Automatic security updates on Ubuntu and RHEL: unattended-upgrades and dnf-automatic

Most breaches use known bugs

Attackers routinely exploit vulnerabilities that already had a patch available. For ordinary servers, installing security updates automatically closes that window from weeks to a day. The risk of an update breaking something is real but usually smaller than the risk of running known-vulnerable software.

Automate security updates by default and handle exceptions deliberately, rather than patching by hand when someone remembers.

Ubuntu and Debian

unattended-upgrades installs packages from the security pocket on a timer. Enable it with dpkg-reconfigure, and review /etc/apt/apt.conf.d/50unattended-upgrades for allowed origins, mail reports, and automatic reboot settings. Logs go to /var/log/unattended-upgrades/.

A dry run shows what it would install without changing anything.

Snippet

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
sudo unattended-upgrade --dry-run --debug | tail -20
ls /var/log/unattended-upgrades/
cat /var/run/reboot-required 2>/dev/null

Lab: RHEL family and reboot checks

On a Fedora, Rocky, or Alma VM, install dnf-automatic, set upgrade_type = security and apply_updates = yes in /etc/dnf/automatic.conf, and enable the timer. Check history with dnf history. needs-restarting -r tells you whether a reboot is required, typically after kernel or glibc updates.

Then decide the reboot policy: an automatic reboot window for stateless servers, or an alert for stateful ones that need coordination. A patched kernel does nothing until the machine boots it.

Snippet

sudo dnf install dnf-automatic
sudo sed -i "s/^upgrade_type.*/upgrade_type = security/; s/^apply_updates.*/apply_updates = yes/" /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer
sudo dnf history | head
sudo needs-restarting -r

Exceptions and visibility

Pin or hold a package only with a ticket that says why and when the hold ends, for example apt-mark hold. Untracked holds are how servers end up years behind.

Report patch status centrally. A simple daily job that records the pending security update count per host makes laggards obvious.

Diagram

Automatic patching with a reboot plan

Enable
Turn on unattended-upgrades or dnf-automatic for security updates.
Review
Check logs and history after each run.
Reboot
Detect reboot-required and apply the agreed policy.
Command
```
sudo needs-restarting -r
```
Report
Track pending updates and holds per host.

Check yourself

1. Which package automates security updates on Ubuntu?

2. Why is a reboot sometimes required after patching?

3. When is holding a package back acceptable?