Base de connaissances

Unpatched software is one of the most common ways servers get compromised. The unattended-upgrades package automatically installs security patches as soon as they're published, without requiring you to log in and run apt upgrade manually.

Prerequisites

• Ubuntu or Debian VPS
• Root or sudo access

Step 1 — Install the Package

sudo apt update
sudo apt install unattended-upgrades apt-listchanges -y

Step 2 — Enable It

sudo dpkg-reconfigure --priority=low unattended-upgrades

Select Yes when prompted.

Step 3 — Review the Configuration

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Confirm the security repository line is uncommented, for example on Ubuntu:

"${distro_id}:${distro_codename}-security";

Step 4 — Enable Automatic Reboots (Optional)

Some kernel updates require a reboot to take effect. To automate this at a low-traffic time:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

Only enable automatic reboots on servers where a scheduled restart won't disrupt production traffic without warning.

Step 5 — Verify Updates Are Applied

sudo cat /etc/apt/apt.conf.d/20auto-upgrades

You should see:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Step 6 — Test a Dry Run

sudo unattended-upgrade --dry-run --debug

Step 7 — Monitor the Logs

sudo cat /var/log/unattended-upgrades/unattended-upgrades.log

Common Errors

Updates aren't being applied — verify the systemd timer is active: systemctl status apt-daily-upgrade.timer.

A critical service didn't restart after a library update — some packages require a manual service restart even after being patched; check needrestart for a list.

Best Practices

• Apply automatic updates only for the security repository, not full-upgrade, on production servers where controlled testing matters
• Install needrestart to be notified when a service needs restarting after a patch
• Keep a recent backup before enabling automatic reboots

FAQ

Will this update all packages, or just security patches?
By default, only the security repository is enabled — feature updates from the regular repository still require manual apt upgrade.

Is it safe to enable on a production server?
Yes, for security-only patches this is widely considered a best practice; just monitor logs and keep backups current.

Related Articles

• VPS Security Checklist for Beginners
• How to Update and Upgrade an Ubuntu/Debian VPS
• How to Set Up Automated VPS Backups