Maintaining the security and stability of a server isn’t just about configuring a firewall or choosing a strong password. One simple yet crucial step is ensuring the system is regularly updated. This is where the auto-update feature plays a crucial role, especially for Linux VPS users using public servers or backend services. In this blog, we’ll be looking into how to enable automatic security updates on Ubuntu 26.04.
The Linux operating system is known for its reliability, but it isn’t immune to security vulnerabilities. Whenever developers discover a vulnerability in the system, they release a security patch that must be applied immediately. If a VPS isn’t regularly updated, attackers can exploit these vulnerabilities.
The problem is, many VPS users forget or delay the update process, citing busy schedules, fear of server downtime, or simply not knowing how. As a result, the server continues to run with old, vulnerable packages and kernels. A practical solution is to enable auto-updates, which run in the background.
Prerequisites
- An Ubuntu 26.04 VPS
- SSH root access, or a user with sudo privileges
Conventions
# – given commands should be executed with root privileges either directly as a root user or by use of sudo command
$ – given commands should be executed as a regular userWhat Are Auto-Updates in Linux?
Auto-updates is a feature that allows the Linux operating system, not just Ubuntu, to automatically update critical packages without manual intervention. This feature generally updates only security-related packages, thereby avoiding system instability.
Each Linux distribution has a different way to enable automatic updates. For example, on Ubuntu and Debian, users can use a package called unattended-upgrades. Meanwhile, on CentOS or AlmaLinux, tools like dnf-automatic or yum-cron are available.
Benefits of Enabling Automatic Updates
There are some benefits of enabling automatic updates:
Guaranteed Security
The server will automatically receive the latest security patches.
Minimal Manual Intervention
Suitable for users who don't have time to monitor daily updates.
Reduced Risk of Exploitation
Avoid exploiting common vulnerabilities that bots can exploit.
Reduced Downtime Costs
A successful attack can cause financial losses. Automatic updates help prevent this from happening in the first place.
However, it's important not to enable all types of updates indiscriminately. Some non-security updates can cause dependency conflicts or unwanted service restarts.How to Set Up Auto Updates on Ubuntu
Automatic updates and unattended upgrades on Ubuntu 26.04 are handled by the unattended-upgrades package. The unattended-upgrades package is usually preinstalled on Ubuntu systems. However, it may not be installed by default. We can check it first using the command below.
$ dpkg -l unattended-upgrades
The command will print an output like this:
+-- Desired=Unknown/Install/Remove/Purge/Hold
|+- Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
||+ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||| Name Version Architecture Description
+++-===================-============-============-===========================================
ii unattended-upgrades 2.12ubuntu9 all automatic installation of security upgradesIf you do not see a similar output, you need to install it. Execute this command to install it.
$ sudo apt install unattended-upgrades
That’s it; the automatic update package should be installed now.
Enable Automatic Updates.
Now, we can run the command below.
$ sudo dpkg-reconfigure --priority=low unattended-upgrades
You will be prompted with the interactive reconfiguration tool to enable the automatic update. The command will print an output like this:
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 79.)
debconf: falling back to frontend: Readline
Configuring unattended-upgrades
-------------------------------
Applying updates on a frequent basis is an important part of keeping systems secure. By default, updates need to be applied manually using package management tools.
Alternatively, you can choose to have this system automatically download and install important updates.
Automatically download and install stable updates? [yes/no] Simply type ‘yes’ then hit ENTER. The command creates the file /etc/apt/apt.conf.d/20auto-upgrades with the following content:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";Each value represents the interval in days. Setting “1” runs the action every day; “7” runs it every week; and “0” disables the action. Let’s run the command below to check the status.
$ sudo systemctl status unattended-upgradesYou should see something like this:
● unattended-upgrades.service - Unattended Upgrades Shutdown
Loaded: loaded (/usr/lib/systemd/system/unattended-upgrades.service; enabled; preset: enabled)
Active: active (running) since Sun 2026-05-17 14:08:08 UTC; 5m ago
Invocation: 0e9afedec7d04a64962b700faecce50c
Docs: man:unattended-upgrade(8)
Main PID: 1028337 (unattended-upgr)
Tasks: 2 (limit: 1605)
Memory: 15M (peak: 15M)
CPU: 159ms
CGroup: /system.slice/unattended-upgrades.service
└─1028337 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
May 17 14:08:08 ubuntu26 systemd[1]: Started unattended-upgrades.service - Unattended Upgrades Shutdown.
May 17 14:08:08 ubuntu26 unattended-upgrade-shutdown[1028337]: /usr/share/unattended-upgrades/unattended-upgrade-shutdown:250: PyGIDeprecationWarning: GLib.unix_signa>
May 17 14:08:08 ubuntu26 unattended-upgrade-shutdown[1028337]: GLib.unix_signal_add(GLib.PRIORITY_DEFAULT, sig,In Ubuntu 26.04, the automatic update system is based on two systemd timers, replacing the older cron-based system. The apt-daily.timer is used to download the package lists and new packages, while the apt-daily-upgrade.timer manages the installation itself. These timers incorporate randomized delays to ensure that not all machines access the repositories simultaneously.
Things to Note:
Ensure updates only come from trusted repositories.
Create regular backups before major updates.
Avoid automatic reboots unless absolutely necessary.
Monitor the automatic update log to detect any errors.Verify Automatic Security Updates
After configuring unattended-upgrades, it is time to verify that everything works as expected before relying on it for production security by running a dry run. A dry run is a test that simulates the upgrade process without actually installing anything. Let’s execute the command below to do a dry run.
$ sudo unattended-upgrades --dry-run The command will not show you anything if everything is okay. You can add the ‘debug’ option to the command to see detailed messages.
$ sudo unattended-upgrades --dry-run --debugWhen using the debug option, you will see a verbose output showing which packages would be upgraded, which origins are allowed, and any configuration errors.
The unattended-upgrades daemon logs its activity to the /var/log/unattended-upgrades/ directory. Let’s check the log:
$ sudo tail -f /var/log/unattended-upgrades/unattended-upgrades.logAdditionally, check the dpkg log for details about which packages were actually installed:
$ sudo tail -f /var/log/unattended-upgrades/unattended-upgrades-dpkg.logTrigger a manual run: To force an immediate update cycle (useful for testing), run:
$ sudo unattended-upgrades --verbose
The command above will run the actual upgrade and display its progress. If there is no package that can be upgraded, you will see a similar message:
No packages found that can be upgraded unattended and no pending auto-removalsWe recommend that Ubuntu users enable automatic updates only for security patches to avoid service conflicts. If using a panel like Webmin or cPanel, check if there’s a built-in automatic update option that can be configured from the dashboard. Use monitoring tools like Logwatch or integration with Telegram/Email for daily update notifications.
Enabling automatic updates doesn’t mean your server can be left unattended. However, it’s a crucial step in reducing security risks and maintaining long-term server stability. With the right configuration, automatic updates can be a constant guard for your system without requiring daily admin presence.
Wrapping Everything Up
Congratulations! You have learned how to enable automatic security updates and unattended upgrades on Ubuntu 26.04. If you’re still not sure how to handle these updates yourself, you can look for a reputable Linux MSP to handle them for you.
If you liked this post on how to enable automatic security updates and unattended upgrades on Ubuntu 26.04, please share it with your friends or leave a comment below.