> The full list of articles is in [llms.txt](https://docs.f3cloud.com/llms.txt). Every page has a Markdown version: add .md to its address. This page as Markdown: [https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/automatic-updates.md](https://docs.f3cloud.com/en/client-area/protect-vps-from-unauthorised-access/automatic-updates.md).

# Automatic security updates in Linux (unattended-upgrades)

How to update the system on a VPS and turn on automatic installation of security updates. Commands for Ubuntu and Debian (unattended-upgrades) and AlmaLinux, CentOS, Oracle Linux (dnf-automatic).

Even perfectly configured access will not save you if the server runs old software with known holes. System developers regularly release fixes, and it is important to install them on time.

The easiest approach is to update the system manually once and then turn on automatic installation of security updates. The server will then close vulnerabilities on its own, and all you have to do is reboot it now and then.

***

### 1. Update the system manually

It is worth doing this right after ordering the server. The commands are run on the server.

#### Ubuntu and Debian

```bash
# Refresh the package list and install all available updates
sudo apt update && sudo apt upgrade -y
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Install all available updates
sudo dnf upgrade -y
```

If the system kernel was updated, reboot the server so the new kernel starts working.

```bash
# Reboot the server. After a minute you can connect to it again
sudo reboot
```

***

### 2. Turn on automatic updates

#### Ubuntu and Debian

```bash
# Install the package that installs security updates on its own
sudo apt install -y unattended-upgrades

# Turn on automatic installation. In the window that appears,
# choose Yes
sudo dpkg-reconfigure -plow unattended-upgrades

# Check that everything is set up. The command shows what it would
# install but does not change anything
sudo unattended-upgrade --dry-run --debug
```
#### AlmaLinux, CentOS, Oracle Linux

```bash
# Install the package for automatic updates
sudo dnf install -y dnf-automatic

# By default it only downloads updates. Allow it to install them
sudo sed -i 's/^apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf

# Turn on the timer that checks for and installs updates once a day
sudo systemctl enable --now dnf-automatic.timer

# Check that the timer is on and when it will run next
systemctl list-timers dnf-automatic.timer
```

> **Security updates only.**
>
> On AlmaLinux, CentOS and Oracle Linux you can install only vulnerability fixes automatically and update everything else manually. To do this, set `upgrade_type = security` in the `/etc/dnf/automatic.conf` file.

***

### Do not forget about your applications

Automatic updates cover the system packages. If the server runs control panels, a CMS such as WordPress, VPN panels or other web applications, they need to be updated separately, following the developers' instructions. Outdated websites and panels are exactly how servers get hacked most often.

***

### Our resources

**Telegram channel:** [https://t.me/f3cloud_news](https://t.me/f3cloud_news)\
**F3 Cloud:** [https://f3cloud.com](https://f3cloud.com/en)