Configure automatic security updates with unattended-upgrades and email notifications

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default email address
ADMIN_EMAIL="${1:-admin@$(hostname -f)}"

# Usage message
usage() {
    echo "Usage: $0 [admin_email]"
    echo "Example: $0 admin@example.com"
    echo "If no email provided, uses admin@$(hostname -f)"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}$1${NC}"; }
log_warn() { echo -e "${YELLOW}$1${NC}"; }
log_error() { echo -e "${RED}$1${NC}"; }

# Cleanup function for rollback
cleanup() {
    log_error "[ERROR] Installation failed. Cleaning up..."
    case "$PKG_MGR" in
        apt) 
            systemctl disable unattended-upgrades 2>/dev/null || true
            systemctl stop unattended-upgrades 2>/dev/null || true
            ;;
        dnf|yum)
            systemctl disable dnf-automatic.timer 2>/dev/null || true
            systemctl stop dnf-automatic.timer 2>/dev/null || true
            ;;
    esac
    systemctl stop postfix 2>/dev/null || true
    systemctl disable postfix 2>/dev/null || true
}

trap cleanup ERR

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root or with sudo"
    exit 1
fi

# Validate email format (basic)
if [[ ! "$ADMIN_EMAIL" =~ ^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$ ]]; then
    log_error "Invalid email format: $ADMIN_EMAIL"
    usage
fi

log_info "[1/8] Detecting distribution..."

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *) 
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution - /etc/os-release not found"
    exit 1
fi

log_info "Detected: $PRETTY_NAME (Package manager: $PKG_MGR)"

log_info "[2/8] Updating system packages..."
$PKG_UPDATE

log_info "[3/8] Installing automatic update packages..."
case "$PKG_MGR" in
    apt)
        $PKG_INSTALL unattended-upgrades apt-listchanges
        ;;
    dnf|yum)
        $PKG_INSTALL dnf-automatic
        ;;
esac

log_info "[4/8] Installing mail transfer agent..."
case "$PKG_MGR" in
    apt)
        # Preconfigure postfix to avoid interactive prompts
        echo "postfix postfix/main_mailer_type select Local only" | debconf-set-selections
        echo "postfix postfix/mailname string $(hostname -f)" | debconf-set-selections
        $PKG_INSTALL postfix mailutils
        ;;
    dnf|yum)
        $PKG_INSTALL postfix mailx
        ;;
esac

systemctl enable --now postfix

log_info "[5/8] Configuring automatic updates..."
case "$PKG_MGR" in
    apt)
        # Configure unattended-upgrades
        cat > /etc/apt/apt.conf.d/50unattended-upgrades << EOF
Unattended-Upgrade::Allowed-Origins {
    "\${distro_id}:\${distro_codename}";
    "\${distro_id}:\${distro_codename}-security";
    "\${distro_id}ESMApps:\${distro_codename}-apps-security";
    "\${distro_id}ESM:\${distro_codename}-infra-security";
};

Unattended-Upgrade::Package-Blacklist {
    "nginx";
    "apache2";
    "mysql-server";
    "postgresql";
    "docker-ce";
    "kubernetes*";
};

Unattended-Upgrade::DevRelease "false";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Unattended-Upgrade::Mail "$ADMIN_EMAIL";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Verbose "1";
Unattended-Upgrade::Debug "false";

Unattended-Upgrade::SyslogEnable "true";
Unattended-Upgrade::SyslogFacility "daemon";
EOF
        chmod 644 /etc/apt/apt.conf.d/50unattended-upgrades
        ;;
    
    dnf|yum)
        # Configure dnf-automatic
        cat > /etc/dnf/automatic.conf << EOF
[commands]
upgrade_type = security
random_sleep = 360
network_online_timeout = 60
download_updates = yes
apply_updates = yes

[emitters]
emit_via = email,stdio

[email]
email_from = root@$(hostname -f)
email_to = $ADMIN_EMAIL
email_host = localhost
email_port = 25

[base]
debuglevel = 1
EOF
        chmod 644 /etc/dnf/automatic.conf
        ;;
esac

log_info "[6/8] Enabling automatic update schedule..."
case "$PKG_MGR" in
    apt)
        cat > /etc/apt/apt.conf.d/20auto-upgrades << EOF
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
EOF
        chmod 644 /etc/apt/apt.conf.d/20auto-upgrades
        systemctl enable --now unattended-upgrades
        ;;
    
    dnf|yum)
        systemctl enable --now dnf-automatic.timer
        ;;
esac

log_info "[7/8] Configuring package exclusions..."
case "$PKG_MGR" in
    apt)
        cat > /etc/apt/preferences.d/01-security-updates << EOF
Package: nginx apache2 mysql-server postgresql docker-ce
Pin: release a=$VERSION_CODENAME-security
Pin-Priority: -1

Package: kubernetes*
Pin: release a=$VERSION_CODENAME-security
Pin-Priority: -1
EOF
        chmod 644 /etc/apt/preferences.d/01-security-updates
        ;;
    
    dnf|yum)
        if [ ! -f /etc/dnf/dnf.conf.bak ]; then
            cp /etc/dnf/dnf.conf /etc/dnf/dnf.conf.bak
        fi
        grep -q "^exclude=" /etc/dnf/dnf.conf || echo "exclude=nginx httpd mysql-server postgresql docker-ce kubernetes*" >> /etc/dnf/dnf.conf
        ;;
esac

log_info "[8/8] Verifying configuration..."

# Verification checks
ERRORS=0

# Check services
case "$PKG_MGR" in
    apt)
        if ! systemctl is-active --quiet unattended-upgrades; then
            log_error "unattended-upgrades service is not running"
            ((ERRORS++))
        fi
        ;;
    dnf|yum)
        if ! systemctl is-active --quiet dnf-automatic.timer; then
            log_error "dnf-automatic.timer is not running"
            ((ERRORS++))
        fi
        ;;
esac

if ! systemctl is-active --quiet postfix; then
    log_error "postfix service is not running"
    ((ERRORS++))
fi

# Check config files
case "$PKG_MGR" in
    apt)
        if [ ! -f /etc/apt/apt.conf.d/50unattended-upgrades ]; then
            log_error "unattended-upgrades configuration missing"
            ((ERRORS++))
        fi
        if [ ! -f /etc/apt/apt.conf.d/20auto-upgrades ]; then
            log_error "auto-upgrades configuration missing"
            ((ERRORS++))
        fi
        ;;
    dnf|yum)
        if [ ! -f /etc/dnf/automatic.conf ]; then
            log_error "dnf-automatic configuration missing"
            ((ERRORS++))
        fi
        ;;
esac

if [ $ERRORS -eq 0 ]; then
    log_info "✓ Automatic security updates configured successfully!"
    log_info "✓ Email notifications will be sent to: $ADMIN_EMAIL"
    log_info "✓ Security updates will be installed automatically"
    log_info "✓ Critical services are excluded from automatic updates"
    
    case "$PKG_MGR" in
        apt)
            log_info "✓ Service: unattended-upgrades ($(systemctl is-active unattended-upgrades))"
            ;;
        dnf|yum)
            log_info "✓ Service: dnf-automatic.timer ($(systemctl is-active dnf-automatic.timer))"
            ;;
    esac
    
    log_warn "Note: First update check will occur within 24 hours"
    log_warn "Monitor logs: journalctl -u unattended-upgrades -f (Ubuntu/Debian) or journalctl -u dnf-automatic -f (RHEL-based)"
else
    log_error "Configuration completed with $ERRORS error(s). Please review the output above."
    exit 1
fi