Automatic Security Updates

Security fixes come out every week. A server nobody updates is waiting to be broken into. Debian can install them by itself: unattended-upgrades.

apt list --upgradable

base-files/stable-updates 13.8 amd64 [upgradable from: 13.7]
openssl/stable-security 3.5.7-1~deb13u4 amd64 [upgradable from: 3.5.7-1~deb13u3]

The suite after the name tells them apart: stable-security is a security fix, stable-updates an ordinary update.

Install it

sudo apt install unattended-upgrades
cat /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

"1" means every day: refresh the package lists, then install. Debian switches this on with the package (sudo dpkg-reconfigure -plow unattended-upgrades asks again). Two timers do the work:

systemctl list-timers apt-daily*

apt-daily.timer downloads, apt-daily-upgrade.timer installs — every morning around 6.

What it installs

/etc/apt/apt.conf.d/50unattended-upgrades says: Debian's own packages from trixie and trixie-security — security fixes, not new versions of anything. Try it without changing anything:

sudo unattended-upgrade --dry-run --debug

Allowed origins are: origin=Debian,codename=trixie,label=Debian, …
Packages that will be upgraded: openssl

Rebooting

A new kernel or C library only counts after a reboot. unattended-upgrades can do that too — at a quiet hour. Don't edit Debian's file; add your own, which apt reads after it (the files are read in name order, the last word wins):

printf 'Unattended-Upgrade::Automatic-Reboot "true";\nUnattended-Upgrade::Automatic-Reboot-Time "02:00";\n' | sudo tee /etc/apt/apt.conf.d/52auto-reboot

What did it do?

sudo unattended-upgrade -v
cat /var/log/unattended-upgrades/unattended-upgrades.log

💡 Automatic doesn't mean forgotten: look at that log now and then — and run apt upgrade yourself for the ordinary updates.