You are helping the user configure automatic updates for Ubuntu.
Configures unattended security updates on Ubuntu systems. Use this to automatically install critical patches while maintaining control over reboot behavior, update types, and notifications for production or personal machines.
/plugin marketplace add danielrosehill/linux-desktop-plugin/plugin install lan-manager@danielrosehillYou are helping the user configure automatic updates for Ubuntu.
Check current update configuration:
dpkg -l | grep unattended-upgradescat /etc/apt/apt.conf.d/50unattended-upgradescat /etc/apt/apt.conf.d/20auto-upgradescat /etc/apt/apt.conf.d/10periodicInstall unattended-upgrades if not present:
sudo apt update
sudo apt install unattended-upgrades apt-listchanges
Ask user about their update preferences: Discuss with the user:
Configure update types:
Edit /etc/apt/apt.conf.d/50unattended-upgrades:
For security updates only (recommended):
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-security";
};
For security + updates:
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-security";
"${distro_id}:${distro_codename}-updates";
};
Configure automatic reboot settings:
In /etc/apt/apt.conf.d/50unattended-upgrades, configure:
Never auto-reboot (safest):
Unattended-Upgrade::Automatic-Reboot "false";
Auto-reboot when required:
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
Only reboot if no users logged in:
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Configure email notifications (optional): If user wants email notifications:
Unattended-Upgrade::Mail "user@example.com";
Unattended-Upgrade::MailReport "on-change"; // or "always" or "only-on-error"
Note: Requires mail system configured (postfix, sendmail, etc.)
Enable automatic updates:
Create/edit /etc/apt/apt.conf.d/20auto-upgrades:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
Explanation:
Update-Package-Lists: Update package list (1=daily)Download-Upgradeable-Packages: Pre-download updates (1=daily)AutocleanInterval: Clean up old packages (7=weekly)Unattended-Upgrade: Actually install updates (1=daily)Configure blacklist (packages to exclude):
In /etc/apt/apt.conf.d/50unattended-upgrades:
Unattended-Upgrade::Package-Blacklist {
"linux-image-*"; // Example: don't auto-update kernel
"nvidia-*"; // Example: don't auto-update GPU drivers
};
Ask user if there are specific packages they want to exclude.
Test configuration:
sudo unattended-upgrades --dry-run --debug
sudo unattended-upgrade --dry-run
Set up monitoring:
cat /var/log/unattended-upgrades/unattended-upgrades.logcat /var/log/dpkg.logsystemctl status unattended-upgrades.serviceConfigure additional safety options:
In /etc/apt/apt.conf.d/50unattended-upgrades:
// Remove unused dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";
// Remove unused kernel packages
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
// Automatically remove new unused dependencies
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
// Split the upgrade into smallest possible chunks
Unattended-Upgrade::MinimalSteps "true";
// Install updates when on AC power only
Unattended-Upgrade::OnlyOnACPower "true"; // laptops only
Set up pre/post-update hooks (optional): If user wants custom actions before/after updates:
Unattended-Upgrade::PreUpdate "echo 'Starting updates' | logger";
Unattended-Upgrade::PostUpdate "echo 'Updates complete' | logger";
Enable and start the service:
sudo systemctl enable unattended-upgrades
sudo systemctl start unattended-upgrades
sudo systemctl status unattended-upgrades
Manual trigger for testing:
sudo unattended-upgrade -d
Provide best practices and recommendations:
/var/log/unattended-upgrades/Show how to check what's configured:
# View current configuration
apt-config dump APT::Periodic
# Check when updates last ran
ls -la /var/lib/apt/periodic/
# View update history
cat /var/log/unattended-upgrades/unattended-upgrades.log