Debian security updates without surprises: a minimal unattended-upgrades policy

You have a Debian host that must stay patched, but you do not want a full upgrade train running at 3am, and you definitely do not want an automatic reboot taking a service offline. The practical compromise is to automate only security updates from the release -security archive, preview what would change, and keep reboots manual.

Debian ships unattended-upgrades for exactly this. It is a daemon-driven APT wrapper that installs updates from origins you explicitly allow. The default security profile targets ${distro_id}:${distro_codename}-security, which maps to the official Debian Security archive for the installed release. The policy is split across two files: /etc/apt/apt.conf.d/20auto-upgrades controls periodic apt behavior, and /etc/apt/apt.conf.d/50unattended-upgrades controls which origins are allowed, mailing, and reboot behavior.

Minimal safe policy

The minimal safe baseline enables package list updates and unattended upgrades, restricts origins to security, disables automatic reboot, and mails a summary to root.

Check the package is present, as root on the host:

dpkg -l unattended-upgrades

Enable the periodic behavior in /etc/apt/apt.conf.d/20auto-upgrades:

// 20auto-upgrades
APT::Periodic::Update-Package-Lists \"1\";
APT::Periodic::Unattended-Upgrade \"1\";

Restrict origins in /etc/apt/apt.conf.d/50unattended-upgrades. The key line is the origin pattern:

// 50unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
        \"${distro_id}:${distro_codename}-security\";
};
// Do not auto-reboot
Unattended-Upgrade::Automatic-Reboot \"false\";
Unattended-Upgrade::Mail \"root\";
Unattended-Upgrade::MailReport \"on-change\";

${distro_id} and ${distro_codename} are expanded by unattended-upgrades from /etc/os-release. This means the rule follows the release you are actually running, e.g., debian:bookworm-security, without hard-coding the codename.

Keep your APT sources containing the security archive for the release. A typical sources.list entry is:

deb http://security.debian.org/debian-security/ ${codename}-security main contrib non-free

Replace ${codename} with the release you are running. If pinning is in use, verify it does not override the origin check.

Preview before you trust

Unattended-upgrades supports a dry-run that prints what would be installed without making changes. Run as root:

unattended-upgrades --dry-run --debug

Expected checks: the debug output lists candidate packages and shows their origin. You should see only packages from the -security origin. If you see updates from updates, backports, or third-party repositories, the Allowed-Origins list is too permissive.

After a real run, review the log:

cat /var/log/unattended-upgrades/unattended-upgrades.log

The log records which packages were upgraded and which origins were considered. This is the practical way to confirm the policy is honoring the security-only restriction.

Reboot and service caveats

Unattended-upgrades does not force a reboot by default. A new kernel can be installed but will not become active until you reboot manually. That is intentional for production hosts, but it means a security fix for the kernel is only effective after a planned restart.

Automatic upgrades can also trigger service restarts via systemd's restart-if-changed logic. Schedule maintenance windows or test on a staging host that mirrors production packages and services before rolling the policy out broadly.

Non-security updates, backports, and kernel upgrades are not applied unless you explicitly add origins. Allowing them expands scope beyond Debian security support and increases change risk.

Configuration syntax and variable expansion can differ between unattended-upgrades versions. Validate the files on the target release rather than copying blindly.

Actionable close

Install unattended-upgrades, enable periodic updates, allow only ${distro_id}:${distro_codename}-security, disable automatic reboot, and require a dry-run plus log review before considering the policy live. Keep reboots manual and review logs after each run to ensure only security-origin packages were touched.