unattended-upgrades: security updates with no one at the keyboard

cheat sheet · Ubuntu 24.04 · unattended-upgrades 2.9 · needrestart 3.6 https://lab.dimsanych.ru/en/wiki/unattended-upgrades/

Cheat sheet

systemctl list-timers 'apt-daily*' when the next run is
cat /etc/apt/apt.conf.d/20auto-upgrades is it switched on
apt-config dump | grep -E '^APT::Periodic|^Unattended-Upgrade::'
sudo unattended-upgrade --dry-run -v what it would install
sudo ls /var/log/unattended-upgrades/ run logs
sudo needrestart -b who needs a restart
ls /var/run/reboot-required is a reboot needed

Configuration

The settings are in apt format in /etc/apt/apt.conf.d/. The files are read in alphabetical order: 20auto-upgrades is the switch, 50unattended-upgrades says what to install and how. Keep your own values in a separate file numbered above 50: a package upgrade may offer to replace 50unattended-upgrades, but it leaves your file alone.

text

// /etc/apt/apt.conf.d/52unattended-upgrades-local
Unattended-Upgrade::Package-Blacklist { "postgresql-"; };
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";

A plain value from a later file replaces the earlier one, while list items { … } are added to the earlier ones. apt-config dump shows the result:

bash

apt-config dump | grep -E '^APT::Periodic|^Unattended-Upgrade::'

The main settings are in the directives table below. The machine's 50unattended-upgrades has Automatic-Reboot "false", Remove-Unused-Dependencies "false" and Mail "" commented out — those are the defaults.