Unattended updates (security only)

Unattended upgrades automatically install critical security updates in the background, ensuring your system stays protected without requiring manual intervention. This helps reduce the risk of known vulnerabilities being exploited, especially on servers, by keeping security patches up to date as soon as they are released.

This guide is intended for Debian and Ubuntu-based systems.

---

Update:

sudo apt update

---

Install:

sudo apt install -y unattended-upgrades apt-listchanges

---

Enable:

sudo dpkg-reconfigure unattended-upgrades

Choose “Yes” when prompted to enable automatic updates.

---

Configure the system to apply security only updates:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

---

Locate the following line and comment it out:

// "origin=Debian,codename=${distro_codename},label=Debian";

This line is disabled to ensure only security updates are applied, not general Debian repository updates.

---

Locate the following lines and ensure they are uncommented:

"origin=Debian,codename=${distro_codename},label=Debian-Security";
"origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

These lines define the official Debian Security repositories used for installing security updates only.

---

Locate the following line and uncomment it:

Unattended-Upgrade::Automatic-Reboot "false";

This setting disables automatic system reboot after security updates are installed.

---

Set daily update schedule:

You can simply paste these lines into the terminal and press Enter to execute:

sudo tee /etc/apt/apt.conf.d/20auto-upgrades >/dev/null <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
EOF

Update-Package-Lists "1" → checks daily
Unattended-Upgrade "1" → installs upgrades automatically
Download-Upgradeable-Packages "1" → pre-downloads packages
AutocleanInterval "7" → cleans old packages weekly

---

Test unattended upgrades:

sudo unattended-upgrade --dry-run --debug

This simulates the upgrade process and shows which updates would be installed, helping you confirm that unattended upgrades are correctly configured.

---

Check logs:

You can simply paste these lines into the terminal and press Enter to execute:

ls -lh /var/log/unattended-upgrades/
tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log

You can verify that unattended upgrades are working by checking the log files.

---

Commands:

Enable to run at boot	sudo systemctl enable unattended-upgrades.service
Start	sudo systemctl start unattended-upgrades.service
Status	sudo systemctl status unattended-upgrades.service
Stop	sudo systemctl stop unattended-upgrades.service
Disable from running at boot	sudo systemctl disable unattended-upgrades.service