Keep your server updated

Ubuntu / Debian

Fetch the list of what's new, then see it:

sudo apt update

apt list --upgradable

Install it all:

sudo apt upgrade -y

Now and then, run sudo apt full-upgrade for updates that add or remove other packages, such as a new kernel series. Then clear out old kernels and leftovers:

sudo apt autoremove -y

If Ubuntu asks which services to restart, the ticked ones are fine: press Tab to Ok, then Enter.

AlmaLinux / Rocky

See what's new:

sudo dnf check-update

Install it all:

sudo dnf upgrade -y

AlmaLinux removes old kernels by itself. To clear out other leftovers:

sudo dnf autoremove -y

Ubuntu / Debian

On Ubuntu, this file appears when a reboot is needed:

cat /var/run/reboot-required.pkgs

"No such file" means none is needed. Debian doesn't always write it, so compare the running kernel with the newest installed:

uname -r && ls /boot/vmlinuz-*

If the newest in the list is newer than the first line, reboot.

AlmaLinux / Rocky

sudo dnf needs-restarting -r

If needs-restarting isn't found: sudo dnf install -y dnf-plugins-core.

Ubuntu / Debian

unattended-upgrades installs security updates once a day. Ubuntu has it on already. On Debian, install it and switch it on:

sudo apt install -y unattended-upgrades

sudo tee /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF

Check what it would do, without installing anything:

sudo unattended-upgrade --dry-run --debug

What it did is logged in /var/log/unattended-upgrades/.

AlmaLinux / Rocky

dnf-automatic downloads and installs updates on a daily timer:

sudo dnf install -y dnf-automatic

sudo systemctl enable --now dnf-automatic-install.timer

To install only security updates, set upgrade_type = security in /etc/dnf/automatic.conf. Check when it next runs:

systemctl list-timers dnf-automatic-install.timer

Ubuntu / Debian

Reboot at 4am, only when an update needs it:

sudo tee /etc/apt/apt.conf.d/52unattended-upgrades-local <<'EOF'
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
EOF

AlmaLinux / Rocky

Check every night at 4am and reboot only if needed, from root's crontab:

echo '0 4 * * * root /usr/bin/dnf needs-restarting -r >/dev/null || /usr/sbin/reboot' | sudo tee /etc/cron.d/reboot-if-needed

If there's no /etc/cron.d folder, cron isn't installed: sudo dnf install -y cronie && sudo systemctl enable --now crond.