How to Set Up Automatic Security Updates on Debian

A patched server is a quiet server. unattended-upgrades on Debian installs security updates without your input — set it once, get patches forever. This guide walks through enabling it, scoping it to security-only, and proving it works.

Prerequisites

• Debian 12 with sudo.
• Outbound HTTPS to security.debian.org and deb.debian.org.

Step 1: Install

sudo apt update
sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades
# Choose YES to enable automatic upgrades.

This drops /etc/apt/apt.conf.d/20auto-upgrades with the two flags that turn the feature on.

Step 2: Scope it to security only (recommended)

Edit /etc/apt/apt.conf.d/50unattended-upgrades. Uncomment the security origin and keep the rest off — you want predictable kernel ABIs, not surprise major-version jumps.

Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
    // optionally also:
    // "origin=Debian,codename=${distro_codename}-updates";
};

Unattended-Upgrade::Package-Blacklist {
    // pin packages you do NOT want auto-updated, e.g.:
    // "mysql-server";
    // "postgresql-15";
};

Unattended-Upgrade::Mail "ops@example.sa";
Unattended-Upgrade::MailReport "on-change";

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

Step 3: Test in dry-run

sudo unattended-upgrade --dry-run --debug 2>&1 | tail -30

Watch for the line Allowed origins are: — that is what will actually be picked up.

Step 4: Confirm the systemd timer fires

sudo systemctl status unattended-upgrades.service
sudo systemctl list-timers apt-daily.timer apt-daily-upgrade.timer

apt-daily.timer refreshes the cache around 06:00 daily; apt-daily-upgrade.timer applies updates around 06:30.

Step 5: Mail alerts (optional)

If you set Unattended-Upgrade::Mail above, make sure a local MTA can deliver. bsd-mailx + msmtp is the lightweight choice:

sudo apt install -y bsd-mailx msmtp msmtp-mta
sudoedit /etc/msmtprc                # set smarthost, from, auth
echo "test" | mail -s "test" ops@example.sa

Verify

After a security advisory drops, the next morning you should see new entries in:

sudo less /var/log/unattended-upgrades/unattended-upgrades.log
sudo less /var/log/dpkg.log | grep -E 'install|upgrade' | tail -20
cat /var/run/reboot-required 2>/dev/null

Conclusion

Three minutes of configuration buys you years of timely security patches without paging anyone. Pair it with a Sunday morning reboot window and you have the cheapest infosec control on the market.

Next steps

• Match the firewall to a default-deny posture — see UFW for specific ports.
• Pin major services with the Package-Blacklist block above to avoid surprise restarts.
• Review the Linux systemd guide to inspect timers.