Linux – Upgrading ubuntu release on a cluster of servers

You pass the password in the command line you are executing. Those may probably be visible not only in your terminal, but also by other users issuing 'ps' command (that may depend on the system configuration). And the password is plain text.

I don't know Fabric, but if it gives you a possibility to communicate with executed commands via their stdin/stdout (like subprocess.Popen()), then it would be probably a better choice to use that instead of 'echo username:password|...'.

Also, you may chose to create the password hash in your Python script (using the crypt module and "$1$XXXXXXXX$" ("X" are random characters) salt) and pass that to chpasswd -e. The plain text password will never be displayed or logged then.

You generate the password hash with the crypt module like so:

import crypt
p='secretpassword'
print(crypt.crypt(p))

And you can pass the output to chpasswd -e like this:

`echo 'someusername:passwordhash' | chpasswd -e`

I used to create a bash script like this to accomplish this task - then just call it from cron:

#!/usr/bin/env 
apt-get update
apt-get upgrade -qq

Honestly, I used -d -q (download only), to download the updates onto my staging server in the middle of the night. I'd then test them when I got in to the office, and push them to our internal apt-proxy server.