Automatic security updates

Most breaches come through vulnerabilities that were patched months ago. Manual updates get postponed; automatic ones don't. A sensible setup installs only security updates and leaves everything else alone.

Debian and Ubuntu

apt install -y unattended-upgrades apt-listchanges
dpkg-reconfigure -plow unattended-upgrades

The file /etc/apt/apt.conf.d/50unattended-upgrades:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::Package-Blacklist {
    "postgresql-.*";
    "docker-ce";
};
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Mail "you@example.com";

The schedule lives in /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

A dry run, without making changes:

unattended-upgrade --dry-run --debug
systemctl status unattended-upgrades
cat /var/log/unattended-upgrades/unattended-upgrades.log

AlmaLinux and CentOS Stream

dnf install -y dnf-automatic

In /etc/dnf/automatic.conf:

[commands]
upgrade_type = security
apply_updates = yes
reboot = never

systemctl enable --now dnf-automatic.timer
systemctl list-timers | grep dnf

What to exclude

Add everything that breaks when its version changes unexpectedly to the exclusion list: the database server, Docker, the application engine itself. Update them by hand at a quiet time — see system and package updates.

Kernel security updates are installed too, but they only take effect after a reboot:

test -f /var/run/reboot-required && cat /var/run/reboot-required.pkgs

Rebooting: a human decision only

The temptation to set Automatic-Reboot "true" is strong, but an automatic nightly reboot means the service restarts with no one watching. If something doesn't come back up, you'll hear about it in the morning from your users.

A sensible compromise: updates install themselves, and you reboot manually once a month while watching the console in the /hosting/vds/m/<id> panel. While you're at it, check that the services start on their own:

systemctl is-enabled nginx postgresql
systemctl list-units --state=failed

Common mistakes

Automatic updates are insurance, not a replacement for attention. Once a month, open the machine, look at the update log, the list of failed services and whether a reboot is needed. Fifteen minutes a month covers most of the scenarios from the signs of a breach article.