"Unattended Upgrades" is a package available on Ubuntu systems that automatically installs updates for security and, optionally, other software packages. This tool is crucial for maintaining system security and stability. It ensures that vulnerabilities and bugs are promptly addressed without requiring manual intervention. This post details the setup instructions for using it for security updates on an Ubuntu Linux 22.04 or 24.04 server and sending emails when the updates are completed.
init: 20240312)sudo pro attach TOKEN) to enable it. You will be prompted with additional details on the different services enabled when run.# For Ubuntu 22.04 (Jammy Jellyfish) Allowed origins are: o=Ubuntu,a=jammy, o=Ubuntu,a=jammy-security, o=UbuntuESMApps,a=jammy-apps-security, o=UbuntuESM,a=jammy-infra-security # For Ubuntu 24.04 (Noble Numbat) Allowed origins are: o=Ubuntu,a=noble, o=Ubuntu,a=noble-security, o=UbuntuESMApps,a=noble-apps-security, o=UbuntuESM,a=noble-infra-security
pro status --all to check on the services enabled on the system.pro help to get more details on the available services, and pro enable <service> (adapt <service> with a valid option from the pro status service list) to attempt to enable that service on your system.# Install needed packages sudo apt install -y unattended-upgrades apt-listchanges # accept the choices given to you in the interactive dialogue # enable the automatic updates sudo dpkg-reconfigure --priority=low unattended-upgrades # select "yes" to "Automatically download and install stable updates?" # (optional) make it possible to reboot automatically sudo apt install -y update-notifier-common
cat /etc/apt/apt.conf.d/20auto-upgrades which should containAPT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1";
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades to see the options for customizing the system.sudo nano /etc/apt/apt.conf.d/50unattended-upgrades find the Unattended-Upgrade::Mail line and uncomment it (remove the // at the beginning of the line) and set the destination email, such as [email protected]. Note that mail sending needs to be functional on your host for this to work. The final line will look something like:Unattended-Upgrade::Mail "[email protected]";
/etc/apt/apt.conf.d/50unattended-upgrades, find, uncomment, and modify the following ::-containing lines according to your needs:// Automatically reboot *WITHOUT CONFIRMATION* if // the file /var/run/reboot-required is found after the upgrade //Unattended-Upgrade::Automatic-Reboot "false"; // Automatically reboot even if there are users currently logged in // when Unattended-Upgrade::Automatic-Reboot is set to true //Unattended-Upgrade::Automatic-Reboot-WithUsers "true"; // If automatic reboot is enabled and needed, reboot at the specific // time instead of immediately // Default: "now" //Unattended-Upgrade::Automatic-Reboot-Time "02:00";
sudo unattended-upgrades --dry-runsudo unattended-upgrades -v to run the tool for the first time and confirm that everything is functional.
If an update was performed and you have email notifications set up, you will receive an email with the details of the operation.
It is up to you to act on Warning: A reboot is required to complete this upgrade, or a previous one notification in the email's content.sudo apt-get update, sudo snap refresh—-list, brew update, etc.pro usage
Hosting on a VPS is a great option to run a blogging service, but installing services that might expose ports needs to be done with some precaution (or not at all if the service is only to be used by the server itself).
This is a more opinionated post than usual: I live on the command line on Linux. As such, I perform a few extra steps after a fresh installation to get to a “usable” system.
Postfix is a free, open-source mail transfer agent (MTA) used to route and deliver email over the Internet. FastMail is a paid service that provides a secure, privacy-focused email provider supporting custom domains. This post details the setup instructions for using Postfix as a Send-Only SMTP server, using Fastmail, on a Ubuntu Linux 22.04 server.