Automatic security updates

What it inspects

Debian/Ubuntu: that apt-daily.timer and apt-daily-upgrade.timer are enabled, the unattended-upgrades package is installed, and `apt-config dump APT::Periodic` shows Enable not 0 and Update-Package-Lists and Unattended-Upgrade switched on; an enabled unattended-upgrades.timer also passes. RHEL family: dnf-automatic.timer (dnf 4) or dnf5-automatic.timer (dnf5, Fedora 41+) must be enabled and apply_updates must be yes in the [commands] section of /etc/dnf/automatic.conf (for dnf5, applied on top of the defaults in /usr/share/dnf5/dnf5-plugins/automatic.conf); a timer that only downloads updates is a warning. Anything else is a warning.

Why it matters

Servers that depend on someone remembering to patch fall behind, and the gap between a public vulnerability and its fix being installed is when attacks happen. Automatic security updates close that gap without a person in the loop. The trade-off is that an update can occasionally restart a service, so most teams enable it for security updates only and keep reboots manual.

How to verify

# Debian/Ubuntu:
systemctl is-enabled apt-daily.timer apt-daily-upgrade.timer
apt-config dump APT::Periodic
dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades
# RHEL family:
systemctl is-enabled dnf-automatic.timer        # dnf5 (Fedora 41+): dnf5-automatic.timer
grep -E '^[[:space:]]*apply_updates' /etc/dnf/automatic.conf

How to fix

Debian/Ubuntu: install unattended-upgrades and enable the apt timers with periodic updates on. RHEL family: install dnf-automatic, set apply_updates = yes, and enable dnf-automatic.timer.

# Debian/Ubuntu: unattended-upgrades installs the security updates; the two apt timers refresh the package
# lists and run the upgrade. The file name sorts last so a stray "Enable 0" in another apt.conf.d file does not win.
apt-get update
apt-get install -y unattended-upgrades
install -m 0644 /dev/stdin /etc/apt/apt.conf.d/99umbermark-periodic <<'EOF'
APT::Periodic::Enable "1";
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
systemctl enable --now apt-daily.timer apt-daily-upgrade.timer
apt-config dump APT::Periodic

# RHEL 8+/Rocky/Alma (dnf 4). dnf-automatic only DOWNLOADS updates unless apply_updates is yes.
# This installs everything dnf offers (upgrade_type = default); to install security updates only, set
# `upgrade_type = security` in the [commands] section of /etc/dnf/automatic.conf.
# Fedora 41+ (dnf5): this snippet is for dnf 4. Install dnf5-plugin-automatic, set apply_updates = yes under
# [commands] in /etc/dnf/automatic.conf, and enable dnf5-automatic.timer instead; the check recognises it.
dnf install -y dnf-automatic
conf=/etc/dnf/automatic.conf
if grep -qE '^[[:space:]]*apply_updates' "$conf"; then
sed -i -E 's/^[[:space:]]*apply_updates[[:space:]]*=.*/apply_updates = yes/' "$conf"
else
sed -i '/^\[commands\]/a apply_updates = yes' "$conf"
fi
systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer

References

• Debian wiki: UnattendedUpgrades
• apt-get(8) manual page