Automatic Security Updates on Linux (Ubuntu, AlmaLinux)

Most servers are compromised through known vulnerabilities that already had a patch. Automatic security updates close that window without you logging in every day. This guide sets them up on both major Linux families and explains how to control reboots.

Before you start

Root or sudo access.
Backups or snapshots: automatic updates are very safe for security patches, but any change can occasionally break something.
On cPanel servers, leave updates to cPanel's own update settings in WHM rather than these tools.

Ubuntu and Debian: unattended-upgrades

Install it (often preinstalled on Ubuntu):

apt install unattended-upgrades apt-listchanges

Enable the daily run:

dpkg-reconfigure -plow unattended-upgrades

Choose Yes. This writes /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Review /etc/apt/apt.conf.d/50unattended-upgrades. By default only the security origin is enabled, which is what you want. Useful options:

Unattended-Upgrade::Mail "you@example.com";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

Test with a dry run:
```
unattended-upgrade --dry-run --debug
```

Email reports need a working mail setup (for example apt install mailutils with an SMTP relay). Logs are in /var/log/unattended-upgrades/.

AlmaLinux and Rocky: dnf-automatic

Install it:
```
dnf install dnf-automatic
```
Edit /etc/dnf/automatic.conf:
```
[commands]
upgrade_type = security
apply_updates = yes
reboot = when-needed

[emitters]
emit_via = stdio
```
reboot = when-needed requires a recent dnf-automatic; on older versions leave reboots to you. Set emit_via = email and the [email] section for mail reports.

Enable the timer:

systemctl enable --now dnf-automatic.timer

Check when it will run: systemctl list-timers dnf-automatic.timer

Handle reboots

Kernel and core library updates only take effect after a reboot.

Ubuntu/Debian: a reboot is pending if /var/run/reboot-required exists.
AlmaLinux/Rocky: run dnf needs-restarting -r.
Services using updated libraries: needrestart (Debian/Ubuntu) restarts them automatically on recent releases.

If unplanned reboots are unacceptable, disable automatic reboot and schedule a monthly maintenance window. Kernel live-patching (Ubuntu Pro Livepatch, KernelCare, TuxCare) can patch the kernel without a reboot.

Check that it works

Ubuntu/Debian: cat /var/log/unattended-upgrades/unattended-upgrades.log
AlmaLinux/Rocky: journalctl -u dnf-automatic
List available security updates manually: apt list --upgradable or dnf updateinfo list security.

Troubleshooting

Could not get lock /var/lib/dpkg/lock: unattended-upgrades is running. Wait a few minutes rather than killing it.
Packages kept back: they need new dependencies. Run apt full-upgrade manually after checking.
Third-party repo packages not updated: only the origins listed in Allowed-Origins are upgraded. Add others if you trust them.

Automatic updates FAQ

Are automatic updates safe on production servers?

For security-only updates, yes for most servers: the risk of an unpatched vulnerability is higher than the risk of a patch breaking something.

Should I auto-update everything, not just security?

Feature updates are better applied manually, after testing, so you can watch for changes.

Does Windows Server do this too?

Yes, Windows Update can install updates automatically, configured through Settings or Group Policy.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket