Automatic Security Updates

Timely installation of security updates is a fundamental measure for maintaining server security. dnf-automatic is the official tool for automating updates in the RHEL/CentOS/Rocky Linux/AlmaLinux family, supporting automatic downloading, automatic installation, and email notifications.

Install dnf-automatic

sudo dnf install dnf-automatic -y

Verify the installation:

rpm -qi dnf-automatic

Configuration File Explained

The main configuration file for dnf-automatic is located at /etc/dnf/automatic.conf.

sudo vi /etc/dnf/automatic.conf

Complete Configuration File Breakdown

[commands]
# Update type:
#   default  - all available updates
#   security - security updates only
upgrade_type = security

# Random delay in seconds before execution (0 means no delay)
random_sleep = 0

# Whether to automatically install after downloading
# yes = automatically download and install
# no  = download only, do not install
apply_updates = yes

# When apply_updates=no, whether to only download updates
download_updates = yes

# Reboot policy after updates (dnf-automatic 3.0+)
# never   - never reboot
# when-changed - reboot when kernel or similar updates require it
# when-needed  - reboot after installing updates that require it
reboot = never

# Wait time before reboot (seconds)
reboot_command = "shutdown -r +5 'Rebooting after applying updates'"

[emitters]
# Notification method:
#   stdio    - output to stdout (logged)
#   email    - send email
#   motd     - update /etc/motd
#   command_email - use an external command to send email
emit_via = email

[email]
# Sender address
email_from = dnf-automatic@hostname
# Recipient address
email_to = [email protected]
# SMTP server
email_host = localhost

[command_email]
# External mail command (when emit_via = command_email)
command_format = "cat"
email_from = dnf-automatic@hostname
email_to = [email protected]
stdin_encoding = utf-8

[base]
# Debug level (0-10)
debuglevel = 1
# Excluded packages (not automatically updated)
# exclude = kernel* php*

Configuration Policies Explained

download_updates vs apply_updates

These two options determine the behavior of dnf-automatic:

Combination	Behavior	Use Case
download_updates=yes + apply_updates=no	Download updates only, do not install	Manual confirmation required before installation
download_updates=yes + apply_updates=yes	Automatically download and install	Fully automated security update handling

Tip

Recommended production strategy: Set apply_updates=yes for automatic installation of security updates, and exclude kernel and other critical updates for manual handling by operations staff.

Install Security Updates Only (Recommended)

[commands]
upgrade_type = security
apply_updates = yes

Download All Updates Without Installing

[commands]
upgrade_type = default
download_updates = yes
apply_updates = no

Exclude Specific Packages

Add exclusions in the [base] section to prevent automatic updates of critical software that might affect services:

[base]
# Exclude kernel and specific applications
exclude = kernel* mysql* nginx*

Activate Timers

dnf-automatic uses systemd timers for periodic execution. Several predefined timers are provided.

Available Timer Units

Timer	Description
dnf-automatic.timer	Download and install updates
dnf-automatic-download.timer	Download updates only
dnf-automatic-install.timer	Download and install updates
dnf-automatic-notifyonly.timer	Check and notify only, no download or install

Enable the Auto-Install Timer

sudo systemctl enable --now dnf-automatic-install.timer

Enable the Download-Only Timer

sudo systemctl enable --now dnf-automatic-download.timer

Enable the Notify-Only Timer

sudo systemctl enable --now dnf-automatic-notifyonly.timer

Caution

Do not enable multiple dnf-automatic timers at the same time, as they will conflict. Enable only one based on your requirements.

Check Timer Status

sudo systemctl status dnf-automatic-install.timer
sudo systemctl list-timers --all | grep dnf

Customize Execution Time

The default timer typically runs daily in the early morning with a random delay. To customize the time:

sudo systemctl edit dnf-automatic-install.timer

Add the override configuration:

[Timer]
# Clear default settings
OnCalendar=
RandomizedDelaySec=0
# Set to run daily at 3:00 AM
OnCalendar=*-*-* 03:00:00

Verify the timer configuration:

sudo systemctl daemon-reload
sudo systemctl list-timers | grep dnf

Configure Email Notifications

Using a Local Mail Service

Ensure the system has a mail transfer agent (MTA) installed and configured:

sudo dnf install postfix mailx -y
sudo systemctl enable --now postfix

Configure in automatic.conf:

[emitters]
emit_via = email

[email]
email_from = dnf-automatic@$(hostname)
email_to = [email protected]
email_host = localhost

Using an External SMTP Server

If you need to send email through an external SMTP server:

[emitters]
emit_via = email

[email]
email_from = [email protected]
email_to = [email protected]
email_host = smtp.example.com:587

Using MOTD Notification

Write update information to /etc/motd so users see it upon login:

[emitters]
emit_via = motd

Combining Multiple Notification Methods

You can use multiple notification methods simultaneously:

[emitters]
emit_via = email,motd

Manual Testing

Dry Run

Check what would be done without actually performing updates:

sudo dnf-automatic --timer

Manually Trigger the Timer

sudo systemctl start dnf-automatic-install.service

View Execution Logs

sudo journalctl -u dnf-automatic-install.service --no-pager -l
sudo journalctl -u dnf-automatic-install.timer --no-pager -l

View dnf History

# View recent update history
sudo dnf history

# View details of the most recent update
sudo dnf history info last

Hands-On: Deploying Automatic Security Updates

1. Install dnf-automatic:

   sudo dnf install dnf-automatic -y

2. Configure the automatic security update policy:

   sudo cp /etc/dnf/automatic.conf /etc/dnf/automatic.conf.bak
   sudo tee /etc/dnf/automatic.conf <<'EOF'
   [commands]
   upgrade_type = security
   apply_updates = yes
   random_sleep = 300
   reboot = never
   
   [emitters]
   emit_via = email,motd
   
   [email]
   email_from = [email protected]
   email_to = [email protected]
   email_host = localhost
   
   [command_email]
   command_format = "cat"
   email_from = [email protected]
   email_to = [email protected]
   stdin_encoding = utf-8
   
   [base]
   debuglevel = 1
   # Exclude kernel updates for manual handling
   exclude = kernel*
   EOF

3. Install and start the mail service (if email notifications are needed):

   sudo dnf install postfix mailx -y
   sudo systemctl enable --now postfix

4. Enable the auto-install timer:

   sudo systemctl enable --now dnf-automatic-install.timer

5. Customize the execution time to 2:00 AM daily:

   sudo mkdir -p /etc/systemd/system/dnf-automatic-install.timer.d
   sudo tee /etc/systemd/system/dnf-automatic-install.timer.d/override.conf <<'EOF'
   [Timer]
   OnCalendar=
   RandomizedDelaySec=0
   OnCalendar=*-*-* 02:00:00
   EOF
   sudo systemctl daemon-reload

6. Verify the configuration:

   # Check timer status
   sudo systemctl status dnf-automatic-install.timer
   sudo systemctl list-timers | grep dnf
   
   # Manual test run
   sudo systemctl start dnf-automatic-install.service
   sudo journalctl -u dnf-automatic-install.service --no-pager -l

7. Periodically check update history:

   sudo dnf history
   sudo dnf history info last

Note

Even with automatic security updates enabled, it is still recommended to regularly review update logs and manually handle kernel updates, major version upgrades, and other updates that require testing and verification. Combining automation with manual review is the best practice.

By properly configuring dnf-automatic, you can maintain server security while reducing operational burden. Automatic installation is recommended for security updates, while kernel and critical business software should be excluded for manual handling.