Automatic Security Updates

apt install unattended-upgrades -y

dpkg-reconfigure --priority=low unattended-upgrades

nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";
};

// Remove unused dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Auto-reboot if needed (e.g., kernel update)
// WARNING: server will reboot automatically!
Unattended-Upgrade::Automatic-Reboot "false";

// If you enable auto-reboot, set it during low-traffic hours
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

// Email notification (optional)
// Unattended-Upgrade::Mail "admin@example.com";

nano /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

# Test without installing anything
unattended-upgrades --dry-run --debug

# Log of executed updates
cat /var/log/unattended-upgrades/unattended-upgrades.log

dnf install dnf-automatic -y

nano /etc/dnf/automatic.conf

[commands]
# Download and install only security updates
upgrade_type = security
apply_updates = yes

# Message after updates
emit_via = stdio

# For email notifications (optional)
# emit_via = email
# email_from = root@localhost
# email_to = admin@example.com

# Daily updates
systemctl enable --now dnf-automatic.timer

# Verify
systemctl status dnf-automatic.timer
systemctl list-timers | grep dnf

# Debian/Ubuntu
apt update && apt upgrade -y

# For kernel updates (requires reboot)
apt full-upgrade -y
reboot

# CentOS/AlmaLinux
dnf update -y

# Debian/Ubuntu
apt list --upgradable

# Security updates only
apt list --upgradable | grep -i security

# CentOS/AlmaLinux
dnf check-update
dnf updateinfo list security