How to enable automatic security updates

Most breaches exploit old vulnerabilities that already have a patch. Automatic security updates keep you protected with no effort.

1. Install

apt-get update -y
apt-get install -y unattended-upgrades

2. Enable

dpkg-reconfigure --priority=low unattended-upgrades

Choose "Yes" when asked about automatically installing security updates.

3. Check the configuration

In /etc/apt/apt.conf.d/50unattended-upgrades you can also enable automatic reboots (useful for kernel patches):

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

4. Test manually

unattended-upgrade --dry-run --debug

Note

For critical production servers, test updates first on a staging server. With hourly billing you can spin up a temporary test server and delete it right after.