Turn on automatic security updates on your VPS

Security fixes for Linux and the software that comes with it are released all the time. Automatic updates install them for you every day, so your server stays patched even when you're busy. This guide sets up unattended-upgrades on Ubuntu and Debian, and dnf-automatic on AlmaLinux and Rocky Linux, to install security updates automatically.

It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10.

Before you start

• SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
• Bring the server fully up to date once by hand, so automatic updates start from a clean state: sudo apt update && sudo apt upgrade -y on Ubuntu/Debian, or sudo dnf upgrade -y on AlmaLinux/Rocky.
• If you plan to turn on automatic reboots, make sure your websites and apps start by themselves when the server boots, for example services enabled with systemctl enable, PM2's startup command, or a Docker restart policy.

What automatic updates don't cover

These tools only update software installed from your operating system's package repositories. They don't update:

• Docker containers and images.
• Websites and web apps, such as WordPress and its plugins, or your own Node.js, PHP or Python packages.
• Software installed with its own install script or from a download. Packages from third-party repositories are often left out too.
• Your operating system's major version, for example Ubuntu 24.04 to 26.04, or AlmaLinux 9 to 10.

So automatic updates don't replace keeping an eye on your apps. Check them for updates regularly, and keep backups.

Step 1: Turn on automatic security updates

Ubuntu/Debian

Ubuntu usually has unattended-upgrades installed and turned on already. Debian may not. Either way, these commands make sure:

sudo apt update
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

When you're asked whether to automatically download and install stable updates, choose Yes. This creates /etc/apt/apt.conf.d/20auto-upgrades. Check it with cat /etc/apt/apt.conf.d/20auto-upgrades. It should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

The "1" means every day. Which updates are installed is set in /etc/apt/apt.conf.d/50unattended-upgrades. The default settings are set up for security updates, and leave most other updates for you to install by hand. We recommend leaving them as they are.

AlmaLinux/Rocky

AlmaLinux 8, 9 and 10 and Rocky Linux 9 and 10 all use version 4 of the DNF package manager, which includes the dnf-automatic tool. Install it:

sudo dnf install -y dnf-automatic

Open its settings file:

sudo nano /etc/dnf/automatic.conf

In the [commands] section, change these lines so they read as follows. Edit the existing lines rather than adding new ones:

upgrade_type = security
download_updates = yes
apply_updates = yes

Save and exit, then turn on the timer that runs it every day:

sudo systemctl enable --now dnf-automatic.timer

Use dnf-automatic.timer, which follows your settings file. The package also includes dnf-automatic-install.timer, dnf-automatic-download.timer and dnf-automatic-notifyonly.timer, which override parts of the settings file. Turn on only one timer.

Step 2 (optional): Reboot automatically when needed

Most updates take effect straight away, but a new Linux kernel and some core system libraries only take effect after a reboot. You can let the server reboot itself when an update needs it. Your websites and apps will be offline for a minute or two while it restarts. If you'd rather reboot by hand, skip this step and see "Rebooting after kernel updates" below.

Ubuntu/Debian

Create a small settings file:

sudo nano /etc/apt/apt.conf.d/51auto-reboot

Paste in the following, then save and exit:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

The server only reboots when an update needs it, at the time you set. The time uses the server's time zone, which may be UTC on a new VPS. Check it with timedatectl, and set New Zealand time with sudo timedatectl set-timezone Pacific/Auckland if you'd like. Check your setting has been picked up with:

apt-config dump | grep -i automatic-reboot

AlmaLinux 9 and 10, and Rocky Linux 9 and 10

In /etc/dnf/automatic.conf, in the [commands] section, set:

reboot = when-needed

When an installed update needs a reboot, such as a new kernel, the server reboots 5 minutes after dnf-automatic finishes. To see when dnf-automatic runs, use systemctl list-timers dnf-automatic.timer.

AlmaLinux 8 doesn't support automatic reboots in dnf-automatic. Reboot by hand when needed, as described below.

Step 3: Check it's working

Ubuntu/Debian

# Show when the update jobs run next
systemctl list-timers 'apt-daily*'

# Do a test run that doesn't change anything
sudo unattended-upgrade --dry-run --debug

# See what's been installed
sudo tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log

AlmaLinux/Rocky

# Show when dnf-automatic runs next
systemctl list-timers dnf-automatic.timer

# List security updates waiting to be installed
sudo dnf updateinfo list --security

# Run it now, then see what it did
sudo systemctl start dnf-automatic.service
sudo journalctl -u dnf-automatic.service -n 50

Running it now installs any waiting security updates straight away, and reboots the server if you turned on automatic reboots and an update needs one.

Rebooting after kernel updates

If you don't use automatic reboots, check every week or so whether your server needs one, and reboot at a quiet time with sudo reboot. You can also use the Reboot button on your VPS's management page in the client area.

Ubuntu/Debian

cat /var/run/reboot-required

If this shows *** System restart required ***, reboot. If it says "No such file or directory", no reboot is needed. cat /var/run/reboot-required.pkgs lists the updates that asked for it.

The needrestart tool checks for running services that are still using old copies of updated software, and restarts them. Ubuntu includes it, and from Ubuntu 24.04 it restarts services automatically after updates. On Debian, you can add it with sudo apt install -y needrestart. Run sudo needrestart to check by hand.

AlmaLinux/Rocky

sudo dnf needs-restarting -r

If it says "Reboot is required to fully utilize these updates", reboot. If the command isn't found, install it with sudo dnf install -y dnf-plugins-core.

Troubleshooting

• "Could not get lock /var/lib/dpkg/lock-frontend" when you run apt: automatic updates are running in the background. Wait a few minutes and try again. Don't delete the lock files.
• Some updates are never installed automatically: that's expected. Only security updates are installed automatically. Run sudo apt update && sudo apt upgrade or sudo dnf upgrade yourself from time to time to install the rest.
• An app didn't come back after an automatic reboot: set it to start at boot, for example with sudo systemctl enable, PM2's startup command, or restart: unless-stopped in Docker Compose.
• dnf-automatic doesn't seem to run: check the timer is on with systemctl list-timers dnf-automatic.timer, and look for errors with sudo journalctl -u dnf-automatic.service.

Related guides

• Secure your new VPS: a checklist for the first 15 minutes
• Set up a firewall on your VPS with UFW or firewalld
• Protect SSH from brute-force attacks with Fail2ban
• Manage your VPS from the client area

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.