unattended-upgrades and run sudo dpkg-reconfigure -plow unattended-upgrades, then answer Yes. Security updates then install daily. On AlmaLinux or Rocky Linux, install dnf-automatic, set upgrade_type = security and apply_updates = yes in /etc/dnf/automatic.conf, and run sudo systemctl enable --now dnf-automatic.timer.
Before you start
- Connect with SSH as a sudo user. Root can leave out
sudo. - Bring the server up to date once by hand: update Linux packages.
- Keep backups. Security updates are small and well tested, but no update is risk-free.
How to enable unattended-upgrades on Ubuntu and Debian
1
Install the package
Ubuntu installs it by default; Debian may not. This command is safe either way:
2
Turn it on
3
Check the schedule file
"1" means every day; "0" turns it off.What gets updated
/etc/apt/apt.conf.d/50unattended-upgrades decides which updates install. On Ubuntu, the release and security origins are enabled by default:
${distro_codename} line matches the release itself, which doesn’t change after release, so in practice Ubuntu installs security updates only. Leave the -updates line commented out unless you also want non-security bug-fix updates installed automatically.
Debian’s file uses Unattended-Upgrade::Origins-Pattern lines instead. By default it enables the security archive and the main Debian release, which also brings in Debian point-release updates.
How to set automatic reboots
Kernel and library updates need a reboot. unattended-upgrades never reboots unless you allow it. Edit the file:// in front of these lines and set them like this:
How to test it
/var/log/unattended-upgrades/.
How to enable dnf-automatic on AlmaLinux and Rocky Linux
1
Install it
2
Set it to install security updates
[commands] section, set:upgrade_type = default installs all updates instead of security ones only.3
Enable the timer
dnf-automatic.timer follows the settings in automatic.conf.
dnf-automatic doesn’t reboot for you on AlmaLinux and Rocky 9. Check whether a reboot is needed with
sudo dnf needs-restarting -r and reboot at a time that suits you.
How to check it worked
- Ubuntu / Debian
- AlmaLinux / Rocky
No packages found that can be upgraded unattended.Frequently asked questions
Will automatic updates break my server?
Security updates are made to fix a problem without changing behaviour, so breakage is rare. Software from third-party repositories and major version changes aren’t included by default. Keep backups and check the logs now and then.Do I still need to update by hand?
Yes, now and then. Automatic updates cover security fixes; run a fullapt upgrade or dnf upgrade for other updates, and plan release upgrades yourself.
How do I get an email report?
On Ubuntu/Debian setUnattended-Upgrade::Mail "you@example.com"; in 50unattended-upgrades; on AlmaLinux/Rocky set emit_via = email and the [email] section in automatic.conf. Both need a working mail transfer agent on the server.
How do I stop one package from updating automatically?
On Ubuntu/Debian add it toUnattended-Upgrade::Package-Blacklist in 50unattended-upgrades. On AlmaLinux/Rocky add exclude=packagename under [base] in automatic.conf.
Related guides
VPS and dedicated server guides
Every server guide in one place.
Update Linux packages
Manual updates with apt and dnf.
Linux security checklist
The other essentials.
Fix the dpkg lock error
When updates are already running.
Checked against the official Ubuntu Server documentation on automatic updates, the Red Hat Enterprise Linux 9 guide to automating software updates and the dnf-automatic(8) manual on 4 November 2026; unattended-upgrades setup and dry run tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.
Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026