Most successful attacks on servers exploit vulnerabilities that already have a fix. Automatic security updates close that window without you logging in every day. The trick is to automate the safe updates, get notified, and handle reboots deliberately.

Ubuntu and Debian: unattended-upgrades

Install and enable

apt install -y unattended-upgrades apt-listchanges
dpkg-reconfigure -plow unattended-upgrades   # answer "Yes"

This creates /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Configure what gets updated

Edit /etc/apt/apt.conf.d/50unattended-upgrades. By default only the security origin is enabled — that’s the right choice for most servers. Useful options:

// Email a report (requires a working local mailer, e.g. msmtp or postfix)
Unattended-Upgrade::Mail "[email protected]";
Unattended-Upgrade::MailReport "on-change";

// Remove unused kernels and dependencies
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Reboot automatically when required (e.g. kernel updates), at a quiet time
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:30";

// Never auto-update these packages
Unattended-Upgrade::Package-Blacklist {
    "mariadb-server";
};

Test it

unattended-upgrade --dry-run --debug
less /var/log/unattended-upgrades/unattended-upgrades.log

AlmaLinux and Rocky Linux: dnf-automatic

dnf install -y dnf-automatic

Edit /etc/dnf/automatic.conf:

[commands]
upgrade_type = security
apply_updates = yes
reboot = when-needed            # newer versions; otherwise handle reboots separately
reboot_command = "shutdown -r +5 'Rebooting after updates'"

[emitters]
emit_via = stdio                # or email (configure [email] section)

Enable the timer:

systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer

Reboots: the part people forget

Kernel and core library updates only take effect after a reboot (or service restarts).

  • Debian/Ubuntu: /var/run/reboot-required exists when a reboot is needed. needrestart (installed by default on Ubuntu) restarts affected services automatically.
  • RHEL family: dnf needs-restarting -r tells you if a reboot is required.

Either allow automatic reboots at a quiet hour (fine for most single servers behind a restart-safe application), or monitor the flag and reboot during a maintenance window.

[ -f /var/run/reboot-required ] && cat /var/run/reboot-required.pkgs

What not to auto-update

  • Major version upgrades of the OS — always manual.
  • Databases on critical servers, if you want to control restart timing.
  • Packages from third-party repositories whose updates have broken things before.

Security-only updates from the distribution are designed to be safe to apply automatically.

Containers and applications

unattended-upgrades updates the host OS. It doesn’t update:

  • Docker images — rebuild or pull new images regularly (or use a tool that notifies you of updates).
  • Language packages (npm, pip, Composer) — handled by your deployment process.
  • CMS and plugins — e.g. WordPress automatic updates.

Summary

Turn on security-only automatic updates, get a report by email, and decide how reboots happen. It takes five minutes and removes the most common way servers get compromised. Part of our broader VPS maintenance guide and Debian setup checklist.

  • Security
  • Updates
  • Linux