How to turn on automatic security updates on Ubuntu and Debian

1. Install it

Many Ubuntu servers have it already. Running this is safe either way:

sudo apt update
sudo apt install unattended-upgrades

2. Turn it on

sudo dpkg-reconfigure -plow unattended-upgrades

When it asks to download and install stable updates automatically, choose Yes. Then check the switch file:

cat /etc/apt/apt.conf.d/20auto-upgrades

You should see both lines set to "1":

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

That's it. Once a day (around 6 in the morning, server time, with a random delay of up to an hour) the server fetches the package lists and installs any new security fixes.

What it updates

• Ubuntu: security updates only. Normal bug-fix updates wait for you.
• Debian: security updates, plus the fixes in Debian's regular "point releases" (for example 13.1 to 13.2). These are small, tested fixes.

The list lives in /etc/apt/apt.conf.d/50unattended-upgrades. You rarely need to change it.

3. Check that it works

Do a test run. It shows what it would install, without installing anything:

sudo unattended-upgrade --dry-run --debug

Look for the line Allowed origins are: (where it takes updates from) and, at the end, Packages that will be upgraded: or No packages found that can be upgraded unattended.

After the first real run, read the logs:

sudo less /var/log/unattended-upgrades/unattended-upgrades.log

The full install output is in unattended-upgrades-dpkg.log in the same folder.

4. Decide about restarts

Most fixes work straight away. Fixes for the Linux kernel, and a few core parts of the system, only work after the server restarts. When that's needed, the file /var/run/reboot-required appears. Check it with:

ls /var/run/reboot-required

By default, unattended-upgrades never restarts the server. You have two choices:

• Restart by hand (the default). No surprise downtime, but kernel fixes don't protect you until you remember to restart.
• Restart automatically at a quiet time. Fixes always take effect, but your sites are down for a minute or two at that time, a few times a month. Make sure your services start again on their own after a restart.

To restart automatically at 3 in the morning (server time), put your own settings in a separate file, so package updates never overwrite them:

sudo nano /etc/apt/apt.conf.d/52unattended-upgrades-local

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

It only restarts when a restart is actually needed. Check your server's time zone with date.

5. Restart services after updates (needrestart)

When a shared library such as OpenSSL is updated, programs that are already running (PHP-FPM, Nginx, your queue workers) keep using the old copy until they restart. needrestart finds them. Ubuntu Server usually has it. On Debian, install it:

sudo apt install needrestart

See which services still use old files:

sudo needrestart -r l

When no one is at the keyboard, as during automatic updates, needrestart only lists services. It doesn't restart them. To let it restart them on its own, create /etc/needrestart/conf.d/50-autorestart.conf with this line:

$nrconf{restart} = 'a';

Each service restart takes about a second. If you'd rather choose the moment, leave it out and run sudo needrestart yourself.

6. Optional: email reports

Add these lines to your 52unattended-upgrades-local file to get an email when something goes wrong:

Unattended-Upgrade::Mail "you@example.com";
Unattended-Upgrade::MailReport "only-on-error";

Use "on-change" to get an email every time something is installed. This only works if the server can send email (a package such as bsd-mailx plus a working mail setup). If you're not sure, skip it and check the log now and then.

What it doesn't cover

Software from other sources is left alone. That includes the popular PHP packages from Ondřej Surý: the ppa:ondrej/php PPA on Ubuntu and packages.sury.org on Debian. If your PHP comes from there, PHP security fixes are not installed automatically.

To include them, add the source to the same 52unattended-upgrades-local file. On Ubuntu with the PPA:

Unattended-Upgrade::Origins-Pattern {
        "origin=LP-PPA-ondrej-php";
};

On Debian with packages.sury.org:

Unattended-Upgrade::Origins-Pattern {
        "origin=deb.sury.org";
};

Run the test from step 3 again. The new source should now be in the Allowed origins are: line. Other repositories work the same way: apt-cache policy shows each source's o= (origin) name.

Also not covered: anything you installed without apt, such as WordPress plugins, Composer packages, Docker images or programs you downloaded by hand. Those need their own updates. For Composer, see our guide to keeping Composer packages safe and up to date.

Official sources

• Automatic updates (Ubuntu Server documentation)
• UnattendedUpgrades on the Debian wiki
• unattended-upgrade manual page (Ubuntu)
• needrestart manual page (Debian)

Next steps: set up a firewall with UFW, then work through the security checklist for a new PHP server. To see which PHP versions still get fixes, read PHP versions and security support.

ServerNest is being built to show which of your servers have updates waiting or need a restart, all in one dashboard. Join early access to try it first.

← Back to the security blog