Debian's unattended-upgrades package automates applying security updates without manual intervention — important for keeping a VPS patched against known vulnerabilities without requiring you to remember to update regularly.
Why This Matters Especially for Debian Stable
Debian Stable's security team issues timely patches for known vulnerabilities — but this only protects you if those patches are actually applied; unattended-upgrades closes the gap between patch availability and actual installation.
Step 1 — Install unattended-upgrades
sudo apt install unattended-upgrades apt-listchanges -yStep 2 — Enable It
sudo dpkg-reconfigure -plow unattended-upgradesSelect "Yes" when prompted to enable automatic updates.
Step 3 — Review the Configuration
sudo nano /etc/apt/apt.conf.d/50unattended-upgradesUnattended-Upgrade::Origins-Pattern {
"origin=Debian,codename=${distro_codename},label=Debian-Security";
};By default, this typically covers security updates — review whether you want to also include regular stable updates, which is a more significant decision since it applies non-security changes automatically too.
Step 4 — Enable Automatic Reboot If Needed (Optional, Use Caution)
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";Some updates (particularly kernel updates) require a reboot to fully take effect — automatic reboot ensures this actually happens, but introduces unattended downtime at the scheduled time; weigh this against manually managing reboots yourself.
Step 5 — Verify the Update Schedule
cat /etc/apt/apt.conf.d/20auto-upgradesAPT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";Step 6 — Test Unattended Upgrades Manually
sudo unattended-upgrade --dry-run --debugShows what would be upgraded without actually applying changes — useful for verifying configuration before relying on it running automatically.
Reviewing Logs
cat /var/log/unattended-upgrades/unattended-upgrades.logCheck periodically to confirm updates are actually being applied as expected, rather than assuming silent success.
Configuring Email Notifications
Unattended-Upgrade::Mail "[email protected]";
Unattended-Upgrade::MailReport "only-on-error";Get notified specifically when something goes wrong, without being flooded with routine success notifications for every automatic update.
Balancing Automation Against Control
For most VPS use cases, automating security updates specifically (not full stable updates) offers a good balance — security patches are generally low-risk to apply automatically, while broader stable updates might warrant more manual review before applying, especially for production systems with specific dependency requirements.
Common Errors
Updates configured but nothing seems to be applying — verify the systemd timer for the periodic update check is actually active: systemctl status apt-daily-upgrade.timer.
Continue Reading
- How to Enable Automatic Security Updates on Ubuntu & Debian
- Debian Security Advisories: How to Stay Informed and Patch Promptly
- How to Manage Debian's APT Sources and Repositories
Browse more articles in Debian VPS Tutorials.
