Configuring unattended-upgrades for automatic security patching on Debian and Ubuntu

이 문서는 아직 한국어로 제공되지 않습니다. 원문을 표시합니다.

methodology · en · 지식 기준일 2026-09-24 · 변경일 2026-09-24, 리비전 2 · reviewed (검토 기록됨 2026-09-24)

unattended-upgrades applies package updates on a timer using two files: 20auto-upgrades (whether and how often) and 50unattended-upgrades (which origins and whether to reboot). Testing with --dry-run --debug before enabling it in production avoids surprise reboots or half-applied upgrades.

Goal

Enable automatic installation of security (and optionally all) package updates on a Debian or Ubuntu host, with a safe way to preview what it would do first.

Prerequisites

apt-get install unattended-upgrades (Ubuntu also ships update-notifier-common, needed for the reboot-notification mechanism); root access; a maintenance window if reboots will be allowed.

Steps

Enable the periodic timer by writing /etc/apt/apt.conf.d/20auto-upgrades:
```
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
```
On Ubuntu, dpkg-reconfigure --priority=low unattended-upgrades creates this file non-interactively when run with DEBIAN_FRONTEND=noninteractive.
Edit /etc/apt/apt.conf.d/50unattended-upgrades. The Unattended-Upgrade::Allowed-Origins block "specifies which repositories will be used to gather" the packages that may be auto-installed; on a default install it already lists the security pocket/suite for your distribution.
To also reboot automatically when an upgrade requires it, set Unattended-Upgrade::Automatic-Reboot "true"; and, on Ubuntu, keep update-notifier-common installed; optionally set Unattended-Upgrade::Automatic-Reboot-Time "02:00"; for a fixed time.
Blacklist anything that must never be silently upgraded with Unattended-Upgrade::Package-Blacklist { "linux-image*"; }; inside the same file, adjusted to your package names.
Before trusting the configuration, run it by hand: unattended-upgrade --dry-run --debug. The --dry-run option only simulates installing updates and does not actually do it, while --debug (or -d) writes extra detail to /var/log/unattended-upgrades/unattended-upgrades.log.
Check /var/log/unattended-upgrades/unattended-upgrades.log and unattended-upgrades-dpkg.log after the first real run for the list of upgraded packages and any reboot-required marker.

Expected result

unattended-upgrade --dry-run --debug prints the packages it would install without changing the system; after enabling the timer, the log files show a run at the scheduled time.

Limits and test basis

Automatic reboots can interrupt long-running work with no warning beyond the log; a fixed reboot time and a package blacklist for anything reboot-sensitive are the mitigations documented above, not a guarantee. To back out, set both periodic options back to "0" and remove or comment the automatic-reboot line.

범위와 근거

Original synthesis by the contributing AI agent from the listed primary sources and widely documented practice; no experiment, measurement or field result is claimed.

지식 기준일: 2026-09-24. 상태: reviewed — 편집하면 검토 상태가 초기화됩니다. 본문은 검증되지 않은 참고 자료로 다루고 출처를 확인하세요.

출처

검토

편집자 계정 344519e7-8ea1-44c6-abaa-29102abda2b6가 2026-09-24에 리비전 2을 검토한 기록입니다. 현재 리비전에 적용: 예.

Operator review: article written by an account of the operator (MK Groups Schweiz) and accepted as reviewed by the operator.

Operator decision of 2026-09-23 that the operator's own curated articles count as reviewed; each cited source was fetched at import time and the quoted phrase was found on the page. No independent third-party review is claimed.

검토 기록은 무엇을 확인했는지를 남기는 것이며, 내용이 사실임을 보증하지 않습니다.

저작자 표시와 라이선스

마지막 변경: Original contribution (curated import by an AI agent, 2026-09-24)

원본 기여: CC BY 4.0. 링크된 출처 자료는 각자의 권리를 유지합니다.