Unattended-upgrades: auto-install security patches on Debian/Ubuntu

Configure automatic installation of security-only package updates with email notification and reboot handling.

Server SecurityBeginner

Why

Unpatched CVEs are the #1 cause of breaches. Manual patching at 3am doesn't scale; unattended-upgrades installs only security updates automatically, with email alerts and optional auto-reboot, keeping servers current without ops overhead.

Verizon's 2024 DBIR shows 68% of breaches involve a non-malicious human element. SSH key compromise and misconfigured S3 buckets are top attack vectors — hardening reduces breach risk by 80%+.

When

Use on every Debian/Ubuntu server. Disable auto-reboot on production databases; enable on stateless web tiers.

How

1. Install: `apt install unattended-upgrades apt-listchanges`. 2. Reconfigure: `dpkg-reconfigure -plow unattended-upgrades`. 3. Edit /etc/apt/apt.conf.d/50unattended-upgrades: set Unattended-Upgrade::Allowed-Origins to include security, add Unattended-Upgrade::Mail "[email protected]", set Unattended-Upgrade::Automatic-Reboot "true" and Automatic-Reboot-Time "04:00". 4. Edit /etc/apt/apt.conf.d/20auto-upgrades: APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1";. 5. Test: `unattended-upgrade --dry-run -v`. 6. Logs at /var/log/unattended-upgrades/.

Example

# /etc/apt/apt.conf.d/50unattended-upgrades (excerpt) Unattended-Upgrade::Allowed-Origins { "\${distro_id}:\${distro_codename}-security"; "\${distro_id}ESMApps:\${distro_codename}"; }; Unattended-Upgrade::Mail "[email protected]"; Unattended-Upgrade::MailReport "on-change"; Unattended-Upgrade::Automatic-Reboot "true"; Unattended-Upgrade::Automatic-Reboot-Time "04:00"; Unattended-Upgrade::Remove-Unused-Kernel-Packages "true"; Unattended-Upgrade::Remove-Unused-Dependencies "true"; # /etc/apt/apt.conf.d/20auto-upgrades APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1"; # Dry run to verify unattended-upgrade --dry-run -v

Common Problems

⚠Auto-reboot during peak traffic — set Automatic-Reboot-Time to a low-traffic window (e.g. 04:00).
⚠A bad kernel update panics on reboot — keep the previous kernel installed and set GRUB default to fallback.
⚠Mail isn't sent because no MTA is installed — install postfix or use needrestart's mail hook.

Best Practices

✓Enable only security origins, not all updates — full auto-upgrade can break apps on a minor-version jump.
✓Use Automatic-Reboot-WithUsers 'false' so a logged-in admin blocks reboot; or 'true' with a 5min warning.
✓Pin critical packages (Unattended-Upgrade::Package-Blacklist) like docker, nginx if you upgrade them manually.

FAQ

What is Unattended-upgrades: auto-install security patches on Debian/Ubuntu and what problem does it solve?

Configure automatic installation of security-only package updates with email notification and reboot handling. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Unattended-upgrades: auto-install security patches on Debian/Ubuntu in 5 minutes?

Two steps to run it: (1) Install: `apt install unattended-upgrades apt-listchanges`.; (2) Reconfigure: `dpkg-reconfigure -plow unattended-upgrades`.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Unattended-upgrades: auto-install security patches on Debian/Ubuntu?

The most frequent issue is: Auto-reboot during peak traffic — set Automatic-Reboot-Time to a low-traffic window (e.g. 04:00).. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Unattended-upgrades: auto-install security patches on Debian/Ubuntu?

Best practices for Unattended-upgrades: auto-install security patches on Debian/Ubuntu include: Enable only security origins, not all updates — full auto-upgrade can break apps on a minor-version jump.; Use Automatic-Reboot-WithUsers 'false' so a logged-in admin blocks reboot; or 'true' with a 5min warning.; Pin critical packages (Unattended-Upgrade::Package-Blacklist) like docker, nginx if you upgrade them manually.. The first one — "Enable only security origins, not all updates — full auto-upgrade can break apps on a minor-version jump." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Unattended-upgrades: auto-install security patches on Debian/Ubuntu?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Unattended-upgrades: auto-install security patches on Debian/Ubuntu options offer a free tier — validate within free quota before scaling.