English
Magyar
A significant proportion of compromised servers are breached via a security vulnerability for which a patch has been available for weeks or months. If you have your own VPS, it is your responsibility, as the operator, to update the system. This article explains the update process, how to check whether a restart is required, and how to set up automatic updates.
We update the servers for our shared hosting plans; you do not need to do anything.
Before updating
- Before carrying out a major update (involving many packages, a new kernel or a database server), take a snapshot.
- You should update a live server during a period of low traffic where possible, as some services will restart during the update.
AlmaLinux, Rocky Linux (dnf)
# Elérhető frissítések listája
sudo dnf check-update
# Az összes frissítés telepítése
sudo dnf upgrade
# Csak a biztonsági frissítések telepítése
sudo dnf upgrade --security
For more information on security updates: yum: Install security updates only.
Back
dnf logs every operation, and an update can be undone:
sudo dnf history
sudo dnf history info 42
sudo dnf history undo 42
Rollback only works if the old package version is still available in the repository; therefore, it is not a substitute for a snapshot. In the test (AlmaLinux 10.2), the dnf history undo command successfully rolled back a security update affecting 19 packages.
Do I need to restart after the dnf update?
sudo dnf needs-restarting -r
Following a glibc and kernel update, the test output was: “Core libraries or services have been updated since boot-up: glibc, kernel, kernel-core … Reboot is required to fully utilise these updates.” The exit code was 1 (0 if no reboot is required), so this can also be checked via a script. If the output indicates that a restart is required, restart the server. Services that are still using the old libraries are listed by the -s option; these can be updated using the systemctl restart command instead of a restart.
sudo dnf needs-restarting -s
Ubuntu, Debian (apt)
# A csomaglisták frissítése
sudo apt update
# Frissíthető csomagok listája
apt list --upgradable
# Frissítés
sudo apt upgrade
# Frissítés akkor is, ha ehhez csomagokat kell telepíteni vagy eltávolítani
sudo apt full-upgrade
# A már nem szükséges csomagok (pl. régi kernelek) eltávolítása
sudo apt autoremove
You can read about installing a specific version of a package in the article ‘Installing a specific version using apt-get’.
Do I need to restart after updating apt?
On Ubuntu, after an update, the file /var/run/reboot-required is created if a reboot is required:
cat /var/run/reboot-required
cat /var/run/reboot-required.pkgs
On Debian, the needrestart package indicates, at the end of an update, which services need to be restarted and whether a system reboot is required. On Ubuntu 24.04, this is installed by default, but not on the Debian 12 cloud image:
sudo apt install needrestart
Automatic updates
Automatic updates ensure that security patches are installed even if you forget about them. We recommend that you set the system to install only security updates automatically, and install the rest manually on a regular basis.
AlmaLinux, Rocky Linux: dnf-automatic
sudo dnf install dnf-automatic
sudo nano /etc/dnf/automatic.conf
In the [commands] section, configure the following:
[commands]
upgrade_type = security
apply_updates = yes
Then set the timer:
sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer
The default settings are upgrade_type = default and apply_updates = no, meaning that, without modification, dnf-automatic would only download the updates but not install them. There are several types of timer (dnf-automatic-install.timer, -download, -notifyonly); these install, download or simply notify, regardless of the configuration file. With the above settings, the standard dnf-automatic.timer is the appropriate one. After enabling it during the test, the next run was scheduled for the early hours of the following morning.
In the [emitters] section, you can also set up email notifications about installed updates.
Ubuntu, Debian: unattended-upgrades
On the Ubuntu 24.04 and Debian 12 cloud images used in the test, unattended-upgrades was already installed and enabled; this is shown in the file /etc/apt/apt.conf.d/20auto-upgrades:
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
If this file is missing, or if the values are "0", please install and enable it:
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
Answer ‘yes’ to this question. By default, only security updates are installed. The settings are located in the file /etc/apt/apt.conf.d/50unattended-upgrades; here, for example, you can also enable automatic reboots at a specified time:
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
Testing the functionality (without making any changes):
sudo unattended-upgrade --dry-run --debug
The run logs can be found in the /var/log/unattended-upgrades/ directory.
Upgrading to a new major version
The commands above update within the current major version of the distribution (for example, from AlmaLinux 9.5 to 9.6). The following articles cover upgrading to a new major version: