Unattended Upgrades

1. Description

Some notes on installing and configuring unattended-upgrades.

Unattended Upgrades is needed for installing updates automatically but not if we only want to run apt update automatically (or downloading upgradable packages automatically), see apt.systemd.daily shell script for more info.

Files timestamp in /var/lib/apt/periodic/ are updated when the script is triggered by its systemd timer apt-daily.timer.

The software-properties GUI has an “Updates” tab to control how updates are handled when the unattended-upgrades package is installed.

2. Installation

sudo apt install unattended-upgrades

The powermgmt-base package is required for AC/battery options (e.g. Unattended-Upgrade::OnlyOnACPower).

3. Configuration

The default configuration file is at /etc/apt/apt.conf.d/50unattended-upgrades.

To override the default configuration file it is recommended to create another apt configuration file to prevent package updates conflicting with local changes, blocking unattended-upgrades itself.

The new file has to be parsed after 50unattended-upgrades to override it (apt reads files in /etc/apt/apt.conf.d/ in lexical order) so name it, e.g. /etc/apt/apt.conf.d/51unattended-upgrades-local.

# /etc/apt/apt.conf.d/51unattended-upgrades-local
Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename}-updates";
        "origin=Debian,codename=${distro_codename},label=Debian";
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "17:00";

4. Enable

https://manpages.debian.org/stable/debconf/dpkg-reconfigure.8

sudo dpkg-reconfigure -plow unattended-upgrades

You can also create a file in /etc/apt/apt.conf.d/ to enable and configure when updates are automatically installed, see notes:apt#periodic-updates.

5. Current configuration

The current configuration can be queried with apt-config (see notes:apt-config).

apt-config dump APT::Periodic::Unattended-Upgrade

If it returns APT::Periodic::Unattended-Upgrade "1"; then unattended-upgrades is enabled.

6. Logs

All operations are logged in /var/log/unattended-upgrades/, packages upgrades are also logged in /var/log/apt/history.log.

7. Related nodes

Debian