How To Set Up Automatic Security Updates with unattended-upgrades on Ubuntu 22.04

Leaving a server's security patches to manual, occasional `apt upgrade` runs is one of the most common ways a box quietly falls behind on fixes for known vulnerabilities. Ubuntu ships a tool built specifically to close that gap: `unattended-upgrades`, a background service that checks for and installs security updates on a schedule without you having to log in and run anything.

This tutorial walks through installing `unattended-upgrades` on an Ubuntu 22.04 server, understanding exactly which package sources it is allowed to pull from, turning on the periodic APT timers that drive it, and — for updates that touch the running kernel — configuring a safe, predictable automatic reboot window. You'll finish by validating the whole setup with a dry run before trusting it to run unattended.

Step 1 — Installing unattended-upgrades

Start by refreshing the local package index and installing the `unattended-upgrades` package itself, along with `apt-listchanges`, which lets the tool summarize what changed in each package it installs. On many current Ubuntu 22.04 images `unattended-upgrades` is already installed by default, but running the install command is harmless and ensures you're on the version from your configured repositories.

sudo apt update
sudo apt install unattended-upgrades apt-listchanges

Installing the package alone does not turn anything on — it just puts the binary and its default configuration files in place under `/etc/apt/apt.conf.d/`. The next two steps cover what those config files control and how to actually enable the periodic runs.

Step 2 — Reviewing /etc/apt/apt.conf.d/50unattended-upgrades

The file `/etc/apt/apt.conf.d/50unattended-upgrades` is where you control which package origins are eligible for automatic installation and how the tool behaves once it decides to act. Open it in a text editor to look at the defaults before changing anything.

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Near the top you'll find the `Allowed-Origins` block, which is the single most important setting in this file — it's an allowlist of exactly which repositories `unattended-upgrades` is permitted to pull packages from. On a stock Ubuntu 22.04 install it looks roughly like this, with the general updates, proposed, and backports lines commented out by default so only security-relevant origins are active:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";
//  "${distro_id}:${distro_codename}-updates";
//  "${distro_id}:${distro_codename}-proposed";
//  "${distro_id}:${distro_codename}-backports";
};