Unattended Upgrades: Automated Maintenance Windows on Linux

Unpatched vulnerabilities in operating system packages represent the single largest attack vector for Internet-facing cloud servers. Zero-day exploits against OpenSSH, glibc, and the Linux kernel often emerge with public exploit code within 48 hours of disclosure. Relying on manual administrative patching across server fleets guarantees delayed updates and exposed attack surfaces.

The unattended-upgrades framework on Debian and Ubuntu automates package installation with enterprise-grade safety. When configured correctly, it applies security-only patches, excludes volatile database and application packages, and executes reboots strictly inside predetermined maintenance windows without human intervention.

Expand

Production Configuration File

Install the package and configure security repository origins, package blacklists, and automatic reboot schedules:

# Install the unattended-upgrades suite
sudo apt-get update && sudo apt-get install -y unattended-upgrades update-notifier-common

Edit the core configuration file at /etc/apt/apt.conf.d/50unattended-upgrades:

// /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

// Blacklist mission-critical packages from automated upgrades
Unattended-Upgrade::Package-Blacklist {
    "nginx";
    "postgresql.*";
    "redis.*";
    "docker-ce.*";
};

// Auto-remove unused dependency packages and kernels
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Scheduled Reboot Settings
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";

// Notifications
Unattended-Upgrade::Mail "sysadmin@example.com";
Unattended-Upgrade::MailReport "only-on-error";

Next, configure the daily execution trigger in /etc/apt/apt.conf.d/20auto-upgrades:

// /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

Dry-Run Testing and Validation

Before leaving the system in automated hands, perform a complete dry-run execution:

# Simulate update processing with verbose debug logs
sudo unattended-upgrade --dry-run --debug

# Inspect historical update logs
sudo cat /var/log/unattended-upgrades/unattended-upgrades.log

The log records every package evaluated, matched against blacklist regexes, and installed, giving complete audit visibility.

Automation and Scripting Video

Learn more about automating system administration tasks in this overview:

Managing Kernel Reboots Safely

When an updated kernel installs, unattended-upgrades flags the system by creating /var/run/reboot-required. If Automatic-Reboot is enabled, the server checks the wall-clock time and triggers systemctl reboot at exactly 03:30 AM local time. This eliminates human negligence without causing daytime service interruptions.

Keep your cloud infrastructure always patched and secure on Netbay VPS instances at netbayhosts.in.