How to set up automatic updates on Ubuntu

Keeping your server updated is one of the most important things you can do for security. But remembering to run apt update && apt upgrade every week is easy to forget. Unattended-upgrades takes care of this for you.

It installs security updates automatically, so you do not have to think about it. Here is how to set it up.

Step 1: Install unattended-upgrades

The package is in Ubuntu's default repository:

sudo apt update
sudo apt install unattended-upgrades -y

Step 2: Enable it

sudo dpkg-reconfigure --priority=low unattended-upgrades

Select Yes when prompted. This creates the config file and enables the service.

Step 3: Check that the service is running

sudo systemctl status unattended-upgrades

It should show "active (running)".

Step 4: Understand the config file

The main configuration file is at /etc/apt/apt.conf.d/50unattended-upgrades. Open it to see what is enabled:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Look for this section:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    // "${distro_id}:${distro_codename}-updates";
    // "${distro_id}:${distro_codename}-proposed";
};

By default, only security updates are enabled (the lines without //). The -updates and -proposed lines are commented out. This is a safe default. Security updates are installed automatically, while regular updates are left for you to decide.

Step 5: Optional - enable regular updates

If you want all updates to be installed automatically, uncomment the updates line:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};

Step 6: Optional - configure automatic reboot

Some updates require a reboot (kernel updates, for example). You can let unattended-upgrades handle this:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

This reboots the server at 3 AM if needed. If you run critical services, you might prefer to handle reboots manually.

Step 7: Configure update schedule

The schedule is controlled by a separate file:

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

It should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";

This means:

• Update package lists every day

• Download upgrades every day

• Clean the package cache every 7 days

• Run unattended-upgrades every day

Step 8: Test the configuration

Run a dry run to see what would happen:

sudo unattended-upgrades --dry-run --debug

You will see a lot of output showing what packages would be updated. If there are no errors, the configuration is correct.

How to check what was installed

Update logs are stored in /var/log/unattended-upgrades/:

sudo less /var/log/unattended-upgrades/unattended-upgrades.log

Optional: Email notifications

If you want to receive an email when updates are installed, install mailutils and add this to the config:

Unattended-Upgrade::Mail "[e-mail]";
Unattended-Upgrade::MailOnlyOnError "true";

You will only get emails when something goes wrong.

Common questions

Will automatic updates break my server? Security updates are tested by Canonical before release. Breaking changes are rare. If you are worried, keep the default setting that only installs security updates.

What about kernel updates? Kernel updates require a reboot. If you enable automatic reboots, they happen at the time you configure. Services are stopped gracefully.

Can I stop an update in progress? Not really. Wait for it to finish or reboot the server. The package manager locks the database during updates.

What to watch out for

• Some applications expect specific package versions. If you run custom software, test updates on a staging server first.

• Automatic reboots can interrupt active connections. Schedule them for low-traffic hours.

• Check the logs occasionally to make sure updates are running successfully.

Conclusion

Set it up once and forget about it. Your server will receive security patches automatically, keeping it safer with no effort from you.