Choosing unattended-upgrades for Security-Only Automation on Ubuntu LTS

Problem: unattended security patches without unintended upgrades

Ubuntu LTS hosts need security updates applied promptly, but automatic full upgrades (apt upgrade or apt dist-upgrade) risk removing packages, changing service defaults, or pulling in new kernel ABIs that require coordinated reboots. The engineering decision is to automate only the -security pocket using unattended-upgrades, keeping feature updates (-updates), backports, and third-party repositories under manual change control.

Requirements driving the design

• Ubuntu 22.04 LTS (Jammy) or 24.04 LTS (Noble) with systemd.
• Root or sudo access to modify APT configuration.
• Official Ubuntu security repository enabled in /etc/apt/sources.list or /etc/apt/sources.list.d/.
• No requirement for automatic reboots; maintenance windows are scheduled separately.
• No Ubuntu Pro / Expanded Security Maintenance (ESM) repositories in scope.

Smallest suitable design

Install the package and configure two files. The design intentionally omits Unattended-Upgrade::Automatic-Reboot and any origin beyond ${distro_id}:${distro_codename}-security.

# Run on the target host with root or sudo
sudo apt update
sudo apt install unattended-upgrades

/etc/apt/apt.conf.d/20auto-upgrades — enables daily index refresh and unattended run, with weekly cache cleanup:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

/etc/apt/apt.conf.d/50unattended-upgrades — restricts allowed origins to the security pocket only. The variable expansion ${distro_id}:${distro_codename}-security resolves to Ubuntu:jammy-security or Ubuntu:noble-security at runtime:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

# Explicitly disable automatic reboot even if a kernel update lands
Unattended-Upgrade::Automatic-Reboot "false";

# Optional: avoid email noise; logs are the primary audit trail
Unattended-Upgrade::Mail "";

Do not add -updates, -backports, or PPA origins unless a documented operational requirement exists. Each additional origin expands the trust boundary and the set of packages that can be installed without human review.

Trust and data boundaries

APT verifies repository metadata via GPG-signed Release files from security.ubuntu.com (or the configured mirror). The trust boundary is therefore the official Ubuntu security origin for the release codename. Packages from PPAs, third-party mirrors, or the -updates pocket are excluded unless explicitly added to Allowed-Origins.

Key filesystem locations:

• /var/lib/apt/lists/ — synchronized package indexes (read by unattended-upgrades)
• /var/cache/apt/archives/ — downloaded .deb files (cleaned weekly by AutocleanInterval)
• /var/log/unattended-upgrades/ — execution logs (primary audit trail)
• /etc/apt/apt.conf.d/ — configuration fragments (version-controlled in practice)

Operational checks

1. Package installed — any user:

   dpkg -s unattended-upgrades

   Expected: Status: install ok installed.
2. Dry-run preview — root or sudo:

   sudo unattended-upgrades --dry-run --debug

   Expected: output lists only packages whose origin matches *-security. No state changes occur.
3. Timer active — any user:

   systemctl list-timers --all | grep apt-daily

   Expected: apt-daily-upgrade.timer shows a future NEXT time.
4. Recent log — any user with read access:

   tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log

   Expected: entries show startup, evaluation, and either "No packages found" or a list of installed security packages.
5. Cross-check pending upgrades — any user:

   apt list --upgradable

   Expected: listed packages should be a subset of the dry-run candidates. If non-security packages appear, review Allowed-Origins and /etc/apt/sources.list.

Failure modes and design-change conditions

Failure mode	Detection	Response
Security repository unreachable	Dry-run or log shows fetch errors for security.ubuntu.com	Verify network and mirror entries in /etc/apt/sources.list; run sudo apt update manually
Package held back	apt-mark showhold lists the package	Decide whether to unhold with sudo apt-mark unhold <package> or accept the exclusion
Reboot required after kernel update	File /var/run/reboot-required exists	Schedule a maintenance window; do not enable automatic reboots unless uptime policy allows
DPKG lock conflict	Logs show Could not get lock /var/lib/dpkg/lock-frontend	Identify the other apt or unattended-upgrades process and wait for it to finish

Change the design when:

• A third-party PPA must be updated automatically — add its origin to Allowed-Origins after verifying its signing key and update cadence.
• Compliance mandates automatic reboots — set Unattended-Upgrade::Automatic-Reboot "true" and optionally Unattended-Upgrade::Automatic-Reboot-Time.
• The host is air-gapped — replace the upstream security origin with a local mirror and adjust Allowed-Origins accordingly.
• Ubuntu Pro / ESM repositories are in use — add ${distro_id}ESMApps:${distro_codename}-apps-security and ${distro_id}ESMInfra:${distro_codename}-infra-security to Allowed-Origins.

Rollback

Disabling automation without removing the package preserves configuration for re-enablement:

# Run as root or with sudo
sed -i 's/Unattended-Upgrade "1"/Unattended-Upgrade "0"/' /etc/apt/apt.conf.d/20auto-upgrades

To remove entirely: sudo apt remove unattended-upgrades. After rollback, schedule manual apt upgrade runs.

Limitation and verification

This note assumes standard Ubuntu LTS with network access to the official Ubuntu security archive and default APT configuration. It does not cover Ubuntu Pro, Expanded Security Maintenance, third-party kernels, or non-systemd variants. After applying the design, run the dry-run command and confirm that only security-origin packages are candidates; that result verifies the trust boundary has not expanded unintentionally.