One of the best reasons to choose Debian for a server is that you can almost forget about it for months at a time. Unattended-upgrades is the package that makes that possible — it automatically installs security patches in the background, so you don't have to.
Who is this for? Mostly servers and headless boxes you don't log into every day. On a desktop you're free to install it too, but you're probably running updates manually anyway.
What it does (and what it doesn't)
By default, unattended-upgrades only installs security updates. It does not upgrade to a new Debian release, and it doesn't install software you didn't already have. It's the quiet janitor, not a renovator.
Step 1: Install it
sudo apt install unattended-upgrades apt-listchangesapt-listchanges is a small helper that shows you a summary of what changed in each update — useful if you ever want to read the email reports.
Step 2: Enable it
sudo dpkg-reconfigure -plow unattended-upgradesA blue dialog appears asking whether to enable automatic updates. Say Yes. Behind the scenes this writes a small file at /etc/apt/apt.conf.d/20auto-upgrades that tells the system to check for updates every day.
Step 3: Tighten the policy
The defaults are sensible but worth reviewing. Open the main config:
sudo nano /etc/apt/apt.conf.d/50unattended-upgradesFind the Origins-Pattern block near the top. To install only security updates (no risk of a routine update breaking something at 3 AM), leave just the line that mentions codename}-security and comment the others out with //.
If you want the machine to reboot itself after an update that requires it, scroll down and set:
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:30";Auto-reboot is great for servers, less great for a desktop you're working on. Choose what fits.
Step 4: Test it without trusting it
sudo unattended-upgrade --dry-run --debug--dry-run means "show what you would do, but don't actually do it." Read the output and make sure you're happy with what it lists.
Step 5 (optional): Get an email when something changes
If you have local mail working, add this to 50unattended-upgrades:
Unattended-Upgrade::Mail "you@example.com";
Unattended-Upgrade::MailReport "on-change";Now you'll get a one-paragraph email every time updates are applied, and a louder one if anything fails.
How to confirm it's really running
The next morning, check the log:
cat /var/log/unattended-upgrades/unattended-upgrades.logIf you see lines about packages being installed (or "no updates to apply"), it's working. If the file doesn't exist yet, give it a day — the daily timer hasn't fired.