Automatic Security Updates in Ubuntu — Setup Guide

curl -sSL https://cp.lv/scripts/avtomaticheskie-obnovleniya-ubuntu.sh | sudo bash

wget -qO- https://cp.lv/scripts/avtomaticheskie-obnovleniya-ubuntu.sh | sudo bash

#!/usr/bin/env bash
# Set up unattended-upgrades: install, enable, automatic reboot
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

# 1. Install the package
sudo apt-get update -y
sudo apt-get install -y unattended-upgrades

# 2. Enable the daily check and install (20auto-upgrades file)
sudo tee /etc/apt/apt.conf.d/20auto-upgrades > /dev/null << 'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF

# 3. Security patches only, reboot automatically at 04:00
sudo tee /etc/apt/apt.conf.d/51custom-unattended > /dev/null << 'EOF'
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
EOF

# 4. Verify the configuration with a dry run
sudo systemctl enable --now unattended-upgrades
sudo unattended-upgrades --dry-run --debug || true
echo "Done: automatic security updates are enabled."

Automatic security updates in Ubuntu are handled by the unattended-upgrades package: it checks for and installs security patches every day without your involvement. That closes vulnerabilities before anyone gets to use them. Here is the setup step by step.

Step 1. Install the package

Most Ubuntu images already ship with it, but installing it does no harm:

sudo apt update
sudo apt install unattended-upgrades -y

Step 2. Enable automatic updates

Start the interactive configuration:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Choose Yes in the dialog. This creates the file /etc/apt/apt.conf.d/20auto-upgrades with the following content:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

The ones mean “run daily”.

You can create the same file in a single command, without the interactive dialog — copy it and paste it into the console (the heredoc writes the whole file):

sudo tee /etc/apt/apt.conf.d/20auto-upgrades > /dev/null << 'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF

Step 3. Choose what gets updated

Open the main config:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

By default only security updates are enabled, which is the right choice for a server. Make sure the line with -security is active inside the Allowed-Origins block:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

Step 4. Configure the automatic reboot

Some updates (kernels, for example) only take effect after a reboot. To have the server reboot automatically at a convenient time, uncomment and set these parameters in the same file:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

The reboot happens at 4 a.m. only if one is actually required. If the server must not reboot on its own, leave false and reboot manually.

Step 5. Set up email notifications (optional)

To receive emails about the updates that were applied, set an address:

Unattended-Upgrade::Mail "[email protected]";
Unattended-Upgrade::MailReport "on-change";

Sending mail requires a configured MTA (postfix or ssmtp, for example).

Step 6. Verify that it works

Run a dry run without installing anything:

sudo unattended-upgrades --dry-run --debug

To see the log of updates that were already applied:

cat /var/log/unattended-upgrades/unattended-upgrades.log

To check whether a reboot is required:

ls /var/run/reboot-required

If the file exists, the kernel or libraries were updated and a reboot is needed.

What is and is not worth updating automatically

Frequently asked questions

Will automatic updates break the server? Security updates backport only the fixes and do not change core functionality, so the risk is minimal. Full release upgrades are never installed automatically.

Should I enable the automatic reboot? If a short night-time outage is acceptable, yes — otherwise the kernel stays un-updated. If a reboot is not desirable, leave false and schedule it manually based on the reboot-required flag.

How do I turn automatic updates off temporarily? Set APT::Periodic::Unattended-Upgrade "0"; in the 20auto-upgrades file, or remove the unattended-upgrades package.

Do automatic updates replace manual oversight? They close security patches, but you still have to watch the server: check the logs, free space and whether a reboot is pending.

Summary

unattended-upgrades is a simple way to keep a server patched without a daily manual apt upgrade. Enable security updates, set up the automatic reboot where you can, and check the logs from time to time.

Want a server for your own project? Take a Linux VPS, order VPS hosting, or order Server administration if you would rather leave maintenance to specialists.