Following the recent heartbleed vulnerability of OpenSSL, I would like to keep my EC2 machines updated on a regular basis. The naive approach would be setting an hourly cron job for security updates (sudo apt-get update && sudo unattended-upgrade).

Are there any risks of doing that? Is there a recommended update mechanism for EC2 machines?


The unattended-upgrades package is the standard way to automatically apply important bug fixes and security patches in Ubuntu.

I recommend installing this on every Ubuntu system:

sudo apt-get update &&
sudo apt-get install unattended-upgrades

You don't need to create your own cron job. The package installs one for you.

You can edit the default configuration if you'd like to alter its behavior: https://help.ubuntu.com/lts/serverguide/automatic-updates.html

  • Any thoughts on the advisability of doing this on a production server? It makes me nervous to have changes quietly applied and risk the possibility of the update failing or introducing problems. – ianjs Apr 14 '14 at 2:19
  • 3
    By "every" I meant production systems, too. I've been auto applying Ubuntu security patches for many years and can't remember any serious issues. It makes me nervous to have a production server sitting there without patches to known security issues and risk the possibility of having them exploited. That said each situation has different needs, so you may be better off going through a rigorous testing phase for each patch. Be aware, though, that they are released all the time, so you'll be busy. – Eric Hammond Apr 19 '14 at 18:48
  • 1
    I do not advise this unless you have a redundant / cluster setup. Ubuntu's update procedures are not up to snuff, I've had stopped services multiple times and most recently even a broken boot sector... And we don't to anything special -- just Apache as reverse proxy and Tomcat applications. – dualed Feb 6 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.