Ubuntu Server normally installs security fixes automatically through unattended-upgrades. To enable or restore it, install the package if necessary, set the daily APT jobs in /etc/apt/apt.conf.d/20auto-upgrades, then review update policy and reboot settings in a later configuration drop-in. Automatic reboots remain off unless you explicitly enable them.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Ubuntu Server updates automatically
The unattended-update system is built from two parts. APT refreshes package lists, and unattended-upgrades installs packages that match an allow-list. Ubuntu’s documented default is security-focused: the current Ubuntu release’s security pocket is enabled, together with Ubuntu Extended Security Maintenance (ESM) security pockets when they apply. Ordinary release updates, proposed packages, backports, and third-party repositories are not automatically included by that default policy.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Canonical’s security guidance records two timing figures for its documented service: security updates are installed after 24 hours, while normal release updates are installed after seven days. Those figures describe Canonical’s policy guidance; the local daily APT jobs still determine when your server checks and processes eligible updates. The daily value is configurable, so an administrator can choose a different cadence.
Automatic updating is independent on every server. It is not a fleet-management system, and it does not replace monitoring, change control, backups, or a plan for services that need manual migration steps.
#1 Best Overall
Check prerequisites before changing policy
- Use an account with
sudoprivileges. - Confirm that the server has working DNS and access to its configured APT mirrors.
- Check free space in the root filesystem and in
/var; package downloads and logs need room to complete. - Know which services are sensitive to restarts and whether the host has a maintenance window.
- For production, make sure monitoring reports failed APT transactions and that you can access the console if networking or SSH is unavailable after a change.
Do not edit the vendor-supplied /etc/apt/apt.conf.d/50unattended-upgrades directly for local policy. A package upgrade can replace that file. Put overrides in a later-numbered file under the same directory so your choices survive package updates.
Enable the daily unattended-upgrade jobs
1. Install the package when it is missing
Ubuntu Server commonly has the package installed for security updates. Check first:
dpkg-query -W -f='${Status}n' unattended-upgradesIf the result shows that it is not installed, install it with:
sudo apt update
sudo apt install unattended-upgradesThe installation may ask whether to enable automatic downloading and installation. You can answer the prompt there, or complete the configuration manually in the next step.
2. Set the APT periodic jobs
Open /etc/apt/apt.conf.d/20auto-upgrades as root and ensure it contains these two directives:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";A value of 1 means daily. A value of 2 means every two days, and 0 disables that action. The first line refreshes package lists; the second invokes unattended installation for packages allowed by policy.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchYou can edit the file with a terminal editor, for example:
sudoedit /etc/apt/apt.conf.d/20auto-upgradesUbuntu also provides an interactive path:
sudo dpkg-reconfigure unattended-upgradesThat command is useful when you want the package’s standard enablement question handled without manually editing the file.
Understand when the jobs run
The configuration above does not run an update immediately. Systemd starts the work through apt-daily.timer and apt-daily-upgrade.timer. Those timers include a randomized delay, so servers in the same environment do not all contact mirrors at exactly the same second.
Inspect the schedule and the last or next run with:
systemctl list-timers apt-daily.timer apt-daily-upgrade.timer
systemctl status apt-daily.timer apt-daily-upgrade.timerIf a machine was powered off when a timer elapsed, systemd can run the missed job after startup. That catch-up behavior is useful for long-lived servers but can be surprising on short-lived virtual machines that are created, used, and destroyed within a day.
Disable catch-up on a short-lived VM
To prevent a missed timer from being executed after boot, create a systemd drop-in for each timer and set Persistent=false:
sudo systemctl edit apt-daily.timer
sudo systemctl edit apt-daily-upgrade.timerIn each editor, add:
[Timer]
Persistent=falseSave both drop-ins, then reload systemd:
sudo systemctl daemon-reloadThis changes catch-up behavior only. It does not disable the normal recurring timers.
Choose which updates are allowed
Security-only policy (the documented default)
The default Allowed-Origins block permits security updates for the current Ubuntu release and, where available, ESM security pockets. In the documented file, the regular -updates, -proposed, and -backports entries are commented out. This keeps unattended changes focused on security fixes rather than every new feature or bug-fix release.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSecurity-only is a sensible starting point when an application has not been validated against every new package version. It still requires you to plan periodic maintenance for non-security fixes, kernel transitions, application compatibility, and packages that need configuration changes.
Include normal release updates
To install the normal updates pocket automatically, create a later drop-in such as /etc/apt/apt.conf.d/52unattended-upgrades-local and add the release’s -updates origin to the allow-list. The variable form below follows Ubuntu’s configuration style:
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-updates";
};Keep the existing security entries when you add this override; do not replace them accidentally. The release-update pocket can contain behavior changes, so test the policy on a staging server and use normal change-control procedures before applying it to production.
Canonical’s named guidance gives seven days as the documented delay for normal updates. Your server can still process them on the next eligible timer run once the origin is allowed, subject to the local APT configuration and package metadata.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Allow a PPA or another third-party repository
Adding a repository to APT does not automatically make unattended-upgrades install from it. Each third-party origin must be explicitly allowed in Allowed-Origins. First inspect the exact origin and suite that APT sees:
apt-cache policy package-nameThen add a matching origin entry in your later local drop-in. Use the repository’s actual origin and suite values rather than guessing them. A PPA can publish packages that are not tested against the same compatibility and security process as Ubuntu’s official archive, so approving it transfers more maintenance responsibility to you.
Restrict third-party automation to packages you have tested, and consider pinning or package-specific exclusions when only a subset of that repository should be unattended.
Decide what happens to services and reboots
Automatic reboot is off by default
Installing an update that requests a reboot does not reboot the server unless you enable the setting. Put the following in a later unattended-upgrades drop-in when you deliberately want automatic reboots:
Unattended-Upgrade::Automatic-Reboot "true";If users may be logged in, control whether a reboot can proceed with Automatic-Reboot-WithUsers. To use a maintenance time instead of rebooting immediately, set Automatic-Reboot-Time, for example:
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";Choose a time that is valid for the server’s local timezone and compatible with your monitoring and clustering plan. A reboot setting is a service-availability decision, not merely an APT preference.
Rank #4
Why a reboot can still matter
A full reboot is not required for every package update. However, a running process can continue using an old version of a library after the package on disk has been replaced. Canonical’s guidance puts the trade-off plainly: “The foolproof way to ensure you are running updated versions is to reboot, but this impacts availability.”
Ubuntu 24.04 LTS and later automatically use needrestart to restart affected services by default. If a critical service must not be restarted automatically, add a configuration file under /etc/needrestart/conf.d/ to exclude that service or change the restart mode. Test the exact needrestart configuration on a non-production host; an exclusion reduces interruption but leaves that process running with older code until you restart it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Use a maintenance-window workflow instead
Many production operators leave automatic reboot disabled, monitor the reboot-required signal, and schedule the restart during an approved window. This separates unattended package installation from the availability decision while still allowing security fixes to arrive promptly. If you use clustering or redundancy, drain or fail over the node before restarting it and verify application health afterward.
Verify that automatic updates are working
Check configuration and timers
cat /etc/apt/apt.conf.d/20auto-upgrades
systemctl is-enabled apt-daily.timer apt-daily-upgrade.timer
systemctl list-timers apt-daily.timer apt-daily-upgrade.timerThe first command should show the two periodic directives. The timer commands should show enabled recurring units and a next-run time. A randomized delay means the displayed time is an execution window rather than a promise that every node runs simultaneously.
Read unattended-upgrades logs
Review the primary log and the surrounding log directory:
sudo less /var/log/unattended-upgrades/unattended-upgrades.log
sudo ls -l /var/log/unattended-upgrades/Look for the transaction start and completion, packages that were kept back, and error messages from APT or dpkg. Keep log collection and alerting in your normal monitoring system; Ubuntu does not provide built-in fleet monitoring for independent unattended-upgrades runs.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check for a pending reboot
if [ -f /var/run/reboot-required ]; then echo "reboot required"; fi
cat /var/run/reboot-required.pkgs 2>/dev/nullThe second file, when present, lists packages that requested the reboot. Treat the signal as an input to your maintenance process rather than as proof that an immediate reboot is safe.
Check for a broken package state
sudo dpkg --audit
sudo apt-get checkA failed or interrupted dpkg transaction can prevent later unattended runs. Resolve the reported package state during a controlled session, then review the unattended-upgrades log again. Do not repeatedly schedule unattended jobs over an unresolved dependency failure.
Best Value
Troubleshoot common failures
The package is installed, but nothing runs
- Confirm both values in
20auto-upgradesare"1", not"0". - Check that the timers are enabled and have a next-run time.
- Inspect logs for lock contention, DNS failures, mirror errors, or a package-manager process that is already running.
- Remember that the timer’s randomized delay means an apparent pause immediately after boot is not necessarily a failure.
Updates are downloaded but not installed
Compare the package’s repository origin with the active Allowed-Origins policy using apt-cache policy. A package from a PPA, -proposed, -backports, or a release-update pocket will remain outside unattended installation unless its origin is explicitly approved. Held packages, dependency conflicts, and packages requiring a manual configuration decision can also be kept back.
A server reboots unexpectedly
Search all unattended-upgrades drop-ins for Automatic-Reboot and verify whether another administrator or configuration-management system enabled it. If reboots are required but must be controlled, set automatic reboot to false, monitor the reboot-required signal, and schedule restarts through the maintenance process.
A critical service restarts during updates
On Ubuntu 24.04 LTS and later, inspect needrestart behavior and any files in /etc/needrestart/conf.d/. Add a narrowly scoped exclusion or restart-mode change only after testing the consequence: the service may continue running old libraries until a planned restart.
A missed timer runs immediately after boot
That is the expected persistent-timer catch-up behavior when the machine was off. For a short-lived VM where this is undesirable, set Persistent=false in drop-ins for both APT timers and reload systemd.
Operate automatic updates safely across servers
Unattended-upgrades makes a good node-level mechanism, but production fleets need an additional operating layer. Decide whether every node follows the same cadence, whether origins are centrally approved, and how failed runs are escalated. Monitoring should alert on failed APT jobs, stale package-list timestamps, held or broken packages, and reboot-required states.
Use staged deployment when enabling normal updates or third-party origins: test on a representative host, observe application behavior, then expand the policy. Keep local drop-ins in configuration management so a rebuild or replacement server receives the same policy. Do not assume that enabling the feature on one node changes any other node.
Recommended Free Tools
Consider Livepatch for kernel availability
Livepatch is an adjacent option included with Ubuntu Pro. Canonical describes it as applying patches to the running kernel until the next scheduled reboot. It can reduce the number of urgent kernel reboots, but it does not replace unattended package updates, service-restart decisions, or periodic full reboots.
A practical policy checklist
- Security coverage: Keep the official security origins enabled and confirm the daily list refresh and unattended-install values.
- Release updates: Add the current release’s
-updatesorigin only after compatibility testing. - Third-party software: Approve each repository origin explicitly; adding a source alone is insufficient.
- Cadence: Use daily operation unless a documented two-day or custom schedule better fits the workload.
- Reboots: Leave automatic reboot off when availability requires a maintenance decision, or schedule it for a defined window.
- Service restarts: Review
needrestartdefaults on Ubuntu 24.04 LTS and define exceptions for services that cannot restart unattended. - Verification: Monitor timers, logs, dpkg health, and reboot-required signals on every node.
- Recovery: Maintain console access, backups, and a tested procedure for repairing a broken APT or dpkg state.
What to expect after enabling it
Once the package is installed and the two periodic values are set to 1, Ubuntu’s timers will refresh package lists and run unattended upgrades on their schedule. Under the default policy, that means eligible security updates rather than every package offered by every configured repository. Normal updates and PPAs require deliberate origin approval. Reboots remain under your control unless you enable them, and Ubuntu 24.04 LTS may restart affected services automatically through needrestart.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
