Best Ubuntu unattended security updates for VPS Guide 2026

Master Ubuntu unattended security updates for VPS. Ensure automated patching & server safety. Read our 2026 guide now!

Futuristic VPS rack with glowing blue and orange lights, holographic shield, and data streams.

Quick Answer: Ubuntu Unattended Security Updates Setup

Want to keep your VPS safe without daily checks? Ubuntu unattended security updates fix this. Run these three commands:

  1. sudo apt update && sudo apt install unattended-upgrades -y
  2. sudo dpkg-reconfigure --priority=low unattended-upgrades
  3. Select “Yes” when asked to apply updates automatically.

Done. Your VPS now installs security patches on its own every day. Keep reading to learn the full setup.

Why Ubuntu Unattended Security Updates Matter for VPS

A VPS runs 24/7. You cannot watch it all the time. Ubuntu unattended security updates protect your server while you sleep.

The Risks of Delayed Security Patches on VPS

Hackers scan VPS servers every minute. If your system misses a patch, they break in fast. Studies show 60% of hacked servers had pending updates. Ubuntu unattended security updates close this gap.

How Unattended-Upgrades Works on Ubuntu 22.04, 24.04, and 26.04

The unattended-upgrades tool checks for new security fixes daily. It downloads and installs them without your help. On Ubuntu 22.04, 24.04, and 26.04, this tool works the same way. A systemd timer runs it each night.

Security-Only vs. All Updates: What’s the Difference?

Security-only updates fix holes that hackers use. All updates add new features too. For VPS safety, choose security-only. It reduces the chance of breaking your server.

Prerequisites Before Enabling Unattended Security Updates

Before you start, check three things. This keeps your VPS safe during setup.

Check Your Ubuntu Version and Current Update Status

Run this command:

lsb_release -a

You need Ubuntu 22.04, 24.04, or 26.04. Then check pending updates:

sudo apt update && apt list --upgradable

Create a VPS Backup or Snapshot

Most VPS providers offer snapshots. Take one now. If Ubuntu unattended security updates break something, you can restore fast.

Identify Critical Services and Packages to Protect

List your key services: web server, database, SSH. Write them down. Later, you will protect these from auto-updates if needed.

Step-by-Step: Install and Enable Ubuntu Unattended Security Updates

Step 1: Verify if Unattended-Upgrades Is Already Installed

Run:

dpkg -l | grep unattended-upgrades

If you see output, it is installed. Skip to Step 3. If not, go to Step 2.

Step 2: Install the Unattended-Upgrades Package

Run these commands:

sudo apt update

sudo apt install unattended-upgrades apt-listchanges -y

This installs the tool and a helper that shows update details.

Step 3: Enable Automatic Security Updates via dpkg-reconfigure

Run:

sudo dpkg-reconfigure --priority=low unattended-upgrades

A screen appears. Choose “Yes” to enable Ubuntu unattended security updates. Press Enter.

Step 4: Configure Security-Only Update Sources

Open the config file:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Find the “Unattended-Upgrade::Allowed-Origins” section. Make sure only security lines are uncommented:

  • “${distro_id}:${distro_codename}-security”;

Comment out other lines with // at the start. Save and exit (Ctrl+X, Y, Enter).

Configure Ubuntu Unattended Security Updates for Production VPS

Understanding /etc/apt/apt.conf.d/20auto-upgrades

This file controls update timing. Open it:

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

You should see:

  • APT::Periodic::Update-Package-Lists “1”;
  • APT::Periodic::Unattended-Upgrade “1”;

The “1” means daily. Change to “7” for weekly if you prefer.

Editing /etc/apt/apt.conf.d/50unattended-upgrades

This is the main config file for Ubuntu unattended security updates. Open it again:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Set Allowed Origins to Security Repositories Only

Look for this block:

Unattended-Upgrade::Allowed-Origins {

Keep only the security line active. Example for Ubuntu 24.04:

"Ubuntu:noble-security";

Exclude Packages That Should Not Auto-Update

Some packages need manual updates. Add them to the blacklist:

Unattended-Upgrade::Package-Blacklist {

"mysql-server";

"postgresql-15";

};

This protects your database from surprise changes.

Configure Automatic Reboot Policy for Kernel Updates

Kernel updates need a reboot. Add this line:

Unattended-Upgrade::Automatic-Reboot "true";

Unattended-Upgrade::Automatic-Reboot-Time "03:00";

This reboots your VPS at 3 AM. Change the time to match your low-traffic hours.

Test and Verify Ubuntu Unattended Security Updates Are Working

Run a Dry-Run to Preview Pending Updates

Test without installing:

sudo unattended-upgrades --dry-run -d

This shows what would happen. Check for errors.

Check Unattended-Upgrades Logs for Successful Execution

View the log:

sudo cat /var/log/unattended-upgrades/unattended-upgrades.log

Look for “Allowed origins” and package names. This confirms Ubuntu unattended security updates ran.

Verify Systemd Timers Are Active and Scheduled

Check the timer:

systemctl list-timers | grep unattended

You should see “apt-daily.timer” and “apt-daily-upgrade.timer”. Both must be active.

Confirm Updates Actually Applied After 24 Hours

Wait one day. Then run:

grep "Unattended-upgrades" /var/log/dpkg.log

This shows installed packages. If you see entries, Ubuntu unattended security updates work.

Monitor Ubuntu Unattended Security Updates on Your VPS

Set Up Email Notifications for Update Events

Open the config file:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Uncomment and set:

Unattended-Upgrade::Mail "your@email.com";

Unattended-Upgrade::MailOnlyOnError "true";

Now you get emails only when updates fail.

Use apt-listchanges to Review Update Details

You installed apt-listchanges earlier. It shows changelogs before updates. To see past changes:

apt-listchanges /var/cache/apt/archives/*.deb

Monitor /var/log/unattended-upgrades/ Regularly

Check logs weekly:

sudo ls -la /var/log/unattended-upgrades/

Key files:

  • unattended-upgrades.log – main log
  • unattended-upgrades-dpkg.log – package actions

Create Alerts for Failed Update Attempts

Use a simple script. Create a file:

nano ~/check-updates.sh

Add:

#!/bin/bash

if grep -q "ERROR" /var/log/unattended-upgrades/unattended-upgrades.log; then

echo "Update failed" | mail -s "VPS Alert" your@email.com

fi

Run it daily with cron. This monitors Ubuntu unattended security updates for you.

VPS-Specific Safety Considerations for Unattended Updates

Avoid Downtime: Schedule Updates During Low-Traffic Hours

Set reboot time to 3-5 AM in your timezone. Edit:

Unattended-Upgrade::Automatic-Reboot-Time "04:00";

This minimizes user impact.

Protect Database Packages (MySQL, PostgreSQL, MongoDB)

Databases need careful updates. Add them to the blacklist:

"mysql-server";

"postgresql*";

"mongodb*";

Update these manually after testing.

Handle SSH and Firewall Updates Carefully

SSH updates can lock you out. Test first:

sudo apt install openssh-server -d

Read changelogs. Then allow auto-updates only if safe.

Kernel Updates: When to Reboot and When to Wait

Kernel updates need reboots. If your VPS has high uptime needs, use live patching (Canonical Livepatch). Otherwise, schedule reboots weekly.

Rollback Plan: What to Do If an Update Breaks Your VPS

If Ubuntu unattended security updates break something:

  1. Restore from your snapshot.
  2. Check logs: sudo cat /var/log/unattended-upgrades/unattended-upgrades.log
  3. Blacklist the problem package.
  4. Try again next week.

Troubleshoot Common Ubuntu Unattended Security Updates Issues

Fix “Package Configuration Failed” Errors

This happens when a post-install script fails. Run:

sudo dpkg --configure -a

Then retry:

sudo unattended-upgrades -d

Resolve Locked apt/dpkg Issues

If you see “dpkg locked” errors:

sudo rm /var/lib/dpkg/lock-frontend

sudo rm /var/lib/apt/lists/lock

sudo dpkg --configure -a

Debug Updates That Aren’t Running on Schedule

Check the timer:

systemctl status apt-daily.timer

If inactive, enable it:

sudo systemctl enable apt-daily.timer

sudo systemctl start apt-daily.timer

Recover from Broken Dependencies After Auto-Update

Run:

sudo apt --fix-broken install

sudo apt update

sudo apt upgrade

This fixes most dependency issues from Ubuntu unattended security updates.

Advanced: Customize Ubuntu Unattended Security Updates Further

Enable Automatic Cleanup of Obsolete Packages

Add to 50unattended-upgrades:

Unattended-Upgrade::Remove-Unused-Dependencies "true";

This saves disk space.

Configure Different Update Frequencies for Different Repos

Create a custom file:

sudo nano /etc/apt/apt.conf.d/99custom-updates

Add:

APT::Periodic::Update-Package-Lists "3";

This checks every 3 days instead of daily.

Integrate with External Monitoring Tools (UptimeRobot, Datadog)

Send update status to UptimeRobot. Add to your check script:

curl https://uptimerobot.com/your-hook-url?status=ok

This tracks Ubuntu unattended security updates health.

Automate VPS Snapshots Before Update Windows

Use your VPS provider’s API. Example for DigitalOcean:

curl -X POST "https://api.digitalocean.com/v2/droplets/YOUR_ID/snapshots" \

-H "Authorization: Bearer YOUR_TOKEN"

Run this before updates. Now you have a safety net.

FAQ: Ubuntu Unattended Security Updates for VPS

Is Unattended-Upgrades Enabled by Default on Ubuntu 24.04 and 26.04?

Yes, on Ubuntu 24.04 and 26.04, unattended-upgrades is installed and enabled by default. But check your settings to confirm security-only mode.

Will Automatic Updates Cause My VPS to Reboot Unexpectedly?

Only if you enable automatic reboots. By default, Ubuntu unattended security updates do not reboot. You must add Automatic-Reboot "true" to enable this.

Can I Use Unattended-Upgrades on Shared Hosting or Managed VPS?

On shared hosting, no. Your provider handles updates. On managed VPS, check with your host first. Some block unattended-upgrades.

How Do I Temporarily Disable Automatic Security Updates?

Run:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Choose “No”. To re-enable, run again and choose “Yes”.

Should I Use Unattended-Upgrades or Manual Updates for Production?

Use Ubuntu unattended security updates for security patches. Use manual updates for major version changes. This gives you safety and control.

Conclusion: Keep Your VPS Secure with Automated Ubuntu Updates

Ubuntu unattended security updates protect your VPS from hackers. You learned how to install, configure, test, and monitor them. You also saw how to handle problems and customize settings.

Key takeaways:

  • Install unattended-upgrades with one command.
  • Configure security-only mode for safety.
  • Test with dry-run before going live.
  • Monitor logs weekly.
  • Blacklist risky packages like databases.

Start today. Run the setup commands. Your VPS will stay safe while you focus on your work. Check back in 24 hours to confirm updates applied. Then relax. Ubuntu unattended security updates have your back.