How to Configure Unattended Upgrades in Ubuntu for Automated Security Patches

Maintaining timely patch cadence across Linux servers is one of the most critical responsibilities of modern systems administration. Unpatched vulnerabilities in core system libraries, SSH daemons, web servers, or network stacks leave infrastructure vulnerable to remote exploits, ransomware, and privilege escalation attacks. In Debian and Ubuntu environments, the native unattended-upgrades utility provides an automated, resilient mechanism to detect, download, and apply high-priority security updates without requiring manual human intervention.

When configured properly, unattended-upgrades ensures that Common Vulnerabilities and Exposures (CVE) patches are deployed within hours of release, while preventing disruptive feature upgrades from inadvertently modifying production package dependencies. This guide walks through installing unattended-upgrades on Ubuntu Server and Desktop, configuring automated security repositories, setting up email alerts, and managing scheduled reboots.

Installing the unattended-upgrades Package on Ubuntu

While the package is included by default on many modern Ubuntu Server LTS installations, you can install and verify its status using APT:

sudo apt update
sudo apt install unattended-upgrades apt-listchanges bsd-mailx

The companion packages apt-listchanges and bsd-mailx allow the system to log release notes and transmit email notifications regarding applied security updates.

Enabling Automated Upgrades via dpkg-reconfigure

To initialize the underlying systemd timers and APT periodic configuration hooks, execute:

sudo dpkg-reconfigure -plow unattended-upgrades

A graphical terminal dialogue will appear asking: “Automatically download and install stable updates?”. Select Yes and press Enter. This command automatically generates the required periodic triggers inside /etc/apt/apt.conf.d/20auto-upgrades.

Configuring Allowed Repositories and Security Filters

The primary configuration file for unattended-upgrades is located at /etc/apt/apt.conf.d/50unattended-upgrades. Open this file in your preferred text editor with administrative privileges:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Locate the Unattended-Upgrade::Allowed-Origins directive. Ensure that only trusted security suites are active by checking that security lines are uncommented while general updates remain disabled if you require maximum stability:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    // "${distro_id}:${distro_codename}-updates";
    // "${distro_id}:${distro_codename}-proposed";
    // "${distro_id}:${distro_codename}-backports";
};

Leaving only the ${distro_codename}-security line enabled guarantees that only certified security fixes will install automatically, preventing unexpected service restarts caused by routine feature updates.

Configuring Package Blacklists and Exclusions

If your server runs specific proprietary or mission-critical packages that should never update automatically (such as a database server or a pinned custom web daemon), add them to the package blacklist section:

Unattended-Upgrade::Package-Blacklist {
    "nginx";
    "postgresql.*";
    "docker-ce";
};

Regex wildcards (such as postgresql.*) allow you to exclude entire package families from automated patching cycles.

Configuring Automated Reboots and Notification Alerts

Certain critical security updates—particularly Linux kernel releases—require a system reboot to replace active memory modules. You can configure unattended-upgrades to reboot your server safely during predefined maintenance windows:

1. Scroll down to the Automatic-Reboot block in /etc/apt/apt.conf.d/50unattended-upgrades.
2. Uncomment and enable the following lines:

   Unattended-Upgrade::Automatic-Reboot "true";
   Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
   Unattended-Upgrade::Automatic-Reboot-Time "03:00";

   This configuration instructs Ubuntu to initiate an automatic restart at 03:00 AM server time only when an update explicitly requires it.
3. Configure administrator email notifications by setting your recipient address:

   Unattended-Upgrade::Mail "[email protected]";
   Unattended-Upgrade::MailReport "on-change";

   Setting MailReport to on-change ensures you only receive alerts when an update is actually deployed or an error occurs, avoiding daily spam.
4. Save the file and exit the editor by pressing Ctrl + O and Ctrl + X.

Testing and Simulating Automated Upgrades via Dry Run

Before relying on unattended-upgrades in a production environment, execute a simulated dry run to verify that your configuration syntax is valid and allowed origins are recognized:

sudo unattended-upgrade --dry-run --debug

Review the terminal output. The utility will evaluate existing APT cache headers, report which packages are eligible for security upgrades, and simulate the installation without touching your disk partitions.

Monitoring System Logs and Audit Trails

All automated upgrade activities are logged for auditing and regulatory compliance. You can review past execution records using:

cat /var/log/unattended-upgrades/unattended-upgrades.log

To inspect whether a reboot is currently pending following a kernel patch, check the presence of the system reboot sentinel:

cat /var/run/reboot-required

Implementing unattended-upgrades establishes an enterprise-grade, set-and-forget security perimeter across your Ubuntu servers, protecting your infrastructure against emerging vulnerabilities with minimal administrative overhead.