Automated upgrades with Unattend Upgrades

The Unattended Upgrade package is helpful for upgrading your server automatically and keeping your computer secure. In this tutorial, I show you the necessary setup to do it. To check if the package is already installed you can run the following command:

# apt-get install unattended-upgrades

Either it is already installed or it will be installed. After this step, the configuration needs to be changed. The file is located in the following path:

# editor /etc/apt/apt.conf.d/50unattended-upgrades

In this file, you will find a lot of possible configurations. Take a look into the body of Origins-Pattern and uncomment the origins. This definition controls, which packages are upgraded.

Unattended-Upgrade::Origins-Pattern {
      "o=Debian,n=${distro_codename}";
      "o=Debian,n=${distro_codename}-updates";
      "o=Debian,n=${distro_codename}-proposed-updates";
      "o=Debian,n=${distro_codename},l=Debian-Security";
};

As you can see I’m using the Debian distribution. The preconfigured file could look different on your distribution. You will get notified if the upgrade fails when you set these two options.

// change the mail address
Unattended-Upgrade::Mail "foo@bar.com";
// get mails on error, only
Unattended-Upgrade::MailOnlyOnError "true";

To send mails you need to have the mailx package installed. You can install bsd-mailx to get it with the following command:

apt-get install bsd-mailx 

The next step is to enable automatic updates and create the configuration file for the update. Run the following command and click through it:

# dpkg-reconfigure -plow unattended-upgrades

You will find the created file at the following location:

# editor /etc/apt/apt.conf.d/20auto-upgrades

Set these configurations to run the update and upgrade daily.

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Now, you can test the automatic update by running it manually. To do so run the following command:

# unattended-upgrade -d

Find the unattended-upgrades logs at the following location:

# cat /var/log/unattended-upgrades/unattended-upgrades.log