Automate Linux Security Updates: unattended-upgrades and dnf-automatic

This article is a localized edition of the Japanese original. Read the Japanese original

The time between a security update's release and its installation is when a Linux server is most exposed to attack. If you apply updates by hand, they tend to be left undone during busy periods or holidays. This article shows how to apply only security updates automatically, separately for Debian/Ubuntu (unattended-upgrades) and the RHEL family (AlmaLinux, Rocky Linux and others, using dnf-automatic). The information is current as of October 2026.

yum-cron, which was used on CentOS 7, and the even older yum-updatesd are not used on currently supported operating systems. CentOS 7 itself is already out of support, so if you are still running it, plan an OS migration before automating updates.

Decide these before enabling automatic updates

• Limit the scope: a safe setup installs only security updates automatically and applies regular updates, which include new features, by hand after checking them.
• Service restarts: when PHP, the web server or the database is updated, the service restarts, and the site may be unreachable for a few seconds.
• OS reboots: kernel and core library updates do not take effect until you reboot. Decide whether to reboot automatically or to reboot by hand after being notified.
• Backups: have snapshots or backups ready so you can roll back if an update causes trouble.

Debian / Ubuntu: unattended-upgrades

Step 1: Install and enable

It is often preinstalled on Ubuntu Server, but install it anyway to be sure, then enable it.

sudo apt update
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades   # Choose "Yes" to enable it

Enabling it writes the following to /etc/apt/apt.conf.d/20auto-upgrades. "1" means "run every day."

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

You can check that it is enabled with this command:

apt-config dump APT::Periodic::Unattended-Upgrade

Step 2: Check what is covered (security updates by default)

What gets updated automatically is defined in /etc/apt/apt.conf.d/50unattended-upgrades. On Ubuntu, the default covers updates from the security repository (-security), as shown below, and regular updates (-updates) are commented out.

Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
        // (ESM-related lines omitted)
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};

On Debian too, the default configuration installs only security updates automatically (Debian specifies them in the Origins-Pattern format). Packages installed from external repositories (such as the official PHP or MariaDB repositories) are not updated automatically unless you add them here.

Step 3: Exclusions, email notifications and reboots

50unattended-upgrades is a package configuration file, so if you edit it directly you will be asked to review the differences every time the package is updated. The Debian Wiki describes writing only your changes to a separate file (for example, 52unattended-upgrades-local).

sudoedit /etc/apt/apt.conf.d/52unattended-upgrades-local

// Packages to exclude from automatic updates (regular expressions allowed)
Unattended-Upgrade::Package-Blacklist {
    "mariadb-";
};

// Email the results (requires a way to send mail, such as mailx)
Unattended-Upgrade::Mail "admin@example.com";
Unattended-Upgrade::MailReport "on-change";

// If an update requires a reboot, reboot automatically at 2 a.m.
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Here is what each setting does:

If you leave Automatic-Reboot at false, check regularly whether the file /var/run/reboot-required has been created, and if it has, reboot at a convenient time.

# Check whether a reboot is needed and which packages caused it
ls /var/run/reboot-required 2>/dev/null && cat /var/run/reboot-required.pkgs

Step 4: Test it

You can see what would be updated without actually updating anything.

sudo unattended-upgrade --dry-run --debug

Automatic runs are handled by systemd timers. apt-daily.timer refreshes the package lists and downloads updates, and apt-daily-upgrade.timer applies them.

systemctl list-timers 'apt-daily*'

To change when they run, override the timer with sudo systemctl edit apt-daily-upgrade.timer.

Step 5: Check the logs

sudo tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log
sudo tail -n 50 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log

These logs record the packages that were updated, the packages that were excluded and any errors.

RHEL family (AlmaLinux, Rocky Linux and others): dnf-automatic

Step 1: Install

sudo dnf install dnf-automatic

Step 2: Edit the configuration file

Configuration lives in /etc/dnf/automatic.conf. To apply only security updates, set the [commands] section as follows.

[commands]
upgrade_type = security
download_updates = yes
apply_updates = yes

The reboot setting was added in relatively recent versions. If your automatic.conf does not have it, you cannot use it; instead, check with dnf needs-restarting as described below.

Choose how results are reported with emit_via in the [emitters] section (stdio, email, motd and others). To receive email, set the sender, recipient and SMTP server in the [email] section.

To exclude specific packages from automatic updates, you can override dnf settings in the [base] section.

[base]
exclude = mariadb*

Step 3: Confirm security information is available

upgrade_type = security selects updates based on the security information (updateinfo) the repository provides. If the repository does not provide it, nothing is applied. Before configuring this, check that the following command returns a list.

sudo dnf updateinfo list --security

Step 4: Enable the timer

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers 'dnf-*'

dnf-automatic.timer follows the settings in automatic.conf. Other timers are also provided that override settings such as apply_updates in the configuration file.

Enabling several timers at once makes the behavior hard to follow, so pick just one.

Step 5: Test and check the logs

# Run once manually (follows the configuration file)
sudo dnf-automatic

# Run history and logs
sudo journalctl -u dnf-automatic --since "7 days ago"
sudo dnf history

You can check whether a reboot is needed with dnf needs-restarting (part of dnf-plugins-core). With -r, it returns exit code 1 when a reboot is required.

sudo dnf needs-restarting -r

What to keep doing after enabling automatic updates

• Read the notifications: watch the email or motd notices so you do not miss failures or updates to packages you excluded.
• Update excluded packages by hand: if you leave them excluded and forget about them, only those packages stay out of date.
• Schedule reboots: kernel updates do not take effect until you reboot. If you do not reboot automatically, make it a regular task, such as once a month.
• Update applications separately: anything outside the OS package manager (WordPress core, plugins and themes, libraries installed with Composer or npm and so on) is not updated by this mechanism.

Summary

• Use unattended-upgrades on Debian/Ubuntu and dnf-automatic on the RHEL family to apply security updates automatically
• unattended-upgrades covers security updates by default. Write your changes in a separate file (such as 52unattended-upgrades-local)
• For dnf-automatic, set upgrade_type = security and apply_updates = yes, and enable dnf-automatic.timer
• Check in advance with unattended-upgrade --dry-run --debug or dnf updateinfo list --security
• Check whether a reboot is needed with /var/run/reboot-required or dnf needs-restarting -r

• How to set up SSH public key authentication

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)