Updates and automatic updates

Most break-ins use a vulnerability that was patched long ago. That makes updating the most important maintenance task for your server.

Updating by hand

anna@web1:~$ sudo apt update
anna@web1:~$ apt list --upgradable
anna@web1:~$ sudo apt upgrade

apt update fetches the list of new versions, apt upgrade installs them. On AlmaLinux and Rocky Linux, use sudo dnf upgrade.

Automatic security updates

Ubuntu: the unattended-upgrades program is already installed and installs security updates every day. Debian: turn it on yourself.

anna@web1:~$ sudo apt install unattended-upgrades
anna@web1:~$ sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes when asked whether updates may be installed automatically. Then check:

anna@web1:~$ cat /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
anna@web1:~$ sudo unattended-upgrade --dry-run --debug

You can see what has been updated automatically in /var/log/unattended-upgrades/.

On AlmaLinux and Rocky Linux: sudo dnf install dnf-automatic and sudo systemctl enable --now dnf-automatic-install.timer.

Rebooting after an update

A new kernel only takes effect after a reboot. If the file /var/run/reboot-required exists, a reboot is needed:

anna@web1:~$ ls /var/run/reboot-required
/var/run/reboot-required
anna@web1:~$ sudo reboot

Want the server to reboot by itself at night when needed? Then enable these two lines in /etc/apt/apt.conf.d/50unattended-upgrades (remove the // in front of them):

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

If you run services that must not be interrupted, it's better to reboot yourself at a quiet moment.

A new version of your operating system

Automatic updates won't take you to the next version, such as from Debian 12 to 13. You do that yourself: take a snapshot first and follow the official steps from Debian or Ubuntu. Reinstalling with the new version (see Reinstalling or attaching an ISO) and restoring your data is often just as quick.