Turn on automatic security updates

Why automatic updates

Most compromised servers run software with a known fix that was never applied. Automatic security updates close that gap without you remembering to log in. The trade-off is that an update can occasionally restart a service or need a reboot, so decide how to handle that and keep backups.

Applying only security updates keeps changes small. Run a full manual update from time to time as well, as the update guide describes.

Ubuntu: configure unattended-upgrades

Ubuntu normally installs and enables this already. Check that the package exists, then confirm that the daily timers are active and the policy allows security updates. Check the effective configuration file instead of assuming.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
cat /etc/apt/apt.conf.d/20auto-upgrades
systemctl list-timers apt-daily*.timer

grep -A6 "Allowed-Origins" /etc/apt/apt.conf.d/50unattended-upgrades

Ubuntu: decide about reboots

Some updates, such as a new kernel, only take effect after a reboot. By default Ubuntu does not reboot by itself. If you accept short downtime, set an automatic reboot at a quiet time. Otherwise check for a pending reboot yourself.

sudo tee /etc/apt/apt.conf.d/52reboot >/dev/null <<'EOF'
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
EOF

test -f /var/run/reboot-required && cat /var/run/reboot-required || echo "No reboot needed"

AlmaLinux: configure dnf-automatic

Install dnf-automatic, then set it to apply security updates only. The configuration file is /etc/dnf/automatic.conf. The default timer only downloads, so enable apply_updates and use the install timer.

sudo dnf install dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/;s/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
grep -E "^(upgrade_type|apply_updates)" /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic-install.timer
systemctl list-timers dnf-automatic*

AlmaLinux: find out whether a reboot is needed

The needs-restarting tool reports when a core library or the kernel changed. Run it after updates, and reboot at a convenient time. Without -r it lists the processes using old libraries, which you can restart individually.

sudo dnf install dnf-utils
sudo needs-restarting -r
sudo needs-restarting -s

Check that it works

Look at the log of the last run. On Ubuntu that is the unattended-upgrades log, and on AlmaLinux the journal for the timer's service. Confirm the number of pending updates is staying low.

sudo tail -n 20 /var/log/unattended-upgrades/unattended-upgrades.log
apt list --upgradable 2>/dev/null | tail -n 5

sudo journalctl -u dnf-automatic-install.service --no-pager | tail -n 20
dnf check-update --security

What automatic updates do not cover

They do not update software you installed manually, containers, language packages or WordPress plugins. Update those on a schedule too, and subscribe to the project's security announcements. Take a backup or snapshot before big upgrades, and keep a working recovery console.