> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Enable Automatic Security Updates (unattended-upgrades, dnf-automatic)

> Turn on automatic security updates with unattended-upgrades on Ubuntu and Debian, or dnf-automatic on AlmaLinux and Rocky Linux, and choose when to reboot.

To enable automatic security updates on Ubuntu or Debian, install `unattended-upgrades` and run `sudo dpkg-reconfigure -plow unattended-upgrades`, then answer **Yes**. Security updates then install daily. On AlmaLinux or Rocky Linux, install `dnf-automatic`, set `upgrade_type = security` and `apply_updates = yes` in `/etc/dnf/automatic.conf`, and run `sudo systemctl enable --now dnf-automatic.timer`.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux / Rocky 9 / 10 | sudo or root access |

## Before you start

* [Connect with SSH](https://help.freakhosting.com/portals/other/how-to-connect-to-a-linux-server-with-ssh.md) as a [sudo user](https://help.freakhosting.com/portals/other/how-to-create-a-sudo-user-on-linux.md). Root can leave out `sudo`.
* Bring the server up to date once by hand: [update Linux packages](https://help.freakhosting.com/portals/other/how-to-update-linux-packages.md).
* Keep [backups](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md). Security updates are small and well tested, but no update is risk-free.

## How to enable unattended-upgrades on Ubuntu and Debian

**1. Install the package**

Ubuntu installs it by default; Debian may not. This command is safe either way:

```bash theme={null}
sudo apt update
sudo apt install unattended-upgrades
```

**2. Turn it on**

```bash theme={null}
sudo dpkg-reconfigure -plow unattended-upgrades
```

Choose **Yes** for "Automatically download and install stable updates?".

**3. Check the schedule file**

```bash theme={null}
cat /etc/apt/apt.conf.d/20auto-upgrades
```

Expected output:

```text theme={null}
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
```

`"1"` means every day; `"0"` turns it off.

### What gets updated

`/etc/apt/apt.conf.d/50unattended-upgrades` decides which updates install. On Ubuntu, the release and **security** origins are enabled by default:

```text theme={null}
Unattended-Upgrade::Allowed-Origins {
	"${distro_id}:${distro_codename}";
	"${distro_id}:${distro_codename}-security";
	...
};
```

The `${distro_codename}` line matches the release itself, which doesn't change after release, so in practice Ubuntu installs security updates only. Leave the `-updates` line commented out unless you also want non-security bug-fix updates installed automatically.

Debian's file uses `Unattended-Upgrade::Origins-Pattern` lines instead. By default it enables the security archive and the main Debian release, which also brings in Debian point-release updates.

### How to set automatic reboots

Kernel and library updates need a reboot. unattended-upgrades never reboots unless you allow it. Edit the file:

```bash theme={null}
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades
```

Remove the `//` in front of these lines and set them like this:

```text theme={null}
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
```

The server then reboots at 04:00 (server time) only when an update needs it. Pick a quiet hour, and leave reboots off for servers that must not restart without you, such as a game server during events.

> [!WARNING]
>
> An automatic reboot ends running game sessions, uploads and anything not set to start at boot. Make sure your services are enabled with `systemctl enable` before you allow automatic reboots. See [manage services with systemctl](https://help.freakhosting.com/portals/other/how-to-manage-services-with-systemctl.md).

### How to test it

```bash theme={null}
sudo unattended-upgrade --dry-run -v
```

The dry run shows what would be installed without changing anything. Logs of real runs are in `/var/log/unattended-upgrades/`.

## How to enable dnf-automatic on AlmaLinux and Rocky Linux

**1. Install it**

```bash theme={null}
sudo dnf install dnf-automatic
```

**2. Set it to install security updates**

```bash theme={null}
sudo nano /etc/dnf/automatic.conf
```

In the `[commands]` section, set:

```ini theme={null}
[commands]
upgrade_type = security
download_updates = yes
apply_updates = yes
```

`upgrade_type = default` installs all updates instead of security ones only.

**3. Enable the timer**

```bash theme={null}
sudo systemctl enable --now dnf-automatic.timer
```

`dnf-automatic.timer` follows the settings in `automatic.conf`.

The package also ships timers with a fixed behaviour. Enable only one:

| Timer | What it does |
| - | - |
| `dnf-automatic.timer` | Follows `/etc/dnf/automatic.conf` |
| `dnf-automatic-install.timer` | Downloads and installs updates |
| `dnf-automatic-download.timer` | Downloads only; you install with `dnf upgrade` |
| `dnf-automatic-notifyonly.timer` | Only reports available updates |

dnf-automatic doesn't reboot for you on AlmaLinux and Rocky 9. Check whether a reboot is needed with `sudo dnf needs-restarting -r` and reboot at a time that suits you.

## How to check it worked

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> systemctl list-timers apt-daily.timer apt-daily-upgrade.timer
> sudo tail /var/log/unattended-upgrades/unattended-upgrades.log
> ```
>
> The timers show a **NEXT** run time. After the first run, the log lists the packages it installed or says `No packages found that can be upgraded unattended`.

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> systemctl list-timers dnf-automatic.timer
> sudo journalctl -u dnf-automatic.service --since today
> ```
>
> The timer shows a **NEXT** run time, and the journal shows the result of each run.

## Frequently asked questions

### Will automatic updates break my server?

Security updates are made to fix a problem without changing behaviour, so breakage is rare. Software from third-party repositories and major version changes aren't included by default. Keep backups and check the logs now and then.

### Do I still need to update by hand?

Yes, now and then. Automatic updates cover security fixes; run a full `apt upgrade` or `dnf upgrade` for other updates, and plan [release upgrades](https://help.freakhosting.com/portals/other/how-to-upgrade-ubuntu-to-a-new-release.md) yourself.

### How do I get an email report?

On Ubuntu/Debian set `Unattended-Upgrade::Mail "you@example.com";` in `50unattended-upgrades`; on AlmaLinux/Rocky set `emit_via = email` and the `[email]` section in `automatic.conf`. Both need a working mail transfer agent on the server.

### How do I stop one package from updating automatically?

On Ubuntu/Debian add it to `Unattended-Upgrade::Package-Blacklist` in `50unattended-upgrades`. On AlmaLinux/Rocky add `exclude=packagename` under `[base]` in `automatic.conf`.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every server guide in one place.

> [card] [Update Linux packages](https://help.freakhosting.com/portals/other/how-to-update-linux-packages.md)
>
> Manual updates with apt and dnf.

> [card] [Linux security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> The other essentials.

> [card] [Fix the dpkg lock error](https://help.freakhosting.com/portals/other/how-to-fix-could-not-get-lock-var-lib-dpkg-lock.md)
>
> When updates are already running.

***

> [!NOTE]
>
> **Checked against the official [Ubuntu Server documentation on automatic updates](https://documentation.ubuntu.com/server/how-to/software/automatic-updates/), the [Red Hat Enterprise Linux 9 guide to automating software updates](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_software_with_the_dnf_tool/assembly_automating-software-updates-in-rhel-9_managing-software-with-the-dnf-tool) and the dnf-automatic(8) manual** on 4 November 2026; unattended-upgrades setup and dry run tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.