Automatic security updates on Ubuntu and Debian

unattended-upgrades installs security updates by itself, once a day. On Ubuntu it is installed and on by default; on Debian you may have to install it. This guide checks that it runs, adds PHP from Ondřej Surý's repositories (which it skips by default) and shows how to test it.

Check that it is installed and on#

1. Install it (nothing happens if it is already there):

   Copier

   sudo apt update
   sudo apt install unattended-upgrades
   

2. Check that it runs every day:

   Copier

   cat /etc/apt/apt.conf.d/20auto-upgrades
   

   You should see:

   Copier

   APT::Periodic::Update-Package-Lists "1";
   APT::Periodic::Unattended-Upgrade "1";
   

   The number is the number of days between runs; 0 turns it off. If the file is missing, create it with:

   Copier

   sudo dpkg-reconfigure unattended-upgrades
   

   and answer Yes.

What it installs by default#

The settings are in /etc/apt/apt.conf.d/50unattended-upgrades. By default it installs only updates from your distribution's security repository (and, on Ubuntu, from ESM where you have it). Normal bug-fix updates, and packages from extra repositories such as a PPA, are skipped.

Do not edit 50unattended-upgrades itself: an update of the package can then conflict with your changes. Put your own settings in a new file that sorts after it, such as /etc/apt/apt.conf.d/52unattended-upgrades-local.

Include PHP from Ondřej Surý's repositories#

If your PHP comes from ppa:ondrej/php or packages.sury.org (see update PHP on Ubuntu or Debian), unattended-upgrades does not update it unless you allow that repository.

1. Create the file:

   Copier

   sudo nano /etc/apt/apt.conf.d/52unattended-upgrades-local
   

2. Add the line for the repository you use.

   For the PPA on Ubuntu:

   Copier

   Unattended-Upgrade::Origins-Pattern {
       "origin=LP-PPA-ondrej-php,codename=${distro_codename}";
   };
   

   For packages.sury.org:

   Copier

   Unattended-Upgrade::Origins-Pattern {
       "origin=deb.sury.org,codename=${distro_codename}";
   };
   

   These entries are added to the default list; they do not replace it.

3. Check that apt sees the repository under that name:

   Copier

   apt-cache policy | grep -E 'ondrej|sury'
   

   The lines below it show o=LP-PPA-ondrej-php or o=deb.sury.org.

Restart PHP-FPM and other services after an update#

A security update of a program only helps once the program is restarted. To see which services still run old files, install needrestart and let it list them:

sudo apt install needrestart
sudo needrestart -r l

For PHP, you can always restart PHP-FPM yourself, for example sudo systemctl restart php8.3-fpm.

Reboot automatically or not#

Kernel updates only count after a reboot. By default, unattended-upgrades never reboots. To let it reboot at a quiet time when an update needs it, add to your 52unattended-upgrades-local file:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

The time is the server's local time. Leave this out if a reboot at night would hurt (for example game servers with players at that time), and reboot by hand instead. On Ubuntu, the file /var/run/reboot-required exists when an update needs a reboot.

Test it#

1. A dry run shows what it would do, without changing anything:

   Copier

   sudo unattended-upgrade -v --dry-run
   

2. The logs are in /var/log/unattended-upgrades/:

   Copier

   sudo tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log
   

Keep a package from being updated#

If a package must not be updated automatically, add it to the block list in your local file. Each entry is a regular expression on the package name:

Unattended-Upgrade::Package-Blacklist {
    "linux-";
};

Blocking a package can also stop other updates that depend on it.

Automatic updates do not replace a backup: see back up your server before an update.