Ubuntu 16.04 - Apply ESM security patches only using unattended-upgrade [closed]

Solution 1:

The setting for Unattended-Upgrade::Allowed-Origins affects what repositories are used by unattended-upgrade. These are defined by default in /etc/apt/apt.conf.d/50unattended-upgrades.

You could add a separate configuration file (e.g. /etc/apt/apt.conf.d/90custom) with the content

#clear Unattended-Upgrade::Allowed-Origins;
Unattended-Upgrade::Allowed-Origins {
        "${distro_id}ESM:${distro_codename}";
        "${distro_id}ESM:${distro_codename}-updates";
        "${distro_id}ESM:${distro_codename}-security";
        "${distro_id}ESM:${distro_codename}-infra-security";
        "${distro_id}ESMApps:${distro_codename}-apps-security";
};

These entries match all ESM repo formats for all distros that I have worked with, but you can tailor for your needs.

I like to use a separate configuration file to avoid conflicts with system packages that update the default configuration file.