How to Enable Ubuntu’s Unattended‑Upgrades for Automatic Security Patching

Why Automatic Security Updates Matter

In a production environment, missing a critical security patch can expose services to exploits. Ubuntu’s unattended‑upgrades package is designed to apply such patches without manual intervention. The feature reads /etc/apt/apt.conf.d/50unattended-upgrades, pulls packages from the configured APT repositories, and runs them through a daily systemd timer. The result is a machine that stays patched even if an administrator forgets to run apt update && apt upgrade.

Thesis: Enable, Verify, Monitor

Enabling unattended‑upgrades is straightforward, but it requires careful verification. The steps below will:

• Activate automatic security updates.
• Confirm the systemd timer is active.
• Show how to inspect the log to prove the feature worked.
• Highlight the main trade‑off: potential reboots and broken custom configs.

Step 1 – Install the Package (If Needed)

Most Ubuntu installations already ship with unattended‑upgrades. If it’s missing, install it:

sudo apt update
sudo apt install unattended-upgrades

Running the install will create the default configuration file /etc/apt/apt.conf.d/50unattended-upgrades.

Step 2 – Configure Automatic Security Updates

Edit the config file to allow all security packages. Open it in your editor of choice:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Locate the Allowed-Origins section and ensure it contains a wildcard entry for security updates:

Allowed-Origins {
    "Ubuntu:Security";
    "${distro_id}:${distro_codename}-security";
    "*"; // Accept all security updates from any repo
}

Below the options, enable the automatic upgrade flag:

Unattended-Upgrade::Automatic-Upgrade "true";

Save the file and exit. To apply the changes immediately, run the reconfigure wizard:

sudo dpkg-reconfigure unattended-upgrades

Choose Yes when prompted to enable automatic updates.

Step 3 – Verify the Systemd Timer

The feature is driven by a timer that runs daily at 02:00 UTC by default. Check its status:

systemctl status unattended-upgrades.timer

You should see output similar to:

● unattended‑upgrades.timer - Daily unattended-upgrades
   Loaded: loaded (/lib/systemd/system/unattended‑upgrades.timer; enabled; vendor preset: enabled)
   Active: active (waiting) since ...

To confirm the service itself is installed:

ls /lib/systemd/system/unattended-upgrades.service

Step 4 – Inspect the Log After a Reboot

After the next reboot, the system will have applied any pending security updates. Verify by looking at the APT history log:

grep -i security /var/log/apt/history.log

Entries will show the package names and the unattended‑upgrades command that installed them. For example:

Start-Date: 2026-11-12 02:00:00
Commandline: unattended‑upgrades
Install: libssl1.1:amd64 (1.1.1f-1ubuntu2.16), openssl:amd64 (1.1.1f-1ubuntu2.16)

Running dpkg -l | grep libssl confirms the packages are present.

Trade‑Offs and Practical Limits

• Reboots: Some security updates require a kernel or initramfs change. unattended‑upgrades can be configured to automatically reboot, but this may disrupt services. Set Unattended-Upgrade::Automatic-Reboot "false"; if you prefer manual control.
• Custom Configs: If you have patched a package manually or rely on a specific version, automatic upgrades may overwrite your changes. Use Unattended-Upgrade::Package-Blacklist to exclude those packages.
• Third‑Party Repos: The wildcard * in Allowed-Origins will pull security updates from any configured repository, including PPAs. Verify that those PPAs are trustworthy before enabling the wildcard.
• Audit: Regularly review /var/log/unattended-upgrades/unattended-upgrades.log to catch any errors or rejections.

Actionable Closing

By enabling unattended‑upgrades and verifying the timer and logs, you can keep your Ubuntu servers patched automatically. Remember to:

• Set Automatic-Reboot according to your service availability requirements.
• Blacklist any package that must not be updated automatically.
• Periodically review the log files to ensure no errors are occurring.

With these safeguards, you achieve the balance of rapid security patching and controlled system stability.