How to Set Up Unattended Upgrades in Ubuntu Linux

If you are managing an Ubuntu server or relying on an Ubuntu desktop for development, staying on top of security patches is critical. However, manually logging in every day to run sudo apt update and sudo apt upgrade is inefficient and easy to forget. To keep your system secure automatically, you need to set up unattended upgrades.

The unattended-upgrades package automatically downloads and installs security updates in the background, ensuring your system is protected against zero-day vulnerabilities without requiring manual intervention.

Why Use Unattended Upgrades?

While enabling automatic updates might sound risky for a production environment, Ubuntu’s unattended upgrades are specifically designed to be safe. By default, the tool only installs essential security patches, actively ignoring feature updates or major version changes that could potentially break your software dependencies.

Step 1: Install the Required Packages

Most modern Ubuntu installations come with the unattended-upgrades package pre-installed. However, it is best to verify its presence and install the update-notifier-common package, which helps manage automatic reboots if required.

1. Open your terminal or connect to your server via SSH.
2. Run the following command to ensure your package list is up to date:
   sudo apt update
3. Install the necessary tools by running:
   sudo apt install unattended-upgrades update-notifier-common

Step 2: Enable Automatic Updates

Once installed, you need to explicitly enable the service using the Debian package configuration tool.

1. Run the following command in your terminal:
   sudo dpkg-reconfigure --priority=low unattended-upgrades
2. A pink configuration screen will appear, asking if you want to automatically download and install stable updates. Use your arrow keys to select Yes and press Enter.

This action generates a configuration file at /etc/apt/apt.conf.d/20auto-upgrades that tells the APT package manager to run the upgrade script daily.

Step 3: Configure the Upgrades for Maximum Safety

To ensure your server remains stable, you should verify that only security updates are being installed automatically. You can customise this in the primary configuration file.

1. Open the configuration file using the nano text editor:
   sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
2. Look for the section labelled Unattended-Upgrade::Allowed-Origins.
3. Ensure that the line ending in -security"; is uncommented (meaning it does not have two forward slashes // at the beginning).
4. Ensure that lines ending in -updates"; or -backports"; remain commented out with //. This prevents feature updates from breaking your server.
5. Press Ctrl + O then Enter to save, followed by Ctrl + X to exit nano.

Step 4: Enable Automatic Reboots (Optional)

Some critical security patches, such as kernel updates, require a system reboot to take effect. If you are comfortable with your server rebooting itself during the night, you can automate this process.

1. Open the configuration file again:
   sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
2. Scroll down to find the line: //Unattended-Upgrade::Automatic-Reboot "false";
3. Remove the // and change “false” to “true”.
4. Directly below it, you can set a specific time for the reboot to occur to minimise downtime (e.g., Unattended-Upgrade::Automatic-Reboot-Time "03:00";).
5. Save and exit the file.

Step 5: Test Your Configuration with a Dry Run

Before leaving your server to its own devices, you should run a test to ensure the configuration works without actually installing anything.

Run the following command:

sudo unattended-upgrades --dry-run --debug

This will output a detailed log showing exactly what the script would do. If it successfully checks the repositories and parses your allowed origins without throwing syntax errors, your setup is complete.

Final Thoughts on Linux Server Security

Setting up unattended upgrades is one of the most effective steps you can take to secure an Ubuntu environment. By automating the installation of security patches, you drastically reduce the window of opportunity for attackers while maintaining the stability of your core applications.