中文
Virtual CardsPaymentsTechAI ToolsSEOSocial & TradeCryptoFree Resources

Debian Unattended Upgrades: Install, Configure & Test

🕐 2025-02-10 ✍️ Moyi Foreign Trade

In Debian system administration, setting up unattended automatic updates greatly improves maintenance efficiency, patches security vulnerabilities in time, and keeps the system running stably. However, there are a few important things to note before you begin.

For non-physical servers — especially KVM-based VPS and cloud hosts with custom or modified kernels — system upgrades and kernel updates carry a risk of Grub failing to load. Be sure to back up important data in advance to avoid data loss. Also, all operations in this article must be run with root privileges; you can switch to root with sudo -i or su root.

1. Installing the Required Software

  • First, run apt update to refresh the package list and make sure the system has the latest package information.
  • Next, install unattended-upgrades with the command apt install unattended-upgrades -y.
user1@debian:~$ sudo apt install unattended-upgrades -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  gir1.2-glib-2.0 libgirepository-1.0-1 libglib2.0-0 libglib2.0-data libicu72 libxml2 python3-dbus python3-distro-info
  python3-gi shared-mime-info xdg-user-dirs xz-utils
Suggested packages:
  low-memory-monitor python-dbus-doc bsd-mailx default-mta | mail-transport-agent needrestart powermgmt-base
The following NEW packages will be installed:
  gir1.2-glib-2.0 libgirepository-1.0-1 libglib2.0-0 libglib2.0-data libicu72 libxml2 python3-dbus python3-distro-info
  python3-gi shared-mime-info unattended-upgrades xdg-user-dirs xz-utils
0 upgraded, 13 newly installed, 0 to remove and 0 not upgraded.
Need to get 14.6 MB of archives.
After this operation, 62.1 MB of additional disk space will be used.
Get:1 https://mirrors.aliyun.com/debian bookworm/main amd64 xz-utils amd64 5.4.1-0.2 [471 kB]
Get:2 https://mirrors.aliyun.com/debian bookworm/main amd64 libglib2.0-0 amd64 2.74.6-2+deb12u5 [1,403 kB]
Get:3 https://mirrors.aliyun.com/debian bookworm/main amd64 libgirepository-1.0-1 amd64 1.74.0-3 [101 kB]
Get:4 https://mirrors.aliyun.com/debian bookworm/main amd64 gir1.2-glib-2.0 amd64 1.74.0-3 [159 kB]
Get:5 https://mirrors.aliyun.com/debian bookworm/main amd64 libglib2.0-data all 2.74.6-2+deb12u5 [1,209 kB]
Get:6 https://mirrors.aliyun.com/debian bookworm/main amd64 libicu72 amd64 72.1-3 [9,376 kB]
Get:7 https://mirrors.aliyun.com/debian bookworm/main amd64 libxml2 amd64 2.9.14+dfsg-1.3~deb12u1 [687 kB]
Get:8 https://mirrors.aliyun.com/debian bookworm/main amd64 python3-dbus amd64 1.3.2-4+b1 [95.1 kB]
Get:9 https://mirrors.aliyun.com/debian bookworm/main amd64 python3-distro-info all 1.5+deb12u1 [6,772 B]
Get:10 https://mirrors.aliyun.com/debian bookworm/main amd64 python3-gi amd64 3.42.2-3+b1 [219 kB]
Get:11 https://mirrors.aliyun.com/debian bookworm/main amd64 shared-mime-info amd64 2.2-1 [729 kB]
Get:12 https://mirrors.aliyun.com/debian bookworm/main amd64 unattended-upgrades all 2.9.1+nmu3 [63.3 kB]
Get:13 https://mirrors.aliyun.com/debian bookworm/main amd64 xdg-user-dirs amd64 0.18-1 [54.4 kB]
Fetched 14.6 MB in 14s (1,059 kB/s)
  • After installation, the unattended-upgrades service usually starts and takes effect automatically.
  • You can check its running status with the systemctl status unattended-upgrades command.
user1@debian:~$  systemctl status unattended-upgrades
● unattended-upgrades.service - Unattended Upgrades Shutdown
     Loaded: loaded (/lib/systemd/system/unattended-upgrades.service; enabled; preset: enabled)
     Active: active (running) since Mon 2025-02-10 09:20:16 EST; 3min 56s ago
       Docs: man:unattended-upgrade(8)
   Main PID: 12444 (unattended-upgr)
      Tasks: 2 (limit: 9474)
     Memory: 13.5M
        CPU: 256ms
     CGroup: /system.slice/unattended-upgrades.service
             └─12444 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
  • If the service is not running, run systemctl enable --now unattended-upgrades to start it immediately and enable it at boot.
user1@debian:~$ sudo systemctl enable --now unattended-upgrades
Synchronizing state of unattended-upgrades.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable unattended-upgrades

2. Configuring the 50unattended-upgrades File

Next, edit and configure the /etc/apt/apt.conf.d/50unattended-upgrades file. You can refer to the following:

#nano /etc/apt/apt.conf.d/50unattended-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1"; 
APT::Periodic::Verbose "1";
APT::Periodic::AutocleanInterval "7";

Unattended-Upgrade::Mail "root";

Unattended-Upgrade::Origins-Pattern {
  "origin=Debian,codename=\${distro_codename},label=Debian";
  "origin=Debian,codename=\${distro_codename},label=Debian-Security";
  "origin=Debian,codename=\${distro_codename}-security,label=Debian-Security";
};

Unattended-Upgrade::Package-Blacklist {
};

Unattended-Upgrade::Automatic-Reboot "false";

Then restart the service:

# systemctl restart unattended-upgrades

About the configuration above:

  • Here is a detailed explanation of these settings:
  • APT::Periodic::Update-Package-Lists and APT::Periodic::Unattended-Upgrade: setting the value to "1" enables automatic updates; setting it to "0" disables them.
  • APT::Periodic::AutocleanInterval "7": the system keeps leftover unused dependency packages for 7 days and then cleans them automatically to free up disk space.
  • Unattended-Upgrade::Origins-Pattern specifies which apt sources to update. By default, only repositories containing debian and debian-security are updated. To update third-party sources, add a custom origin — for example, add origin=PowerDNS to update the PowerDNS source. The origin value can be obtained from the repository's Release file.
  • Unattended-Upgrade::Package-Blacklist sets the package blacklist. Packages on this list will not be automatically updated, and regular expressions are supported. For example, setting "linux-" blocks all packages starting with linux-; setting "apache2" blocks Apache 2 packages; setting "(lib)?xen(store)?" blocks packages starting with xen, xenstore, and libxen.
  • APT::Periodic::Verbose "1" enables update progress reporting; the default value "0" means no reports are sent. Enabling it gives you a clearer picture of the update process.
  • Unattended-Upgrade::Mail "root"; sends update report emails to root; change it to another user as needed.
  • Unattended-Upgrade::Automatic-Reboot "false"; means the system will not reboot automatically after updates. Set the value to "true" if you want an automatic reboot after updating.

After completing the configuration above, run the systemctl restart unattended-upgrades command to restart the service and apply the new settings.

3. Testing the Configuration and Checking Logs

To make sure the configuration is correct, run the unattended-upgrades --dry-run --debug command to test it. If no error messages appear, the configuration is correct.

To view update logs, use the journalctl -u apt-daily.service | tail command. When you see messages like download updated metadata (success) and unattended-upgrade -d (success) in the logs, your automatic update configuration is working. Follow the steps above and you will have unattended automatic updates running smoothly on Debian, making system maintenance easier and more efficient.

🌐 阅读中文版