How to Configure Automatic Security Updates on Ubuntu

Quick take: Configure unattended-upgrades on Ubuntu Server, control reboots, test safely, read logs, and troubleshoot automatic security patching.

Why automatic patching matters

A security update protects a server only after it is installed. Ubuntu includes unattended-upgrades on current Server installations and normally runs it daily. This reduces the time that known vulnerabilities remain exposed, although larger fleets still need staged rollout, reporting, and maintenance-window controls.

Install and enable unattended-upgrades

sudo apt update
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
systemctl list-timers 'apt-daily*'

The timers include a randomized delay so many machines do not contact repositories simultaneously. Confirm backups and recovery procedures before automating production changes.

Control the schedule

Set the cadence in /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Values are measured in days: 1 means daily and 0 disables the action. Prefer a higher-priority drop-in file for local policy instead of editing package-owned defaults.

Configure safe reboots

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";

Enable automatic reboot only if the workload can restart in that window. Clustered and stateful services usually need traffic draining and coordinated reboots.

Test and troubleshoot

sudo unattended-upgrade --dry-run --debug
sudo tail -n 100 /var/log/unattended-upgrades/unattended-upgrades.log
test -f /var/run/reboot-required && cat /var/run/reboot-required

If APT reports a lock, check whether an APT timer is active rather than deleting lock files. Third-party repositories are not automatically eligible; review an origin carefully before allowing it.

Production implementation workflow

A reliable implementation of Ubuntu automatic security updates requires more than copying commands. Treat unattended-upgrades and the APT systemd timers as an operated service with ownership, validation, monitoring, and rollback. The objective is to protect Ubuntu servers while avoiding unpatched packages and uncontrolled reboots. The following workflow turns a lab configuration into a repeatable production practice.

Plan the change before touching production

Record the owner, affected hosts, maintenance window, rollback trigger, and expected user impact. A short written plan prevents an urgent technical change from becoming an untraceable operational event. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Establish a clean baseline

Capture the current version, configuration, service state, resource usage, and recent errors. Without a baseline, a later difference may be blamed on the change even when it existed beforehand. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Use a canary first

Apply the procedure to one representative non-critical host before a fleet rollout. The canary should use the same repositories, network path, data shape, and startup behavior as production. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Keep configuration reviewable

Store local policy in a clearly named file, document why each non-default value exists, and protect secrets separately. Reviewable configuration is easier to audit, reproduce, and roll back. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Validate syntax before reload

Use the product's validation command before restarting or reloading a service. Syntax checks catch common quoting, indentation, path, and option errors without creating avoidable downtime. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Separate availability from correctness

A process that exists is not proof that the service performs useful work. Test the behavior users depend on and distinguish startup, readiness, liveness, and dependency failures. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Observe the rollout

Watch logs, service state, resource graphs, and application responses during the change. Continue observing after the first success because delayed failures often appear under traffic or scheduled work. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Define a rollback trigger

Choose measurable conditions that stop the rollout, such as repeated failures, rising latency, missing data, or an unexpected restart. Decide the rollback action before pressure makes the decision harder. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Automate cautiously

Automation should be idempotent, produce an audit trail, and fail safely. Test both the successful path and the partial-failure path, including what happens when a host is offline or a dependency is unavailable. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Document the final state

Record the effective configuration, commands used, validation evidence, exceptions, and follow-up work. Good documentation shortens the next maintenance window and supports incident response. For Ubuntu automatic security updates, collect APT policy, unattended-upgrades logs, reboot-required state, and service health. Run sudo unattended-upgrade --dry-run --debug where appropriate and compare the result with the recorded baseline. Do not continue merely because the command exited successfully; confirm the expected behavior from the perspective of the workload.

Make the decision visible to the next engineer. Note how /etc/apt/apt.conf.d/60local-unattended-upgrades affects apt-daily-upgrade.timer, which assumption was tested, and what result proves success. This extra context is especially important when addressing unpatched packages and uncontrolled reboots, because the safest response depends on service design rather than a universal command.

Security and reliability checklist

Use this checklist before declaring Ubuntu automatic security updates complete:

• Limit administrative access and apply least privilege.
• Keep secrets out of HTML, shell history, logs, metrics labels, and source control.
• Use supported packages and verify downloads or repository signatures.
• Restrict network listeners to the hosts that genuinely require access.
• Back up state and test restoration, not only backup creation.
• Log configuration changes and retain enough history for investigation.
• Monitor time between a security update becoming available and successful installation.
• Patch dependencies and review release notes before major upgrades.
• Test failure behavior, restart behavior, and the rollback procedure.
• Assign an owner for alerts and maintenance rather than assuming someone will notice.

A disciplined troubleshooting method

When Ubuntu automatic security updates fails, begin with scope: one host, one application, one network segment, or the full fleet. Confirm time synchronization, because incorrect clocks make logs and certificates misleading. Check apt-daily-upgrade.timer, then inspect APT policy, unattended-upgrades logs, reboot-required state, and service health. Work from the user-visible symptom toward the underlying component instead of changing several settings at once.

Form one hypothesis, collect evidence, make one reversible change, and test again. Preserve the original error and command output in the incident record. If rollback restores service, keep investigating in a safe environment; a successful rollback identifies the change boundary but does not automatically explain the root cause.

Ongoing maintenance

Review Ubuntu automatic security updates at least quarterly and after operating-system, container-engine, application, or monitoring upgrades. Remove obsolete exceptions, verify that alerts still reach an accountable person, and rehearse recovery. Capacity and traffic patterns change, so thresholds that were sensible during installation may later become noisy or dangerously permissive.

The strongest operational signal is not the existence of a configuration file. It is consistent evidence that the service works, failures are detected promptly, responders know what to do, and changes can be reproduced across Ubuntu servers.

Official reference

Commands and defaults were checked against the official documentation. Confirm release-specific details before changing production systems.