Even perfectly configured access will not save you if the server runs old software with known holes. System developers regularly release fixes, and it is important to install them on time.

The easiest approach is to update the system manually once and then turn on automatic installation of security updates. The server will then close vulnerabilities on its own, and all you have to do is reboot it now and then.

---

1. Update the system manually

It is worth doing this right after ordering the server. The commands are run on the server.

# Refresh the package list and install all available updates
sudo apt update && sudo apt upgrade -y

# Install all available updates
sudo dnf upgrade -y

If the system kernel was updated, reboot the server so the new kernel starts working.

# Reboot the server. After a minute you can connect to it again
sudo reboot

---

2. Turn on automatic updates

# Install the package that installs security updates on its own
sudo apt install -y unattended-upgrades

# Turn on automatic installation. In the window that appears,
# choose Yes
sudo dpkg-reconfigure -plow unattended-upgrades

# Check that everything is set up. The command shows what it would
# install but does not change anything
sudo unattended-upgrade --dry-run --debug

# Install the package for automatic updates
sudo dnf install -y dnf-automatic

# By default it only downloads updates. Allow it to install them
sudo sed -i 's/^apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf

# Turn on the timer that checks for and installs updates once a day
sudo systemctl enable --now dnf-automatic.timer

# Check that the timer is on and when it will run next
systemctl list-timers dnf-automatic.timer

Security updates only

On AlmaLinux, CentOS and Oracle Linux you can install only vulnerability fixes automatically and update everything else manually. To do this, set upgrade_type = security in the /etc/dnf/automatic.conf file.

---

Do not forget about your applications

Automatic updates cover the system packages. If the server runs control panels, a CMS such as WordPress, VPN panels or other web applications, they need to be updated separately, following the developers' instructions. Outdated websites and panels are exactly how servers get hacked most often.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com