Configure Automatic Security Updates on Debian with unattended-upgrades

Desired outcome

The Debian system automatically downloads and installs security updates from the official Debian security archive without manual intervention, reducing the window of exposure to known vulnerabilities.

Prerequisites

• A supported Debian release (e.g., Debian 11 bullseye or Debian 12 bookworm) with APT configured.
• Root access or a user account with sudo privileges.
• Working package sources that include the security repository (typically deb.debian.org/debian-security or security.debian.org).
• Network connectivity to reach the Debian mirrors.

Procedure

1. Update package index and install the tooling

   Run as root or with sudo:

   apt update && apt install unattended-upgrades apt-listchanges

   apt-listchanges is optional but provides changelog notes before upgrades.

2. Enable the unattended‑upgrades service

   Execute:

   dpkg-reconfigure -plow unattended-upgrades

   When prompted, answer “Yes” to enable automatic downloads and installations. This creates/updates /etc/apt/apt.conf.d/20auto-upgrades with:

   APT::Periodic::Update-Package-Lists "1";
   APT::Periodic::Unattended-Upgrade "1";
   

3. Review and adjust the policy file (optional)

   The main configuration lives in /etc/apt/apt.conf.d/50unattended-upgrades. By default only the security origin is enabled:

   Unattended-Upgrade::Allowed-Origins {
           "${distro_id}:${distro_codename}-security";
           // "${distro_id}:${distro_codename}-updates";
           // "${distro_id}:${distro_codename}-proposed";
           // "${distro_id}:${distro_codename}-backports";
   };
   

   To receive email after each run, set:

   Unattended-Upgrade::Mail "root";
   Unattended-Upgrade::MailOnlyOnError "true";
   

   To enable automatic reboots (use with caution), add:

   Unattended-Upgrade::Automatic-Reboot "true";
   Unattended-Upgrade::Automatic-Reboot-Time "02:00";
   

   Edit the file with your preferred editor (e.g., nano or vim) and save.

4. Start and enable the systemd timers

   The timers are usually enabled by the package, but you can verify and start them:

   systemctl enable --now apt-daily.timer
   systemctl enable --now apt-daily-upgrade.timer
   

Expected checks

• Dry‑run simulation – as root:

unattended-upgrade --dry-run --debug

Look for lines indicating candidate security updates and no fatal errors.

• Timer status:

systemctl list-timers apt-daily.timer apt-daily-upgrade.timer

Both timers should show “next” times and be “loaded active”.

• Log inspection after the next scheduled run:

grep -i "^" /var/log/unattended-upgrades/unattended-upgrades.log | tail -20

Entries should show packages being fetched, installed, or noted as held back.

• Security source presence:

grep -r security /etc/apt/sources.list /etc/apt/sources.list.d/

At least one line matching the security mirror should appear.

Recovery options

If an automatic update causes a problem:

1. Identify the offending package version from /var/log/apt/history.log:

grep "Upgrade:" /var/log/apt/history.log | tail -10

Downgrade to the previous version (replace pkg and version with the values from the log):

apt install pkg=version

If the issue is kernel‑related, reboot into an older kernel from the GRUB menu.

To disable further automatic upgrades temporarily, set the periodic flag to zero in /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Unattended-Upgrade "0";

Remember to re‑enable it after the problem is resolved.

Limitations and practical verification

• Automatic reboots are disabled by default; enabling them requires a maintenance window or a configured Automatic-Reboot-Time.
• Kernel updates are installed automatically but only take effect after a reboot, so uptime alone does not guarantee a patched kernel.
• Enabling origins beyond the security suite (e.g., -updates or -backports) increases the chance of unexpected behavior changes; review the changelogs if you do so.
• Exact option names and default security‑repository URLs can vary between releases; always verify against the commented examples in /etc/apt/apt.conf.d/50unattended-upgrades.

After completing the steps, run the dry‑run command and check the timers and logs as described above to confirm that the automation is active and functioning.