Automate security updates

A fixed vulnerability that is not installed remains an open vulnerability. On a public server, the gap between a patch release and its installation is measured in days, sometimes hours. Automating security updates narrows that window without requiring you to log in every morning.

What the tool actually does

unattended-upgrades installs updates from the Debian security repository and point releases automatically. It does not change Debian major version, does not touch application dependencies (npm, pip, Composer) and does not reboot by default. It is triggered by the apt-daily and apt-daily-upgrade systemd timers.

Install and enable

sudo apt update
sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

The last command writes the schedule file. Check its contents:

cat /etc/apt/apt.conf.d/20auto-upgrades

You should see two active directives:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Set the scope

The /etc/apt/apt.conf.d/50unattended-upgrades file controls what is allowed. On Debian 13 the security rule looks like this:

Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=trixie-security";
    "origin=Debian,codename=trixie,label=Debian";
};
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Remove-Unused-Dependencies "false";

Leave automatic reboot at false: you pick the moment. Keep unused dependency removal off, because it can remove a package your application uses without declaring it. To exclude a package that breaks your service on every update, add it to Package-Blacklist, but document why and revisit it: excluding means not patching.

Reboots and services

A NeoHeberg VPS is a system container: the kernel comes from the platform, so container updates cover libraries and services, not the kernel. A libc or OpenSSL update still requires restarting the processes that use them.

Install needrestart to identify services to restart:

sudo apt install needrestart

After an update, sudo needrestart -r l lists the affected services. Restart them in a quiet window, then reboot the VPS from the dashboard if needed.

Monitor and test

Automating without checking is hoping. Review regularly:

sudo tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log
systemctl list-timers 'apt-daily*'
apt list --upgradable
sudo unattended-upgrade --dry-run --debug

The last command simulates a run and shows what would be installed. If the log stops moving, check that the timers are active and the disk is not full: a failed update usually leaves an explicit message. Finally, keep a restore point before periods of significant change: a security update can still break a misconfigured application.