Thought I'd share how to get unattended upgrades working on Ubuntu Enhance servers:
Edit the config file, and modify it to trust/include the enhance repo:
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
Remove the Allowed-Origins lines, and replace with these lines:
Unattended-Upgrade::Origins-Pattern {
// Ubuntu standard
"o=Ubuntu,a=${distro_codename}";
"o=Ubuntu,a=${distro_codename}-security";
"o=UbuntuESMApps,a=${distro_codename}-apps-security";
"o=UbuntuESM,a=${distro_codename}-infra-security";
"o=Ubuntu,a=${distro_codename}-updates";
// Enhance repo
"o=Enhance,a=${distro_codename}";
};
Then optionally run it with --dry-run to test it:
sudo unattended-upgrade --dry-run --debug
I do this on every Enhance server and it updates automatically daily now.
Or... If you don't like using unattended-upgrades... I used to use this script and scheduled it to run twice a day via crontab. It runs apt update / apt upgrade and then if ran between 1-3am (server time) it compares the kernel running, and if needed it will send an email notification, and reboot the server for you. It is specific to vmlinuz so that part may need to be edited depending on your OS and VM etc:
# will run apt update, apt upgrade, apt autoremove
# if ran between 1am-3am (cron) it will eval kernel and if reboot needed, email and reboot
LOGFILE="/var/log/full-upgrade-reboot.log"
EMAIL="youremail@yourdomain.com"
echo "=== Upgrade started at $(date) ===" >> $LOGFILE
# Save current kernel version
OLD_KERNEL=$(uname -r)
# Update package lists and upgrade everything
apt update >> $LOGFILE 2>&1
DEBIAN_FRONTEND=noninteractive apt upgrade -y >> $LOGFILE 2>&1
apt autoremove -y >> $LOGFILE 2>&1
# Check if kernel upgraded
LATEST_KERNEL=$(ls -1 /boot/vmlinuz-* 2>/dev/null | sort -V | tail -n1)
LATEST_KERNEL=$(basename "$LATEST_KERNEL")
NEW_KERNEL=${LATEST_KERNEL#vmlinuz-}
if [ "$OLD_KERNEL" != "$NEW_KERNEL" ]; then
echo "Kernel upgraded from: $OLD_KERNEL to: $NEW_KERNEL" >> $LOGFILE
# Determine current hour
CURRENT_HOUR=$(date +%H)
# Auto-reboot window: 01:00–03:00
if [ "$CURRENT_HOUR" -ge 1 ] && [ "$CURRENT_HOUR" -lt 3 ]; then
echo "*** Within reboot window. Sending email and rebooting ***" >> $LOGFILE
# Send email notification
/usr/sbin/sendmail $EMAIL <<EOF
Subject: [Server: $(hostname)] Kernel Upgrade and Reboot
From: no-reply@$(hostname)
To: $EMAIL
Kernel upgraded on $(hostname) from $OLD_KERNEL to $NEW_KERNEL.
System is rebooting now.
EOF
# Wait a few seconds to ensure email is sent
sleep 15
# Reboot the system (systemd will stop services cleanly)
/sbin/reboot
else
echo "Kernel upgraded but outside reboot window. Manual reboot required." >> $LOGFILE
fi
else
echo "No kernel change, reboot not required." >> $LOGFILE
fi
echo "=== Upgrade finished at $(date) ===" >> $LOGFILE
