Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the GUI tool you can get a list packages with security updates. Can this be done on the command line in Debian or Ubuntu?

Normally I might use "apt-get upgrade" which would show me what is being upgraded, but I would like to know which ones are security updates.

share|improve this question
up vote 3 down vote accepted

Use the unattended-upgrade application.

sudo unattended-upgrade

This lets you install only security updates automatically, but you can call it manually if needed.

share|improve this answer
I like this answer as you've actually thought about what I might be trying to do and unattended-upgrade is something I've installed today to try out. – Stephen Paulger Sep 5 '12 at 20:38
apt-get upgrade -s | grep -i security

... is what the Nagios check-apt plugin uses to count pending security updates which is similar to what you're looking for.

share|improve this answer
But it cannot find bash security update for shellshock? – linjunhalida Sep 28 '14 at 2:18
This gives false positives on packages with "security" in the name, such as "xml-security-c-utils", "debian-security-support", "modsecurity-crs", "node-security", etc. – Shnatsel Dec 16 '14 at 18:55

On ubuntu you should be able to use apt-check, it's the one that populates your motd with the number of security updates available.

share|improve this answer
I can't see that on debian or ubuntu. – Stephen Paulger Oct 22 '12 at 15:33
apt-check is in /usr/lib/update-notifier/. Try /usr/lib/update-notifier/apt-check --human-readable for a straightforward message. – u2702 Oct 18 '14 at 1:30

You can get a list with this command:

sudo unattended-upgrade --dry-run -d 2>&1 > /dev/null | grep 'Checking' | awk '{ print $2 }'
share|improve this answer

I believe that Answering the question the OP asks is how to see the List of packages, and not how to install only security packages. Building on the answer of @topdog You should use: /usr/lib/update-notifier/apt-check -p Where the -p flag stands for packages

share|improve this answer
this lists all packages and not only security updates – confiq Jul 14 '15 at 14:11
apt-check seems unavailable in Debian Jessie. It remains on updated Wheezy-systems but fresh installs don't have the update-notifier-common anymore. Do you know an alternative? – jan Jan 27 at 17:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.