How to Set Up Automated Unattended Upgrades and Security Patching on Ubuntu Server 24.04 LTS

Maintaining security posture across cloud instances, on-premises virtual machines, and bare-metal production nodes requires swift application of Common Vulnerabilities and Exposures (CVE) security patches. However, relying strictly on manual SSH sessions and interactive apt upgrade runs leads to delayed patching windows, leaving server workloads exposed to zero-day vulnerabilities in OpenSSL, the Linux kernel, or standard system daemons.

Ubuntu Server integrates a robust automated patch management framework via the unattended-upgrades package. Maintained by Canonical and Debian upstream, this daemon periodically queries upstream security repositories, applies security-critical package updates silently in the background, cleans obsolete dependency libraries, and can optionally execute scheduled maintenance reboots outside business hours with automated email dispatch. This technical guide explains how to install, configure, simulate, and monitor unattended upgrades on Ubuntu Server 22.04 LTS and 24.04 LTS.

Architecture and Operational Model Overview

The unattended-upgrades subsystem operates via systemd timers that invoke APT periodic scripts:

System Component	Configuration File	Operational Role
APT Periodic Timers	/etc/apt/apt.conf.d/20auto-upgrades	Defines execution frequency for package list updates and automated installation cycles.
Upgrade Policy Rules	/etc/apt/apt.conf.d/50unattended-upgrades	Specifies allowed package origins (e.g., security-only), blacklists, email alerts, and reboot schedules.
Execution Logs	/var/log/unattended-upgrades/	Maintains detailed audit logs recording package installation outcomes and dpkg exit codes.

Step 1: Installing and Enabling the Service

On modern Ubuntu Server editions, the package is frequently pre-installed. Verify installation and initialize service configuration:

sudo apt update
sudo apt install -y unattended-upgrades update-notifier-common

To enable the automated service via the debconf interactive dialogue:

sudo dpkg-reconfigure --priority=low unattended-upgrades

When prompted with “Automatically download and install stable updates?”, select Yes.

Step 2: Configuring Update Frequency (20auto-upgrades)

Inspect the automation intervals declared in /etc/apt/apt.conf.d/20auto-upgrades:

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

Ensure the configuration reflects daily execution:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

• "1" — Executes daily (every 24 hours).
• AutocleanInterval "7" — Automatically purges obsolete .deb package caches from /var/cache/apt/archives every 7 days.

Step 3: Fine-Tuning Upgrade Policies and Package Origins (50unattended-upgrades)

The master configuration file is /etc/apt/apt.conf.d/50unattended-upgrades. Open it for editing:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

1. Restricting to Security Updates Only

Ensure the Allowed-Origins block strictly enables security updates to prevent disruptive application breaking changes:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    // "${distro_id}:${distro_codename}-updates";
};

Note: Keeping ${distro_codename}-updates commented out ensures only vetted security patches are installed automatically, leaving major feature upgrades for controlled maintenance windows.

2. Blacklisting Critical Daemons from Auto-Upgrades

To prevent sensitive database engines (such as PostgreSQL or MySQL) from restarting unexpectedly during business transactions, add them to the blacklist:

Unattended-Upgrade::Package-Blacklist {
    "nginx";
    "mysql-server";
    "postgresql.*";
};

3. Automating Dependency Housekeeping

To automatically uninstall orphaned kernel headers and unused package dependencies after upgrades:

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

4. Scheduling Automatic Reboots for Kernel Patches

Kernel security updates require a system reboot to activate. You can instruct Ubuntu to reboot automatically at a specific time when system load is minimal:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";

Step 4: Setting Up Administrator Email Notifications

To receive automated notifications when security patches install or if an update fails:

1. In 50unattended-upgrades, locate and configure the email alert parameter:

   Unattended-Upgrade::Mail "[email protected]";
   Unattended-Upgrade::MailReport "on-change";

   Using "on-change" ensures you receive alerts only when packages were upgraded or if an error occurred, preventing inbox spam on days when zero patches were released.

2. Ensure your server has a local mail transfer agent (MTA) like postfix or sSMTP configured to relay outbound mail to an authenticated SMTP server.

Step 5: Testing with a Dry-Run Simulation

Always simulate the unattended upgrade cycle to verify that your rules and blacklists evaluate properly without modifying installed software:

sudo unattended-upgrades --dry-run --debug

Review the detailed terminal output. The log indicates which packages are held back by blacklist rules and displays the exact simulated upgrade actions.

Auditing and Log Monitoring

To audit historical installations, inspect the persistent log files:

# View the summary log
cat /var/log/unattended-upgrades/unattended-upgrades.log

# Check whether a system reboot is currently pending following a kernel patch
cat /var/run/reboot-required