XP in the year of its end of life? Or is the printer a refresh of an old model that dates back to the beginning of the century?

Fortunately, for now, the drivers supplied by Brother work (very well) with CUPS for perfect printing, and hopefully it will be a while before CUPS stops supporting proprietary drivers.