| 加固项 | 更新自动化 |
|---|---|
| 适用平台 | Linux（Debian/Ubuntu） |
| 风险等级 | 中 |
| 基线 | 自动化策略与业务匹配 |
配置与验证
配置与验证
dpkg-reconfigure -plow unattended-upgrades
grep -E 'Unattended-Upgrade|Automatic-Reboot' /etc/apt/apt.conf.d/20auto-upgrades /etc/apt/apt.conf.d/50unattended-upgrades
unattended-upgrade --dry-run -d 2>&1 | tail -20关键参数示例
关键参数示例
# Unattended-Upgrade::Automatic-Reboot \"false\";
# Unattended-Upgrade::Automatic-Reboot-Time \"03:00\";
# Unattended-Upgrade::Package-Blacklist { \"nginx\"; \"mysql-server\"; };自动重启是常见事故源：内核更新后重启由业务窗口决定，自动化只负责“装”，重启走人工/编排。