Automatic Updates Guide: unattended-upgrades Setup

One of the most fundamental server security requirements is timely application of security patches. Forgetting to update manually can leave your server vulnerable to known security exploits. The unattended-upgrades package automatically applies security updates on Ubuntu and Debian systems. This guide covers installation, configuration, and best practices.

What is unattended-upgrades?

unattended-upgrades is an APT plugin that automatically downloads and installs security updates without human intervention. It's ideal for:

Rapid application of critical security patches
Automatic updates during off-hours or maintenance windows
Simplifying update tracking when managing multiple servers

Automatic updates can sometimes cause service interruptions. Kernel updates in particular require a reboot. Configure carefully in production environments.

Installation

Ubuntu/Debian

hljs bash

# Install the package
sudo apt update
sudo apt install unattended-upgrades apt-listchanges -y

# Verify installation
dpkg -l unattended-upgrades

# Check service status
systemctl status unattended-upgrades

Automatic Configuration Wizard

hljs bash

# Auto-configure basic settings
sudo dpkg-reconfigure -plow unattended-upgrades
# Select "Yes"

Basic Configuration

Main configuration file: /etc/apt/apt.conf.d/50unattended-upgrades

hljs bash

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    // Ubuntu security updates
    "${distro_id}:${distro_codename}-security";
    // ESM security updates (Ubuntu Pro)
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";

    // All updates (not recommended — prefer security-only)
    // "${distro_id}:${distro_codename}";
    // "${distro_id}:${distro_codename}-updates";
};

// Exclude specific packages from updates
Unattended-Upgrade::Package-Blacklist {
    // "nginx";
    // "mysql-server";
    // "php*";
};

// Automatic reboot after updates
Unattended-Upgrade::Automatic-Reboot "false";

// Reboot time (only if Automatic-Reboot is true)
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

// Remove unused dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Remove unused kernel packages
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

// Email notification
Unattended-Upgrade::Mail "admin@rexe.tr";

// Send email only on change
Unattended-Upgrade::MailReport "on-change";
// Options: "always", "only-on-error", "on-change"

// Keep update log
Unattended-Upgrade::SyslogEnable "true";
Unattended-Upgrade::SyslogFacility "daemon";

Update Schedule

Update frequency is configured in /etc/apt/apt.conf.d/20auto-upgrades:

hljs bash

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

// Update package list daily
APT::Periodic::Update-Package-Lists "1";

// Download upgradeable packages daily
APT::Periodic::Download-Upgradeable-Packages "1";

// Run unattended-upgrades daily
APT::Periodic::Unattended-Upgrade "1";

// Clean old package cache every 7 days
APT::Periodic::AutocleanInterval "7";

Values are in days. "1" = daily, "7" = weekly, "0" = disabled.

Security-Only Updates

Applying only security updates automatically is the safest approach for production servers:

hljs bash

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    // ONLY security updates
    "${distro_id}:${distro_codename}-security";
};

// Comment out all other update sources
// "${distro_id}:${distro_codename}";
// "${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-backports";

Email Notifications

mailutils or postfix is required for update notifications:

hljs bash

# Install mailutils
sudo apt install mailutils -y

# For simple SMTP configuration
sudo apt install ssmtp -y
sudo nano /etc/ssmtp/ssmtp.conf

root=admin@rexe.tr
mailhub=smtp.gmail.com:587
AuthUser=your-email@gmail.com
AuthPass=your-app-password
UseTLS=YES
UseSTARTTLS=YES

hljs bash

# Test email
echo "Test message" | mail -s "Server Update Test" admin@rexe.tr

Testing the Configuration

Dry Run

hljs bash

# Simulate without actually updating
sudo unattended-upgrade --dry-run --debug

# More verbose output
sudo unattended-upgrade -d --dry-run

Manual Run

hljs bash

# Run unattended-upgrades immediately
sudo unattended-upgrade -d

# Run in verbose mode
sudo unattended-upgrade --verbose

Reviewing Log Files

hljs bash

# Main log file
cat /var/log/unattended-upgrades/unattended-upgrades.log

# Error logs
cat /var/log/unattended-upgrades/unattended-upgrades-dpkg.log

# Real-time log monitoring
tail -f /var/log/unattended-upgrades/unattended-upgrades.log

# Check last update time
ls -la /var/log/unattended-upgrades/

Kernel Updates and Reboots

Kernel updates require special attention:

hljs bash

# Check if a reboot is required
cat /var/run/reboot-required

# See which packages require a reboot
cat /var/run/reboot-required.pkgs

# Check if reboot is needed
if [ -f /var/run/reboot-required ]; then
  echo "Reboot required!"
fi

Automatic Reboot Configuration

hljs bash

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

// Enable automatic reboot
Unattended-Upgrade::Automatic-Reboot "true";

// Reboot time (2:00 AM)
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

// Don't reboot if users are logged in
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

Before enabling automatic reboots, assess whether your application can tolerate restarts. Manual reboots are preferred for critical production systems.

Risks and Mitigations

Potential Risks

Service interruption: Some updates restart services
Dependency conflicts: Package conflicts can occur in rare cases
Configuration changes: Updates may modify configuration files
Kernel updates: Require a reboot

Risk Mitigation

hljs bash

# 1. Blacklist critical packages
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Package-Blacklist {
    // Critical database server
    "mysql-server";
    "postgresql";
    // Web server
    "nginx";
    "apache2";
    // Kernel (for manual updates)
    "linux-image*";
    "linux-headers*";
};

hljs bash

# 2. Take a snapshot before updates (on supported systems)
# 3. Regularly check update logs
tail -100 /var/log/unattended-upgrades/unattended-upgrades.log

# 4. Check service status after updates
systemctl --failed

dnf-automatic for CentOS/AlmaLinux/RHEL

RPM-based systems use dnf-automatic:

hljs bash

# Install
sudo dnf install dnf-automatic -y

# Configure
sudo nano /etc/dnf/automatic.conf

hljs ini

[commands]
# Security updates only
upgrade_type = security
# Apply updates automatically
apply_updates = yes

[emitters]
# Email notification
emit_via = email
email_to = admin@rexe.tr

[email]
email_from = server@rexe.tr
email_host = localhost

hljs bash

# Enable the service
sudo systemctl enable --now dnf-automatic.timer

# Check status
sudo systemctl status dnf-automatic.timer

# List timers
sudo systemctl list-timers dnf-automatic*

On both Ubuntu and CentOS systems, closely monitor log files during the first week after enabling automatic updates. This helps you catch unexpected issues early.

Conclusion

unattended-upgrades is a powerful tool for keeping your REXE servers secure. By automatically applying only security updates, blacklisting critical packages, and enabling email notifications, you can maintain both a secure and stable server environment. Regular log checks and validation in a test environment make the automatic update process more reliable.

Automatic Updates Guide: unattended-upgrades Setup

Table of Contents