How to Set Up Automatic Security Updates on Ubuntu Server (unattended-upgrades)
You will forget to run apt upgrade. Everyone does. Ubuntu Server can install security updates by itself every night, and on a recent install it's already doing so — but the defaults leave reboots to you and tell you nothing. Ten minutes of configuration and the server patches itself, reboots at 4 am when it must, and emails you a summary.
Quick reference
| Task | Where |
|---|---|
| Install / check | sudo apt install unattended-upgrades -y |
| Turn on | sudo dpkg-reconfigure -plow unattended-upgrades → Yes |
| Settings | /etc/apt/apt.conf.d/50unattended-upgrades |
| Test run | sudo unattended-upgrade --dry-run --debug |
| What it did | /var/log/unattended-upgrades/unattended-upgrades.log |
1. Make sure it's on
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades
Choose Yes. That writes /etc/apt/apt.conf.d/20auto-upgrades with the daily schedule.
2. Decide what it installs
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
Near the top is the Allowed-Origins block. By default only the security line is active, which is the right choice for a server — bug-fix updates can wait for you. If you'd rather it install everything, remove the // from the -updates line.
3. Reboots
Kernel updates need a reboot. Scroll down and set:
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Remove the // at the start of each line. The last line stops it rebooting while someone's logged in. If a reboot would be a disaster — say the server runs a database you'd rather restart by hand — leave Automatic-Reboot as false and check for /var/run/reboot-required yourself.
4. Get told
Unattended-Upgrade::Mail "you@example.com";
Unattended-Upgrade::MailReport "on-change";
on-change emails only when it installed something or hit an error. The server needs a way to send mail — sudo apt install msmtp msmtp-mta and a short /etc/msmtprc with your email provider's SMTP details is the simplest.
5. Test it
sudo unattended-upgrade --dry-run --debug
It walks through what it would do without changing anything. Look for "Packages that will be upgraded" and no errors at the bottom.
6. See what it's done
less /var/log/unattended-upgrades/unattended-upgrades.log
Each run is logged: what was installed, whether a reboot was needed, whether it did one.
Docker and other things apt doesn't manage
This only covers packages from apt. Docker images are updated with docker compose pull && docker compose up -d — put that in a weekly cron job, or run Watchtower (a container that updates other containers). Snap packages update themselves already.
Troubleshooting
Nothing in the log for days. The timer isn't running: systemctl status apt-daily-upgrade.timer, and sudo systemctl enable --now apt-daily-upgrade.timer apt-daily.timer.
It rebooted during the day. Automatic-Reboot-Time isn't set, so it rebooted straight after installing. Set the time.
"Packages were kept back" / something didn't update. Unattended-upgrades is deliberately cautious and won't do upgrades that remove packages. Run sudo apt upgrade by hand to see what's waiting.
Updates broke something. Rare for security-only, but possible. The log shows exactly what changed; apt-get install package=old-version rolls one back. This is why you have backups (tutorial 23).
Wrapping up
Turn it on, keep it to security updates, let it reboot at 4 am, have it email you when it does. Check the log once a month. That's a server that stays patched without you remembering a thing.
