Operation and Maintenance
Linux Operation and Maintenance
How to install security updates automatically in Linux
How to install security updates automatically in Linux
Use unattended-upgrades on Ubuntu/Debian by installing and enabling it, then configure daily checks in APT periodic settings. 2. On RHEL-based systems, install dnf-automatic, set upgrade_type=security, and enable the timer. 3. Verify operation via logs and ensure reboots are handled post-updates.
Keeping your Linux system secure means staying up to date with the latest security patches. Manually checking for updates isn't reliable or efficient. The best approach is to set up automatic installation of security updates. Here's how to do it on major Linux distributions.
Ubuntu and Debian (using unattended-upgrades)
On Ubuntu and Debian-based systems, unattended-upgrades is the standard tool for automatic security updates.
- Install the package: sudo apt install unattended-upgrades
- Enable automatic updates: sudo dpkg-reconfigure unattended-upgrades (choose "Yes")
- Configure settings in /etc/apt/apt.conf.d/50unattended-upgrades
- Ensure the line Unattended-Upgrade::Origins-Pattern:: "origin=Ubuntu,archive=stable,label=Ubuntu-Security"; is active
- Set update frequency in /etc/apt/apt.conf.d/20auto-upgrades:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
This checks for and installs updates daily.
CentOS, RHEL, and AlmaLinux (using dnf-automatic)
RHEL-based systems use DNF and provide dnf-automatic for auto-updates.
- Install the package: sudo dnf install dnf-automatic
- Edit the config file: /etc/dnf/automatic.conf
- Set upgrade_type=security to limit updates to security fixes only
- Enable and start the timer: sudo systemctl enable --now dnf-automatic.timer
Check if Automatic Updates Are Working
After setup, verify everything runs as expected.
- Check logs: journalctl -u dnf-automatic.timer or grep -i unattended /var/log/unattended-upgrades/unattended-upgrades.log
- Ensure the system reboots if needed (especially after kernel updates) using tools like needrestart or custom scripts
- Monitor for failed updates that might break services
Automating security updates reduces risk significantly. Configure it early in your system setup. Test on non-critical machines first. Monitoring is key—automation helps, but you still need to confirm it's working.
Basically just pick the right tool for your distro, configure it, then check the logs.
The above is the detailed content of How to install security updates automatically in Linux. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undresser.AI Undress
AI-powered app for creating realistic nude photos
ArtGPT
AI image generator for creative art from text prompts.
Stock Market GPT
AI powered investment research for smarter decisions
Hot Article
Popular tool
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
20518
7
13631
4
How to manage software packages using Dnf and Rpm in Linux?
Mar 07, 2026 am 01:50 AM
dnfinstall prompts packagenotfound because it queries the enabled warehouse rather than the local installation status; rpm-q queries the local RPM database, and the scopes of the two are different.
How to monitor system performance and resources in Linux? (Top & Htop)
Mar 06, 2026 am 01:04 AM
The total top CPU usage is not 100% because it is calculated based on a single core, and the maximum is 800% for an 8-core system; the htop terminal size error needs to be fixed with eval$(resize); the real memory pressure is available rather than used; top command line truncation can be solved with the -c parameter.
How to setup file sharing using Samba on Linux? (SMB Protocol)
Mar 13, 2026 am 12:33 AM
The main reason why Windows cannot see the Samba share is that the firewall blocks UDP137–139/TCP445 or NetBIOS name resolution fails; it is necessary to confirm that the workgroup is consistent, the interfaces are configured correctly, the file permissions match forceuser/forcegroup, and set doscharset=UTF-8 to solve Chinese garbled characters.
How to extend a Logical Volume (LVM) in Linux without downtime?
Mar 13, 2026 am 12:53 AM
Logical volumes and file systems can be expanded online. You need to expand the LV first and then the file system. It is recommended to use lvextend-r for automatic synchronization adjustment, but you must ensure that the LVM and file system tool versions are compatible.
How to check open ports and listening services in Linux? (Netstat & SS)
Mar 10, 2026 am 01:08 AM
Netstat displays fewer LISTEN ports than ss because it does not display process information by default that non-root users do not have access to; ss can read all listening sockets by default without process names, and sudonetstat-tulpn is required to display them completely.
How to set up SSH key authentication on Linux? (Passwordless Login)
Mar 11, 2026 am 12:46 AM
It is recommended to use ssh-keygen-ted25519 to generate a key pair, because it is faster, more secure, and has a shorter key than the default RSA; it is necessary to strictly set the ~/.ssh directory permissions to 700 and authorized_keys to 600, and use ssh-v to confirm whether the client is Offering public key and whether the server rejects it.
How to format disk partitions using the command line in Linux?
Mar 15, 2026 am 12:01 AM
When fdisk is stuck at the Command prompt, it is normally waiting for input. Enter q to exit safely; you must umount before mkfs, otherwise it may fail silently; partedmkpart does not support the specified file system type, and mkfs needs to be executed separately.
How to configure a static IP address on Linux? (Netplan & NetworkManager)
Mar 14, 2026 am 12:02 AM
Netplan reports "InvalidYAML" when configuring a static IP due to indentation errors, missing spaces after colons, or mixed tabs; gateway4 has been deprecated and routes to:default must be used instead; NetworkManager needs to be modified before down/up takes effect; the renderer field is used to determine the backend during coexistence; incorrect DNS configuration will cause ping to succeed but curl to fail.
