Updates done right

Most break-ins don't use clever new tricks. They use holes that were fixed months ago on servers nobody updated. Keeping a server updated is the single most important security habit. You'll also learn what to do after an update, when a reboot is really needed, and how to let the machine patch itself safely at night.

What's waiting?

dnf check-update                  # everything that has a newer version
dnf updateinfo                    # summary: security / bugfix notices
dnf updateinfo list --security    # which packages, which advisory (RLSA-…)

sudo apt update                   # refresh the lists first!
apt list --upgradable             # …/noble-security = security fix
                                  # …/noble-updates  = normal update

Security advisories have names and a severity: Rocky calls them RLSA (Rocky Linux Security Advisory) with Critical, Important, Moderate or Low. Ubuntu publishes USN notices and puts security fixes in the -security pocket.

Install them

sudo dnf upgrade --security   # only security fixes
sudo dnf upgrade              # everything
rpm -q kernel                 # kernels are INSTALLED side by side, not replaced

sudo unattended-upgrade -v    # only security fixes (what the nightly job does)
sudo apt upgrade              # everything
dpkg -l 'linux-image*'        # kernels, side by side

Why keep the old kernel? If the new one won't boot, you pick the old one from the boot menu. Both families keep the last few automatically.

Updated… now what? Restarts and reboots

Updating a file on disk doesn't change programs that are already running. They keep the old code in memory until they restart. And the kernel only changes when the machine boots.

dnf needs-restarting -r       # "Reboot is required…" (exit code 1)
sudo dnf needs-restarting -s  # services still running old libraries
sudo systemctl restart sshd   # restart those, or…
sudo reboot                   # …reboot for a new kernel

ls /var/run/reboot-required       # exists = reboot needed
cat /var/run/reboot-required.pkgs # which packages want it
sudo reboot
uname -r                          # the new kernel is running

Automatic updates

Humans forget. For security fixes, most servers should patch themselves every night.

sudo dnf install dnf-automatic
sudoedit /etc/dnf/automatic.conf
  # upgrade_type = security
  # apply_updates = yes
sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers 'dnf-*'

# installed and ON by default:
cat /etc/apt/apt.conf.d/20auto-upgrades
# what, and whether to reboot:
sudoedit /etc/apt/apt.conf.d/50unattended-upgrades
systemctl list-timers 'apt-daily*'
less /var/log/unattended-upgrades/unattended-upgrades.log

Automatic reboots are a bigger decision: great for a single web server at 3 a.m., risky for a database in the middle of work. Ubuntu has Unattended-Upgrade::Automatic-Reboot "true"; and a reboot time. Many teams prefer to patch automatically and reboot on a schedule they control.

Practice: patch Tuesday 🩹

This server has five updates waiting, some of them security fixes, including a new kernel. Install them the careful way, reboot into the new kernel, then set up automatic security updates. (Here the reboot takes a second, not a minute.)

Quick check