How to Configure unattended-upgrades in Ubuntu Server for Automated Security Patching

Maintaining security on production Ubuntu servers requires continuous patch management without causing service disruptions or unexpected system reboots. The unattended-upgrades utility automates the download and installation of security and critical updates directly from the official Ubuntu repositories. When configured properly with email notifications, precise repository filtering, and scheduled reboot maintenance windows, unattended-upgrades protects workloads from known Common Vulnerabilities and Exposures (CVEs) with minimal manual administrative overhead.

Installing and Enabling unattended-upgrades

On modern Ubuntu Server installations (including 20.04 LTS, 22.04 LTS, and 24.04 LTS), the package is often installed by default. However, it requires active enablement within the systemd and APT framework. Begin by updating repository metadata and installing the required packages:

sudo apt update
sudo apt install unattended-upgrades update-notifier-common -y

To enable the automated updater through the debconf interface, execute the following command:

sudo dpkg-reconfigure --priority=low unattended-upgrades

When the interactive ncurses prompt appears asking whether to automatically download and install stable updates, select Yes. This generates the core schedule configuration in /etc/apt/apt.conf.d/20auto-upgrades.

Directive	Default Value	Operational Impact
APT::Periodic::Update-Package-Lists	“1”	Executes apt update once every 24 hours in the background.
APT::Periodic::Unattended-Upgrade	“1”	Runs unattended-upgrade daily to apply qualified packages.
APT::Periodic::Download-Upgradeable-Packages	“1”	Pre-fetches .deb files prior to invocation to reduce maintenance lag.
APT::Periodic::AutocleanInterval	“7”	Cleans outdated archive packages from /var/cache/apt/archives every 7 days.

Configuring Allowed Package Origins and Blacklists

The primary control configuration file is located at /etc/apt/apt.conf.d/50unattended-upgrades. Open this file in your preferred administrative editor:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Within this configuration, verify the Unattended-Upgrade::Allowed-Origins stanza. For security-first production environments, restrict automatic patching strictly to security pockets rather than general distribution updates:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    // "${distro_id}:${distro_codename}-updates";
    // "${distro_id}:${distro_codename}-proposed";
    // "${distro_id}:${distro_codename}-backports";
};

If you run database engines, web servers, or custom application runtimes (such as MySQL, PostgreSQL, or Nginx) where automated upgrades could cause version mismatches or config breaks, isolate them using the package blacklist array:

Unattended-Upgrade::Package-Blacklist {
    "nginx";
    "mysql-server";
    "postgresql.*";
    "docker-ce";
};

Automating System Reboots and Maintenance Windows

Certain kernel updates require a complete system reboot to apply changes to memory. In high-availability environments, an immediate unexpected midday reboot can disrupt active sessions. You can configure unattended-upgrades to reboot only during low-traffic maintenance windows:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";

With this configuration, if an updated kernel marks the file /var/run/reboot-required, the system schedules the restart exactly at 03:30 AM local server time. Setting Automatic-Reboot-WithUsers "false" ensures that the machine will never restart if an administrator or engineer is actively logged into a shell session via SSH.

Setting Up Alert Notifications and Log Auditing

To receive notifications whenever packages fail to install or when the server completes a security restart, install an email transfer agent like mailutils or postfix, and update the mail directive:

Unattended-Upgrade::Mail "[email protected]";
Unattended-Upgrade::MailReport "only-on-error";

You can verify your configuration syntax and simulate an unattended execution run using the dry-run debug flag:

sudo unattended-upgrades --dry-run --debug

Examine the detailed execution logs at any time in /var/log/unattended-upgrades/unattended-upgrades.log and /var/log/unattended-upgrades/unattended-upgrades-dpkg.log to audit which packages were processed and verify system health.