Security guide

How to Set Up Automatic Security Updates on Linux

By Gander Web · Published 16 October 2026 · 2 min read

Short answer

On Ubuntu and Debian, install unattended-upgrades and run sudo dpkg-reconfigure --priority=low unattended-upgrades. On AlmaLinux and Rocky, install dnf-automatic, set upgrade_type = security and apply_updates = yes, and enable its timer. Kernel updates still need a reboot.

Automatic security updates install published fixes for your server's packages every day, without you logging in. They're limited to security fixes by default, so major version changes don't arrive unannounced.

Ubuntu and Debian: unattended-upgrades

Ubuntu Server usually has it installed already; Debian often doesn't. Either way:

sudo apt update
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Answer Yes. That writes /etc/apt/apt.conf.d/20auto-upgrades, which should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

The "1" means every day. On Ubuntu only security updates install automatically. Debian's defaults also include stable point-release updates, which are bug fixes Debian has already tested for that release.

Decide about reboots

Kernel and some core library updates only take effect after a reboot. When one is waiting, the file /var/run/reboot-required exists. To let the server reboot itself at a quiet time, edit /etc/apt/apt.conf.d/50unattended-upgrades and set:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

Leave it off if a reboot would interrupt something, and reboot by hand when it suits you. The same file has a Unattended-Upgrade::Mail setting for email reports, which needs a working mail setup on the server such as msmtp.

Check it's working

sudo unattended-upgrade --dry-run --debug
systemctl list-timers 'apt-daily*'

The dry run lists what would install now. The timers show when the next check and install will run. Each real run is logged in /var/log/unattended-upgrades/unattended-upgrades.log.

AlmaLinux and Rocky Linux: dnf-automatic

sudo dnf install dnf-automatic
sudo nano /etc/dnf/automatic.conf

In the [commands] section, set:

upgrade_type = security
apply_updates = yes

Then turn on the timer and check it's scheduled:

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers 'dnf-automatic*'

To see whether a reboot is needed after updates, run sudo dnf needs-restarting -r.

Software these don't cover

Automatic updates only cover packages from the system's repositories. WordPress, Node.js apps, Docker images, and anything installed from a download or an install script need updating separately. Pi-hole, for example, updates with pihole -up, and WordPress with the steps in updating WordPress safely.

UK VPS hosting with full root access

Guaranteed AMD EPYC cores, SSD RAID storage and DDoS protection on every plan, from £5.99 a month with no VAT to add. Need faster cores? Upgrade to Ryzen.

See VPS plans

Questions

Will automatic updates break my server?

Security updates are small, targeted fixes and rarely change how software behaves. If a server is critical, test updates on a copy first and keep backups.

Do I need to reboot after updates?

Only for kernel and some core library updates. On Ubuntu and Debian, check whether /var/run/reboot-required exists. On AlmaLinux, run sudo dnf needs-restarting -r.

Can I install all updates automatically, not just security fixes?

Yes. On Ubuntu, uncomment the -updates line in 50unattended-upgrades. On AlmaLinux, set upgrade_type = default. You'll get more changes without reviewing them first.

Can Ubuntu apply kernel fixes without a reboot?

Livepatch applies some kernel security fixes without a reboot. It's part of Ubuntu Pro, which is free for personal use on up to five machines.

How to Secure a Linux VPS: The First Steps That Matter How to Install and Configure Fail2ban on Linux How to Set Up SSH Keys and Turn Off Password Logins How to Update WordPress Safely Using a Staging Site

Sources

  1. unattended-upgrade manual page (Debian 12)

Commands are for Ubuntu 24.04, Debian 12 and AlmaLinux 9, as of 16 October 2026. If something here no longer matches what you see, tell us and we'll update it.