Skip to main content
Back to Category

Automatic Updates Guide: unattended-upgrades Setup

Install and configure unattended-upgrades, security-only updates, email notifications, testing, risks and mitigations for Linux servers.

Read time: 10 min Server Management
unattended-upgradesautomatic updatessecurity updatesubuntudebianlinuxapt
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Automatic Updates Guide: unattended-upgrades Setup

One of the most fundamental server security requirements is timely application of security patches. Forgetting to update manually can leave your server vulnerable to known security exploits. The unattended-upgrades package automatically applies security updates on Ubuntu and Debian systems. This guide covers installation, configuration, and best practices.

What is unattended-upgrades?

unattended-upgrades is an APT plugin that automatically downloads and installs security updates without human intervention. It's ideal for:

  • Rapid application of critical security patches
  • Automatic updates during off-hours or maintenance windows
  • Simplifying update tracking when managing multiple servers

Automatic updates can sometimes cause service interruptions. Kernel updates in particular require a reboot. Configure carefully in production environments.

Installation

Ubuntu/Debian

hljs bash
# Install the package
sudo apt update
sudo apt install unattended-upgrades apt-listchanges -y

# Verify installation
dpkg -l unattended-upgrades

# Check service status
systemctl status unattended-upgrades

Automatic Configuration Wizard

hljs bash
# Auto-configure basic settings
sudo dpkg-reconfigure -plow unattended-upgrades
# Select "Yes"

Basic Configuration

Main configuration file: /etc/apt/apt.conf.d/50unattended-upgrades

hljs bash
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    // Ubuntu security updates
    "${distro_id}:${distro_codename}-security";
    // ESM security updates (Ubuntu Pro)
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";

    // All updates (not recommended — prefer security-only)
    // "${distro_id}:${distro_codename}";
    // "${distro_id}:${distro_codename}-updates";
};

// Exclude specific packages from updates
Unattended-Upgrade::Package-Blacklist {
    // "nginx";
    // "mysql-server";
    // "php*";
};

// Automatic reboot after updates
Unattended-Upgrade::Automatic-Reboot "false";

// Reboot time (only if Automatic-Reboot is true)
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

// Remove unused dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Remove unused kernel packages
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

// Email notification
Unattended-Upgrade::Mail "admin@rexe.tr";

// Send email only on change
Unattended-Upgrade::MailReport "on-change";
// Options: "always", "only-on-error", "on-change"

// Keep update log
Unattended-Upgrade::SyslogEnable "true";
Unattended-Upgrade::SyslogFacility "daemon";

Update Schedule

Update frequency is configured in /etc/apt/apt.conf.d/20auto-upgrades:

hljs bash
sudo nano /etc/apt/apt.conf.d/20auto-upgrades

// Update package list daily
APT::Periodic::Update-Package-Lists "1";

// Download upgradeable packages daily
APT::Periodic::Download-Upgradeable-Packages "1";

// Run unattended-upgrades daily
APT::Periodic::Unattended-Upgrade "1";

// Clean old package cache every 7 days
APT::Periodic::AutocleanInterval "7";

Values are in days. "1" = daily, "7" = weekly, "0" = disabled.

Security-Only Updates

Applying only security updates automatically is the safest approach for production servers:

hljs bash
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    // ONLY security updates
    "${distro_id}:${distro_codename}-security";
};

// Comment out all other update sources
// "${distro_id}:${distro_codename}";
// "${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-backports";

Email Notifications

mailutils or postfix is required for update notifications:

hljs bash
# Install mailutils
sudo apt install mailutils -y

# For simple SMTP configuration
sudo apt install ssmtp -y
sudo nano /etc/ssmtp/ssmtp.conf

root=admin@rexe.tr
mailhub=smtp.gmail.com:587
AuthUser=your-email@gmail.com
AuthPass=your-app-password
UseTLS=YES
UseSTARTTLS=YES
hljs bash
# Test email
echo "Test message" | mail -s "Server Update Test" admin@rexe.tr

Testing the Configuration

Dry Run

hljs bash
# Simulate without actually updating
sudo unattended-upgrade --dry-run --debug

# More verbose output
sudo unattended-upgrade -d --dry-run

Manual Run

hljs bash
# Run unattended-upgrades immediately
sudo unattended-upgrade -d

# Run in verbose mode
sudo unattended-upgrade --verbose

Reviewing Log Files

hljs bash
# Main log file
cat /var/log/unattended-upgrades/unattended-upgrades.log

# Error logs
cat /var/log/unattended-upgrades/unattended-upgrades-dpkg.log

# Real-time log monitoring
tail -f /var/log/unattended-upgrades/unattended-upgrades.log

# Check last update time
ls -la /var/log/unattended-upgrades/

Kernel Updates and Reboots

Kernel updates require special attention:

hljs bash
# Check if a reboot is required
cat /var/run/reboot-required

# See which packages require a reboot
cat /var/run/reboot-required.pkgs

# Check if reboot is needed
if [ -f /var/run/reboot-required ]; then
  echo "Reboot required!"
fi

Automatic Reboot Configuration

hljs bash
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

// Enable automatic reboot
Unattended-Upgrade::Automatic-Reboot "true";

// Reboot time (2:00 AM)
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

// Don't reboot if users are logged in
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

Before enabling automatic reboots, assess whether your application can tolerate restarts. Manual reboots are preferred for critical production systems.

Risks and Mitigations

Potential Risks

  1. Service interruption: Some updates restart services
  2. Dependency conflicts: Package conflicts can occur in rare cases
  3. Configuration changes: Updates may modify configuration files
  4. Kernel updates: Require a reboot

Risk Mitigation

hljs bash
# 1. Blacklist critical packages
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Package-Blacklist {
    // Critical database server
    "mysql-server";
    "postgresql";
    // Web server
    "nginx";
    "apache2";
    // Kernel (for manual updates)
    "linux-image*";
    "linux-headers*";
};
hljs bash
# 2. Take a snapshot before updates (on supported systems)
# 3. Regularly check update logs
tail -100 /var/log/unattended-upgrades/unattended-upgrades.log

# 4. Check service status after updates
systemctl --failed

dnf-automatic for CentOS/AlmaLinux/RHEL

RPM-based systems use dnf-automatic:

hljs bash
# Install
sudo dnf install dnf-automatic -y

# Configure
sudo nano /etc/dnf/automatic.conf
hljs ini
[commands]
# Security updates only
upgrade_type = security
# Apply updates automatically
apply_updates = yes

[emitters]
# Email notification
emit_via = email
email_to = admin@rexe.tr

[email]
email_from = server@rexe.tr
email_host = localhost
hljs bash
# Enable the service
sudo systemctl enable --now dnf-automatic.timer

# Check status
sudo systemctl status dnf-automatic.timer

# List timers
sudo systemctl list-timers dnf-automatic*

On both Ubuntu and CentOS systems, closely monitor log files during the first week after enabling automatic updates. This helps you catch unexpected issues early.

Conclusion

unattended-upgrades is a powerful tool for keeping your REXE servers secure. By automatically applying only security updates, blacklisting critical packages, and enabling email notifications, you can maintain both a secure and stable server environment. Regular log checks and validation in a test environment make the automatic update process more reliable.

Frequently Asked Questions

Does unattended-upgrades install all updates or only security updates?

By default, it installs only security updates. You can control which update sources are used in the Allowed-Origins section of /etc/apt/apt.conf.d/50unattended-upgrades. For production servers, it's recommended to keep only the '-security' source active.

When does automatic updating run?

By default, it runs once a day. The exact time varies based on the system's APT timer (usually at night). You can adjust the frequency in /etc/apt/apt.conf.d/20auto-upgrades. You can also customize it with a systemd timer.

How do I exclude a specific package from automatic updates?

Add the package name to the Package-Blacklist section in the 50unattended-upgrades file. For example, to exclude nginx, add '"nginx";'. You can use wildcards: '"php*";' excludes all PHP packages.

The server is automatically rebooting after updates. How do I prevent this?

Set 'Unattended-Upgrade::Automatic-Reboot "false";' in the 50unattended-upgrades file. This prevents any update, including kernel updates, from triggering an automatic reboot. You can then schedule reboots manually.

How do I check if unattended-upgrades is working?

Several methods: check service status with 'systemctl status unattended-upgrades', review the log file with 'cat /var/log/unattended-upgrades/unattended-upgrades.log', or run a simulation with 'sudo unattended-upgrade --dry-run'.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps