Automated Security Updates on a VPS: unattended-upgrades Setup

Goal: keep a Debian or Ubuntu VPS patched against security vulnerabilities without logging in every week. This guide sets up unattended-upgrades, restricts it to security updates, adds reboot handling and email notifications, then covers the equivalent dnf-automatic setup for RHEL/Fedora. Prerequisites: root access and a working outbound mail path or a webhook URL.

Why automate patching at all

The median time from CVE disclosure to public exploit is under 15 days; manual monthly patching is too slow
A compromised VPS is often used as a spam relay or cryptocurrency miner within hours
Automated security-only updates rarely break apps; full dist-upgrades are what you should review manually

Most providers publish their patch SLA, but even managed VPS plans do not patch the OS on unmanaged tiers. On a self-managed VPS, unattended-upgrades is the cheapest insurance you can install.

Install and enable unattended-upgrades

On Debian/Ubuntu:

sudo apt update
sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Answer “Yes” when asked whether to download and install stable updates. The package creates /etc/apt/apt.conf.d/50unattended-upgrades; verify it is active:

sudo unattended-upgrades --dry-run --debug

The dry run must show that security updates would be installed and end without errors. On Ubuntu, the 20auto-upgrades file in /etc/apt/apt.conf.d/ controls the automatic update and upgrade flags — both should be “1”.

Restrict to security updates only

Open the main config and uncomment only the security origins; leave the rest commented out:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

This prevents the machine from auto-installing new package versions from normal repos, which is where most upgrade-related breakage comes from. If you also run an LTS kernel, you can add the -updates origin, but start security-only.

Pin what gets installed

Sometimes you want to block a specific package from ever being auto-upgraded — for example a patched kernel that conflicts with your vendor’s modules, or a database binary your application is pinned against. Blacklist it explicitly:

Unattended-Upgrade::Package-Blacklist {
    "linux-image-5.15.*";
    "mysql-server";
};

The blacklist accepts regex patterns, so linux-image-.* disables all kernel auto-upgrades. Use this sparingly: every blacklisted security update is a vulnerability you are choosing to patch manually.

What happens on failure

If a package fails to install, unattended-upgrades sends a mail (if configured) and leaves the package in a broken state — it does not retry aggressively. Check the log after any manual apt run, and watch for repeated failure lines:

grep -i error /var/log/unattended-upgrades/unattended-upgrades.log | tail

A common failure is a held package (apt-mark hold) that you forgot about, or a config file conflict from a previous manual edit. Fix the conflict and run sudo unattended-upgrades again to confirm the queue drains.

Reboot handling and notifications

Kernel updates need a reboot to take effect. Configure automatic reboots at a quiet hour and send yourself an email:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";
Unattended-Upgrade::Mail "[email protected]";

If you prefer chat notifications, point the mail line at a service that forwards to Slack or Telegram, or watch /var/log/unattended-upgrades/unattended-upgrades.log with a log-shipping agent. Test the mail path with mail or a curl webhook before relying on it.

RHEL/Fedora: dnf-automatic

On AlmaLinux, Rocky, or Fedora the equivalent is:

sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

Edit /etc/dnf/automatic.conf: set apply_updates = yes and, under [emitters], emit_via = motd plus your preferred email or command emitter. Check the timer with systemctl list-timers dnf-automatic.timer.

Verify it actually runs

After configuring, confirm the service and timers are live:

systemctl status unattended-upgrades
cat /var/log/unattended-upgrades/unattended-upgrades.log | tail -20

Force a run to confirm end-to-end behavior: sudo unattended-upgrades. You should see newly installed packages in the log and, if any were pending, a reboot at the configured time. Combine this with key-only SSH and a firewall — virtualserversvps.com has a full hardening checklist for the rest of the setup.

Automated patching is one layer; snapshots are the second. Before a major change or at least weekly, take a provider snapshot so a bad update is a five-minute rollback instead of a rebuild. see the full specs and pricing on our VPS comparison page to see which providers include free snapshots on entry plans.

If you would rather not maintain patching yourself, Cloudways managed VPS hosting applies OS and stack patches on managed plans with a staging area for testing — at a higher price than unmanaged VPS, but with the operational work removed.