#Staying Up-to-Date
The first thing we’re going to do is make sure we have the latest security updates for Ubuntu.
1sudo apt-get update2sudo apt-get upgrade -y
Some updates, like a new kernel, only take effect after a reboot. Ubuntu creates /var/run/reboot-required when that is the case:
1[ -f /var/run/reboot-required ] && sudo reboot
#Automatic Security Updates
Ubuntu ships with unattended-upgrades, which installs security updates automatically every day. Make sure it is installed and enabled:
1sudo apt-get install -y unattended-upgrades
file: /etc/apt/apt.conf.d/20auto-upgrades
1APT::Periodic::Update-Package-Lists "1";2APT::Periodic::Unattended-Upgrade "1";3APT::Periodic::AutocleanInterval "7";
1sudo systemctl enable --now unattended-upgrades
By default only packages from the security pocket are upgraded, and the server is never rebooted automatically. We recommend keeping it that way for a forger, so you can plan reboots and make sure it comes back online. You can check what would be upgraded with:
1sudo unattended-upgrade --dry-run --debug
Information
Kernel updates still need a reboot. If you want to avoid that, Canonical Livepatch applies critical kernel fixes to a running system. It is part of Ubuntu Pro, which is free for personal use on a limited number of machines: sudo pro attach <token> && sudo pro enable livepatch.
Warning
cron-apt is no longer recommended. Remove it if you set it up before, so it does not run alongside unattended-upgrades: sudo apt-get purge cron-apt.