Enable Debian Linux automatic updates to keep latest OS Patches / Security Up to Date
I'm not a big fan of automatism on GNU / Linux as often using automatic updates could totally mess things especially with a complex and a bit chatic OS-es like is Linux nowadays.
Nevertheless as Security is becoming more and more of a problem especially the browser security, having a scheduled way to apply updates like every normal modern Windows and MAC OS as an option is becoming essential to have a fully manageble Operating system.
As I use Debian GNU / Linux for desktop for my own personal computer and I have already a lot of Debian servers, whose OS minor level and package version maintenance takes up too big chunk of my time (a time I could dedicated to more useful activities). Thus I found it worthy at some cases to trigger Debian's way to keep the OS and security at a present level, the so called Debian "unattended upgrades".
In this article, I'll explain how to install and Enable Automatic (" Unattended " ) Updates on Debian, with the hope that other Debian users might start benefiting from it.
Pros of enabling automatic updates, are:
- Debian OS Stay secure without constant monitoring.
- You Save much time by letting your system handle updates.
- Presumably Enjoying more peace of mind, knowing your system is more protected.
Cons of enabling automatic updates:
- Some exotic and bad maintained packages (might break after the update)
- Customizations made on the OS /etc/sysctl.conf or any other very custom server configs might disappear or not work after the update
- At worst scenario (a very rare but possible case) OS might fail to boot after update 🙂
Regular security updates patch vulnerabilities that could otherwise be exploited by attackers, which is especially important for servers and systems exposed to the internet, where threats evolve constantly.
1. Update Debian System to latest
Before applying automatic updates making any changes, run apt to update package lists and upgrade any outdated packages,to have automatic updates for a smooth configuration process.
# apt update && apt upgrade -y
2. Install the Unattended-Upgrades deb Package
# apt install unattended-upgrades -y
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
The following additional packages will be installed:
distro-info-data gir1.2-glib-2.0 iso-codes libgirepository-1.0-1 lsb-release python-apt-common python3-apt python3-dbus python3-distro-info python3-gi
Suggested packages:
isoquery python-apt-doc python-dbus-doc needrestart powermgmt-base
The following NEW packages will be installed:
distro-info-data gir1.2-glib-2.0 iso-codes libgirepository-1.0-1 lsb-release python-apt-common python3-apt python3-dbus python3-distro-info python3-gi unattended-upgrades
0 upgraded, 11 newly installed, 0 to remove and 0 not upgraded.
Need to get 3,786 kB of archives.
After this operation, 24.4 MB of additional disk space will be used.
Do you want to continue? [Y/n]
# apt install apt-listchanges
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
The following package was automatically installed and is no longer required:
linux-image-5.10.0-30-amd64
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
python3-debconf
The following NEW packages will be installed:
apt-listchanges python3-debconf
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 137 kB of archives.
After this operation, 452 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://deb.debian.org/debian bookworm/main amd64 python3-debconf all 1.5.82 [3,980 B]
Get:2 http://deb.debian.org/debian bookworm/main amd64 apt-listchanges all 3.24 [133 kB]
Fetched 137 kB in 0s (292 kB/s)
Preconfiguring packages …
Deferring configuration of apt-listchanges until /usr/bin/python3
and python's debconf module are available
Selecting previously unselected package python3-debconf.
(Reading database … 84582 files and directories currently installed.)
Preparing to unpack …/python3-debconf_1.5.82_all.deb …
Unpacking python3-debconf (1.5.82) …
Selecting previously unselected package apt-listchanges.
Preparing to unpack …/apt-listchanges_3.24_all.deb …
Unpacking apt-listchanges (3.24) …
Setting up python3-debconf (1.5.82) …
Setting up apt-listchanges (3.24) …Creating config file /etc/apt/listchanges.conf with new version
Example config for apt-listchanges would be like:
# vim /etc/apt/listchanges.conf
[apt]
frontend=pager
email_address=root
confirm=0
save_seen=/var/lib/apt/listchanges.db
which=both
3. Enable Automatic unattended upgrades
Once installed, enable automatic updates with the following command, which will prompt asking if you want to enable automatic updates. Select Yes and press Enter, which will confirm that the unattended-upgrades service is active and ready to manage updates for you.
# dpkg-reconfigure unattended-upgrades
Or non-interactively by running command:
# echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true | debconf-set-selections
dpkg-reconfigure -f noninteractive unattended-upgrades
4. Set the Schedule for Automatic Updates on Debian
By default, unattended-upgrades runs daily, to verify or modify the schedule, check the systemd timer:
# sudo systemctl status apt-daily.timer
# sudo systemctl status apt-daily-upgrade.timer
# systemctl edit apt-daily-upgrade.timer
Current apt-daily.timer config as of Debian 12 (bookworm) is as follows
root@haproxy2:/etc/apt/apt.conf.d# cat /lib/systemd/system/apt-daily.timer
[Unit]
Description=Daily apt download activities[Timer]
OnCalendar=*-*-* 6,18:00
RandomizedDelaySec=12h
Persistent=true[Install]
WantedBy=timers.target
root@haproxy2:/etc/apt/apt.conf.d#
# systemctl edit apt-daily-upgrade.timer
[Timer]
OnCalendar=
OnCalendar=03:00
RandomizedDelaySec=0
At Line num 2 above is needed to reset (empty) the default value shown below in line num 5.
Line 4 is needed to prevent any random delays coming from the defaults.
Now both timers should be active, if not, activate them with:
# systemctl enable –now apt-daily.timer
# systemctl enable –now apt-daily-upgrade.timer
These timers ensure that updates are checked and applied regularly, without manual intervention.
5.Test one time Automatic Updates on Debian works
To ensure everything is working, simulate an unattended upgrade with a dry run:
# unattended-upgrade –dry-run
You can monitor automatic updates by checking the logs.
# less /var/log/unattended-upgrades/unattended-upgrades.log
Log shows details of installed updates and any issues that occurred. Reviewing logs periodically can help you ensure that updates are being applied correctly and troubleshoot any problems.
6. Advanced Configuration Options
If you’re a power user or managing multiple systems, you might want to explore these additional settings in the configuration file:
# vim /etc/apt/apt.conf.d/50unattended-upgrades
Configure unattended-upgrades to send you an email whenever updates are installed.
Unattended-Upgrade::Mail "your-email-address@email-address.com";
Enable automatic reboots after kernel updates
by adding the line:
Unattended-Upgrade::Automatic-Reboot "true";
To schedule reboots after package upgrade is applied at a specific time:
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
Specify packages you don’t want to be updated by editing the Unattended-Upgrade::Package-Blacklist section in the configuration file.
Here is alternative way to configure the unattended upgrade, by using apt configuration options:
# vim /etc/apt/apt.conf.d/02periodic
// Control parameters for cron jobs by /etc/cron.daily/apt-compat //
// Enable the update/upgrade script (0=disable)
APT::Periodic::Enable "1";
// Do "apt-get update" automatically every n-days (0=disable)
APT::Periodic::Update-Package-Lists "1";
// Do "apt-get upgrade –download-only" every n-days (0=disable)
APT::Periodic::Download-Upgradeable-Packages "1";
// Run the "unattended-upgrade" security upgrade script
// every n-days (0=disabled)
// Requires the package "unattended-upgrades" and will write
// a log in /var/log/unattended-upgrades
APT::Periodic::Unattended-Upgrade "1";
// Do "apt-get autoclean" every n-days (0=disable)
APT::Periodic::AutocleanInterval "21";
// Send report mail to root
// 0: no report (or null string)
// 1: progress report (actually any string)
// 2: + command outputs (remove -qq, remove 2>/dev/null, add -d)
// 3: + trace on
APT::Periodic::Verbose "2";
If you have to simultaneously update multiple machines and you're on a limited connection line, configure download limits if you’re on a metered connection by setting options in /etc/apt/apt.conf.d/20auto-upgrades.
7. Stop Automatic Unattended Upgrade
Under some circumstances if it happens the unattended upgrades are no longer required and you want to revert back to manual package updates, to disable the updates you have to disable the unattended-upgrades service
# systemctl stop unattended-upgrades
8. Stop an ongoing apt deb package set of updates applied on Debian server
Perhaps not often, but it might be you have run an automated upgrade and this has broke a server system or a service and for that reason you would like to stop the upcoming upgrade (some of whose might have started on other servers) immediately, to do so, the easiest way (not always safe thogh) is to kill the unattended-upgrades daemon.
# pkill –signal SIGKILL unattended-upgrades
Note that this a very brutal way to kill it and that might lead to some broken package update, that you might have to later fix manually.
If you have the unattended-upgrade process running on the OS in the process list backgrounded and you want to stop the being on the fly upgrade on the system more safely for the system, you can stop and cancel the ongoing apt upgrade it by running the ncurses prompt interface, through dpkg-reconfigure
# dpkg-reconfigure unattended-upgrades
Then just select No, press Enter. In my case, this has promptly stopped the ongoing unattended upgrade that seemed blocked (at least as promptly as the hardware seemed to allow 🙂 ).
If you want to disable it for future, so it doesn't automatically gets enabled on next manual update, by some update script disable service as well.
# systemctl disable unattended-upgrades
…
Close up
That’s all ! Now, your Debian system will automatically handle security updates, keeping your system secure without you having to do a thing.
The same guide should be good for most Deb based distributions such as Ubuntu / Mint and there rest of other Debian derivative OS-es.
You’ve now set up a reliable way to ensure your system stays protected from vulnerabilities, but anyways it is a good practice to always login and check what the update has done to the system, otherwise expect the unexpected.
