Turn on automatic security updates (unattended-upgrades and dnf-automatic)

Most break-ins on small servers use security holes that already have a fix. Automatic security updates close that gap within a day of a patch being released, even when you are busy.

Update everything once by hand

Start from a fully patched system.

sudo apt update && sudo apt upgrade -y     # Ubuntu / Debian
sudo dnf upgrade -y                        # AlmaLinux / Rocky Linux

Ubuntu and Debian: unattended-upgrades

1. Install and switch it on

Ubuntu usually has it already. Debian minimal images may not.

sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Answer Yes. This writes /etc/apt/apt.conf.d/20auto-upgrades, which should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

2. Decide about reboots

Kernel and core library updates only take effect after a reboot. Open /etc/apt/apt.conf.d/50unattended-upgrades and set these lines if you want the server to reboot itself at a quiet hour when needed:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

Leave them at false if an unplanned reboot would hurt, and reboot by hand when /var/run/reboot-required exists.

3. Test it

sudo unattended-upgrade --dry-run --debug

Logs are kept in /var/log/unattended-upgrades/.

AlmaLinux and Rocky Linux: dnf-automatic

1. Install

sudo dnf install -y dnf-automatic

2. Configure security-only updates

Edit /etc/dnf/automatic.conf and set these values in the [commands] section:

[commands]
upgrade_type = security
download_updates = yes
apply_updates = yes

Use upgrade_type = default if you prefer all updates, not only security fixes.

3. Enable the timer

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers 'dnf-automatic*'

To see whether a reboot is needed after updates, run:

sudo dnf needs-restarting -r

Troubleshooting

• Nothing seems to install: on Debian/Ubuntu check 20auto-upgrades contains both lines set to "1". On AlmaLinux/Rocky make sure apply_updates = yes and the timer is active.
• A held package is never updated: apt-mark showhold lists packages pinned by hand. Remove the hold with sudo apt-mark unhold <package> if it is no longer needed.
• dpkg was interrupted: run sudo dpkg --configure -a, then sudo apt -f install.

Next steps

• Set up a UFW firewall or firewalld
• Protect SSH with Fail2ban