Control script to enable/disable CDN firmware updates on Unifi controller (bash)

cdn_fw

#!/usr/bin/env bash
# must be run as root

CDN_HOSTNAME=fw-update.ubnt.com
FW_JSON=/var/lib/unifi/firmware.json
FW_BASENAME=${FW_JSON%.json}
TAB=$(printf '\t')

function check_cdn() {
  if grep -Ec "^127.0.0.1[\ ${TAB}]+${CDN_HOSTNAME}$" /etc/hosts >/dev/null; then
    echo "disabled (custom mode)"
    echo "firmware can be manually specified in $FW_JSON"
  else
    echo "enabled (normal mode)"
    echo "the UBNT CDN enforces firmware versions"
  fi
  return
}

function disable_cdn() {
  echo "disabling CDN firmware updates"
  stop_unifi
  echo "blocking CDN via blackhole in /etc/hosts"
  add_etchosts_entry
  echo "restricting file permissions on $FW_JSON to prevent writes by controller"
  chown root:unifi $FW_JSON
  chmod 640 $FW_JSON
  echo "done!"
  echo
  echo "you can now edit ${FW_JSON}"
  echo "when ready, restart the controller with \`service unifi start\`"
  return
}

function enable_cdn() {
  echo "re-enabling CDN firmware updates"
  stop_unifi
  DTSTAMP=$(date '+%Y%m%d-%H%M')
  echo "saving backup copy of firmware JSON"
  cp "$FW_JSON" "${FW_BASENAME}.${DTSTAMP}.json"
  echo "removing blackhole entry in /etc/hosts"
  remove_etchosts_entry
  echo "relaxing file permissions on $FW_JSON to allow writes by controller"
  chown root:unifi $FW_JSON
  chmod 660 $FW_JSON
  start_unifi
  echo "done!"
  return
}

function add_etchosts_entry() {
  echo "127.0.0.1${TAB}${CDN_HOSTNAME}" >/tmp/hosts_tmp
  sed -re "/^127.0.0.1[\ \t]+${CDN_HOSTNAME}$/d" /etc/hosts >>/tmp/hosts_tmp
  mv -f /tmp/hosts_tmp /etc/hosts
}

function remove_etchosts_entry() {
  sed -re "/^127.0.0.1[\ \t]+${CDN_HOSTNAME}$/d" /etc/hosts >/tmp/hosts_tmp
  mv -f /tmp/hosts_tmp /etc/hosts
}

function start_unifi() {
  echo "starting Unifi service"
  service unifi start
}

function stop_unifi() {
  echo "stopping Unifi service"
  service unifi stop
}

case $1 in
check)
  check_cdn
  exit
  ;;
enable)
  enable_cdn
  exit
  ;;
disable)
  disable_cdn
  exit
  ;;
*)
  echo 'Usage: cdn_fw <command>'
  echo '  check              check whether CDN is enabled or disabled'
  echo '  enable             allow firmware updates from UBNT CDN'
  echo '  disable            block firmware updates from CDN'
  exit
  ;;
esac

Sample /var/lib/unifi/firmware.json snippet to illustrate how to specify the overrides

{
  "5.10.5": {
    "U7PG2": {
      "md5sum": "b3a46b7509bfa3c871c7377076c3b1d9",
      "url": "https://dl.ubnt.com/unifi/firmware/U7PG2/4.0.17.9910/BZ.qca956x.v4.0.17.9910.190114.1115.bin",
      "version": "4.0.17.9910"
    },
    "U7MSH": {
      "md5sum": "b3a46b7509bfa3c871c7377076c3b1d9",
      "url": "https://dl.ubnt.com/unifi/firmware/U7PG2/4.0.17.9910/BZ.qca956x.v4.0.17.9910.190114.1115.bin",
      "version": "4.0.17.9910"
    },
    "U7HD": {
      "md5sum": "ddb511347f4547148762a3b46c9fdba5",
      "url": "http://unifi.foo.corp:8080/dl/firmware/U7HD/BZ.ipq806x.v4.0.17.9910.190114.1115.bin",
      "version": "4.0.17.9910"
    },
    "US24P250": {
      "md5sum": "030d520eadeea7c99590833c64b25648",
      "url": "http://unifi.foo.corp:8080/dl/firmware/US24P250/US.bcm5334x.v4.0.17.9910.190114.1116.bin",
      "version": "4.0.17.9910"
    },
    "US8P60": {
      "md5sum": "030d520eadeea7c99590833c64b25648",
      "url": "http://unifi.foo.corp:8080/dl/firmware/US24P250/US.bcm5334x.v4.0.17.9910.190114.1116.bin",
      "version": "4.0.17.9910"
    }
  },
[...]

Another small trick I learned, if you aren't sure what internal "board ID" your hardware uses, SSH into the device and run

# grep board.shortname /etc/board.info

This will output something like

board.shortname=US24P250

That string is the HW ID you should use in your firmware.json file.