How to enable automatic security updates on Linux

The most common way servers get compromised isn't clever hacking — it's unpatched software. A vulnerability is disclosed, a fix ships, and machines that didn't update get exploited by automated scanners days later. The defense is simple: let security updates install themselves. Here's how on both major distro families.

Ubuntu and Debian: unattended-upgrades

Ubuntu and Debian have a built-in tool that applies security updates automatically.

Step 1: Install it

sudo apt update
sudo apt install unattended-upgrades -y

Step 2: Enable it

The interactive way:

sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes when asked to automatically download and install stable updates. This writes /etc/apt/apt.conf.d/20auto-upgrades with the schedule.

Step 3: Confirm and tune what gets updated

Open /etc/apt/apt.conf.d/50unattended-upgrades. By default only the security repository is enabled — which is exactly what you want for hands-off safety. You can also configure automatic reboots for kernel updates:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

That reboots at 3 AM only when a kernel update requires it. Leave it off if unplanned reboots would disrupt your service, and reboot manually instead.

Step 4: Test a dry run

sudo unattended-upgrade --dry-run --debug

This shows what would be installed without changing anything.

Where to see what happened

Automatic upgrades log to:

cat /var/log/unattended-upgrades/unattended-upgrades.log

AlmaLinux and Rocky: dnf-automatic

The RHEL family uses dnf-automatic.

Step 1: Install

sudo dnf install dnf-automatic -y

Step 2: Configure for security-only

Edit /etc/dnf/automatic.conf and set:

[commands]
upgrade_type = security
apply_updates = yes

upgrade_type = security limits it to security patches; apply_updates = yes installs them rather than just downloading.

Step 3: Enable the timer

sudo systemctl enable --now dnf-automatic.timer

Check it's scheduled:

systemctl list-timers | grep dnf-automatic

Should you auto-update *everything*?

There's a trade-off. Security-only updates are safe to automate on virtually any server — that's the recommended default here. Automating *all* updates (including feature releases) is convenient but occasionally a major package bump changes behavior. For production, keep automatic updates limited to security and apply feature updates manually after a quick check.

Don't forget reboots

Some fixes — especially kernel and core library patches — only take effect after a reboot. Check whether one is pending:

# Ubuntu/Debian
cat /var/run/reboot-required 2>/dev/null && echo "Reboot needed"
# RHEL family
sudo dnf needs-restarting -r

Schedule reboots during a quiet window, or enable the automatic-reboot option above.

Back it up first

Automated updates are safe, but any change carries a small risk. This is where a snapshot shines: take one before major maintenance so you can roll back instantly. Nxeon lets you snapshot a VPS from the dashboard in seconds, giving you a safety net around updates.

The bottom line

Enabling automatic security updates is a five-minute task that closes the single biggest hole attackers exploit. Turn it on for every server you run, keep it scoped to security patches, and reboot on a schedule — your VPS stays patched without you lifting a finger.