How can I automate a "conffile" prompt in unattended upgrades?

We have many systems, managed via Ansible. They are configured to run nightly security updates. We have a problem because the sudo package wants to put in a new /etc/sudoers. This is what now happens in our cron output:

/etc/
Package 'sudo' has conffile prompt and needs to be upgraded manually

I can manually apt-get install sudo on a box and press the button to keep my config file, but that doesn't scale well. Is there a config I can tweak so that the nightly security updates, at least in this instance, know my preference to keep our local /etc/sudoers? Thanks!

1 Answer

This appears to be the desired answer:

I also want to keep original config files while doing automatic updates. You can add the following to /etc/apt/apt.conf.d/50unattended-upgrades

Dpkg::Options { "--force-confdef"; "--force-confold";
};

See here for a good explanation of the options: