Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you use apt-get to only install critical security updates on ubuntu?

We'd like to only upgrade packages that need to be upgraded for security reasons, without upgrading all other packages.

share|improve this question
There is a great answer to this on askubuntu… – Iain May 16 '11 at 18:55
Perhaps I'm stating the obvious, but if you are running a stable distribution, the only updates you get will be critical updates (mostly security, occasionally fixing crucial breakage in a package). – tripleee Jan 22 '13 at 11:30

I read the apt-get man page carefully when I got tired of manually editing the sources.list every time I wanted to only apply security updates (that means the second time).

Figured this solution out:

sudo cp /etc/apt/sources.list /etc/apt/security.sources.list

Edit the latter to contain only security repositories, then:

sudo apt-get upgrade -o Dir::Etc::SourceList=/etc/apt/security.sources.list

Tadaaaa... Scriptable stuff.

share|improve this answer

Try the unattended-upgrades or any of the other methods listed here. It can be used to configure automatic security updates (I believe it's used when asked during the installer) as well as other upgrades automatically. See the man pages for more details.

share|improve this answer

If you are just looking to do this quickly once, instead of creating a separate repository and scripting up some automation and all that. Great if you aren't supposed to be making changes while auditing a system or whatever.

These two commands will spit out the list. Pipe to wc -l to see how many are behind. ;-)

grep security /etc/apt/sources.list > /tmp/security.list
sudo apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -s

Still valid for older distros or if you have update repos off, but security on:

sudo apt-get upgrade -s| grep ^Inst |grep Security 
share|improve this answer

I don't know if it will work, but apt has it's sources in /etc/apt/sources.list and/or /etc/sources.list.d/

Why not edit the file, and comment all lines that are not part of the security updates ?

The security lines for apt should be something like this:

deb ..... ..... ...

Leave those lines alone and comment all the others.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.