نصب خودکار وصله‌های امنیتی در Debian با unattended-upgrades

sudo apt install -y unattended-upgrades apt-listchanges needrestart
sudo dpkg-reconfigure -plow unattended-upgrades
cat /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
//      "origin=Debian,codename=${distro_codename}-updates";
};

Unattended-Upgrade::Package-Blacklist {
    "postgresql-";
    "mariadb-server";
};

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

Unattended-Upgrade::Mail "ops@sahor.ir";
Unattended-Upgrade::MailReport "on-change";

sudo unattended-upgrade --dry-run --debug 2>&1 | tail -30
systemctl list-timers 'apt-daily*'

less /var/log/unattended-upgrades/unattended-upgrades.log
ls /var/run/reboot-required 2>/dev/null && cat /var/run/reboot-required.pkgs
sudo needrestart -r l      # list services that still run old libraries