Managing servers and systems running Debian requires ongoing maintenance to ensure their security and stability. One key aspect of this maintenance is updating packages and security patches. However, performing these updates manually can be tedious and prone to oversights. To address this, Debian offers the unattended-upgrades tool , which automates this process.
In this guide, we'll explore in detail how to configure and manage unattended updates on Debian . You'll learn how to install the appropriate package, configure it to your needs, and monitor its operation to ensure everything is working correctly.
What is unattended-upgrades and what is it used for?
Unattended-upgrades is a package designed to automatically apply security updates and other packages to Debian and its derivatives, such as Ubuntu—which has had it enabled by default for several versions. Its purpose is to reduce the need for manual system administration by facilitating the automatic installation of important updates.
This tool is especially useful on servers that must remain constantly updated without manual intervention, minimizing vulnerabilities and ensuring a stable environment . Furthermore, the use of automatic updates is gaining popularity in various distributions such as Tails and Pop!_OS, which also implement similar solutions to maintain system security.
Installing unattended-upgrades
To install unattended-upgrades , simply run the following command in the terminal:
sudo apt install unattended-upgrades
Once installed, it is recommended to run its initial configuration with:
sudo dpkg-reconfigure -plow unattended-upgrades
This will open an interactive wizard where you can enable automatic updates.
NOTE: The service may already be installed and running in more recent versions of Debian.
Setting up unattended-upgrades
The behavior of unattended updates is defined in the configuration file /etc/apt/apt.conf.d/50unattended-upgrades . Here you can specify which repositories and types of updates you want to apply automatically.
Allow updates from certain sources
Within the configuration file, you'll find a section called Unattended-Upgrade::Allowed-Origins . By default, this list includes only security updates.
Unattended-Upgrade::Allowed-Origins { "${distro_id}:${distro_codename}-security"; };
If you wish to include other updates, such as general system updates , you can add the following lines:
Unattended-Upgrade::Allowed-Origins { "${distro_id}:${distro_codename}"; "${distro_id}:${distro_codename}-updates"; };
Exclude packages from automatic updates
If there are certain packages you don't want to update automatically , you can add them to the blacklist. Within the same configuration file, find the Unattended-Upgrade::Package-Blacklist section and add the packages you wish to exclude.
Unattended-Upgrade::Package-Blacklist { "linux-image"; "apache2"; };
Set up email notifications
If you want to receive notifications when updates are applied, you can enable this option in the settings:
Unattended-Upgrade::Mail "[email protected]";
You can also configure whether you only want to receive notifications in case of errors :
Unattended-Upgrade::MailOnlyOnError "true";
For more details on update management, you can consult how Debian might implement automatic updates in future versions.
Frequency and scheduling of updates
To define how often automatic updates run, edit the file /etc/apt/apt.conf.d/20auto-upgrades and make sure it contains the following:
APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1"; APT::Periodic::Download-Upgradeable-Packages "1"; APT::Periodic::AutocleanInterval "7";
This file defines that:
- Update lists are updated daily (1).
- Unattended updates are performed daily.
- Downloaded packages are removed every week.
If you're looking for more information on implementing automatic updates in different distributions, I invite you to read about how Pop!_OS implements these features.
Monitoring and verifying updates
To ensure that unattended-upgrades is working correctly, you can review the logs stored in /var/log/unattended-upgrades/ . To inspect the most recent log, use:
less /var/log/unattended-upgrades/unattended-upgrades.log
You can also manually run an upgrade simulation with:
sudo unattended-upgrade --dry-run -d
It is important to regularly monitor the logs to detect any anomalies.
Disabling unattended-upgrades
If you decide to disable unattended updates, you can do so by editing the file /etc/apt/apt.conf.d/20auto-upgrades and setting the values ​​to 0 :
APT::Periodic::Unattended-Upgrade "0";
You can also uninstall the package with:
sudo apt remove unattended-upgrades
Configuring automatic updates in Debian using unattended-upgrades is an excellent way to keep your systems up-to-date without manual intervention. With the right settings, you can ensure that only necessary updates are installed, minimizing risks and guaranteeing system stability.
