> For the complete documentation index, see [llms.txt](https://docs.ititanhosting.ro/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ititanhosting.ro/docs/english/vps/linux/how-to-set-up-automatic-updates-on-ubuntu.md).

# How to set up automatic updates on Ubuntu

Keeping your server updated is one of the most important things you can do for security. But remembering to run `apt update && apt upgrade` every week is easy to forget. Unattended-upgrades takes care of this for you.

It installs security updates automatically, so you do not have to think about it. Here is how to set it up.

### Step 1: Install unattended-upgrades

The package is in Ubuntu's default repository:

```bash
sudo apt update
sudo apt install unattended-upgrades -y
```

### Step 2: Enable it

```bash
sudo dpkg-reconfigure --priority=low unattended-upgrades
```

Select **Yes** when prompted. This creates the config file and enables the service.

### Step 3: Check that the service is running

```bash
sudo systemctl status unattended-upgrades
```

It should show "active (running)".

### Step 4: Understand the config file

The main configuration file is at `/etc/apt/apt.conf.d/50unattended-upgrades`. Open it to see what is enabled:

```bash
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
```

Look for this section:

```
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    // "${distro_id}:${distro_codename}-updates";
    // "${distro_id}:${distro_codename}-proposed";
};
```

By default, only security updates are enabled (the lines without `//`). The `-updates` and `-proposed` lines are commented out. This is a safe default. Security updates are installed automatically, while regular updates are left for you to decide.

### Step 5: Optional - enable regular updates

If you want all updates to be installed automatically, uncomment the updates line:

```
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};
```

### Step 6: Optional - configure automatic reboot

Some updates require a reboot (kernel updates, for example). You can let unattended-upgrades handle this:

```
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";
```

This reboots the server at 3 AM if needed. If you run critical services, you might prefer to handle reboots manually.

### Step 7: Configure update schedule

The schedule is controlled by a separate file:

```bash
sudo nano /etc/apt/apt.conf.d/20auto-upgrades
```

It should contain:

```
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
```

This means:

* Update package lists every day
* Download upgrades every day
* Clean the package cache every 7 days
* Run unattended-upgrades every day

### Step 8: Test the configuration

Run a dry run to see what would happen:

```bash
sudo unattended-upgrades --dry-run --debug
```

You will see a lot of output showing what packages would be updated. If there are no errors, the configuration is correct.

### How to check what was installed

Update logs are stored in `/var/log/unattended-upgrades/`:

```bash
sudo less /var/log/unattended-upgrades/unattended-upgrades.log
```

### Optional: Email notifications

If you want to receive an email when updates are installed, install `mailutils` and add this to the config:

```
Unattended-Upgrade::Mail "your@email.com";
Unattended-Upgrade::MailOnlyOnError "true";
```

You will only get emails when something goes wrong.

### Common questions

**Will automatic updates break my server?** Security updates are tested by Canonical before release. Breaking changes are rare. If you are worried, keep the default setting that only installs security updates.

**What about kernel updates?** Kernel updates require a reboot. If you enable automatic reboots, they happen at the time you configure. Services are stopped gracefully.

**Can I stop an update in progress?** Not really. Wait for it to finish or reboot the server. The package manager locks the database during updates.

### What to watch out for

* Some applications expect specific package versions. If you run custom software, test updates on a staging server first.
* Automatic reboots can interrupt active connections. Schedule them for low-traffic hours.
* Check the logs occasionally to make sure updates are running successfully.

### Conclusion

Set it up once and forget about it. Your server will receive security patches automatically, keeping it safer with no effort from you.