How to turn on automatic security updates on Ubuntu

Most compromised servers were not hit by clever zero-day attacks. They were running software with a known bug that had been fixed weeks or months earlier, and nobody installed the fix. Automatic security updates close that gap for you. Ubuntu has a built-in tool for it, called unattended-upgrades, and it takes about five minutes to turn on.

What it does, and what it does not

It does: download and install security updates for the operating system and installed packages, on a schedule, without you being there.

It does not:

  • Update software you installed by hand, such as a program from a download or a Docker image.
  • Update your applications' own packages, such as WordPress plugins or Node.js dependencies.
  • Restart the machine for you, unless you say so. Some updates, such as the kernel, only take effect after a reboot.

So it covers one important layer. The rest is still your job.

Install and enable

Ubuntu usually has the package already. Make sure:

sudo apt update
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

The last command asks whether to install updates automatically. Choose Yes. It creates a file, /etc/apt/apt.conf.d/20auto-upgrades, containing two lines:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

These mean "refresh the package lists every day" and "install upgrades every day".

What gets installed

The main settings are in /etc/apt/apt.conf.d/50unattended-upgrades. By default, only packages from the security channel are installed automatically, which is the safe and sensible choice. Regular updates, which may change behaviour, are left for you to apply when you choose.

You can leave the file as it is. The settings worth knowing about:

  • Unattended-Upgrade::Mail can email you a report, if the server has mail set up.
  • Unattended-Upgrade::Remove-Unused-Dependencies cleans up old packages to save disk space.
  • Unattended-Upgrade::Automatic-Reboot reboots when needed. See below.

Rebooting after kernel updates

A kernel update does nothing until the machine restarts. Ubuntu leaves a marker file when a reboot is needed. Check it:

ls /var/run/reboot-required

If the file exists, a restart is pending. You can reboot by hand at a quiet time, or let the system do it:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

Set a time when your users are asleep. Only enable automatic reboots if everything on the server starts again by itself after a restart. For that, services need to be enabled to start at boot. See How to run a service with systemd. For game servers and bots, check that they come back, and that a reboot does not cut off players unexpectedly. Another option is to schedule a regular maintenance window, as in Uptime and maintenance windows explained.

Test it

Run a dry run, which shows what would happen without installing anything:

sudo unattended-upgrade --dry-run --debug

Look for lines about the allowed origins and the packages it would upgrade. Errors here, such as a broken repository, show up before they cause a missed update.

Check what it did

Logs are in /var/log/unattended-upgrades/:

sudo less /var/log/unattended-upgrades/unattended-upgrades.log

You will see which packages were upgraded and when. Make it a habit to glance at it now and then.

Things to watch for

  • Services restart. When a package such as a web server is upgraded, its service may restart briefly. This is normally fine.
  • Database major versions. Security updates stay within a version, but if you pinned or held a package, it will not update. Review held packages occasionally with apt-mark showhold.
  • Third-party repositories. By default, only Ubuntu's own security updates are automatic. Software from other repositories, such as Docker's, needs a manual update or an extra setting.
  • Disk space. A full disk makes updates fail. See Fixing "No space left on device".

A fuller update routine

Automatic security patches are a baseline. Alongside them:

  1. Once a month, run sudo apt update && sudo apt upgrade to apply the rest, after taking a backup.
  2. Update your applications and containers on your own schedule.
  3. Reboot when reboot-required appears.
  4. Keep a record of what changed, so you can find the cause if something breaks.

Take backups before big updates. See How to back up your VPS with rsync.

Why it matters for the rest of your security

A firewall, key-only SSH and Fail2ban reduce what attackers can reach. Updates fix the holes in what they can reach. Together they form the basics listed in Basic security for a new VPS. Skip any one, and the others protect you less.

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.