Automatic Updates¶

Updating once fixes today. The machine also needs to keep checking, so that the next security release installs without anyone remembering to run apt (CIS 1.2.2.2).

The periodic settings¶

/etc/apt/apt.conf.d/10periodic and 20auto-upgrades control what apt does on a timer. Values are in days; 1 means daily, 0 means never.

Setting	Value	Meaning
`APT::Periodic::Update-Package-Lists`	"1"	Refresh the lists daily
`APT::Periodic::Download-Upgradeable-Packages`	"1"	Download available updates daily
`APT::Periodic::AutocleanInterval`	"7"	Clean the cache weekly
`APT::Periodic::Unattended-Upgrade`	"1"	Install security updates daily

sudo tee /etc/apt/apt.conf.d/10periodic > /dev/null <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
EOF
sudo tee /etc/apt/apt.conf.d/20auto-upgrades > /dev/null <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF

unattended-upgrades¶

The package that does the installing:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades    # answer Yes
systemctl is-enabled unattended-upgrades apt-daily.timer apt-daily-upgrade.timer

/etc/apt/apt.conf.d/50unattended-upgrades lists which origins are installed automatically; the ${distro_id}:${distro_codename}-security line must be present and uncommented. In the same file, two lines the STIG wants (UBTU-22-214015) so replaced packages and old kernels don't pile up as attack surface:

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

The GUI¶

Mint: Update Manager → Edit → Preferences → Automation, turn on Apply updates automatically; the Options tab sets how often to check. Debian GNOME: Software & Updates → Updates. Both write the same files.

Verify¶

cat /etc/apt/apt.conf.d/10periodic /etc/apt/apt.conf.d/20auto-upgrades
systemctl list-timers apt-daily*
sudo unattended-upgrade --dry-run --debug 2>&1 | tail -n 5

Example¶

10periodic has Download-Upgradeable-Packages "0" and Unattended-Upgrade "0"; nothing is ever installed automatically. Write both files, install unattended-upgrades, confirm the timers are active.

Try it¶

Set the periodic values, then run unattended-upgrade --dry-run --debug and read what it would do.
Find the apt timers with systemctl list-timers.

Build it¶

An autoupdate.sh that writes the two files and prints the timers.

Next¶

Snaps and Flatpaks