How to keep Linux packages updated

Quick answer: Update manually with apt update && apt upgrade (Ubuntu/Debian) or dnf upgrade (AlmaLinux/Rocky), and automate security patches with unattended-upgrades or dnf-automatic. Most real-world server compromises exploit vulnerabilities that already had a patch available.

Overview

Package updates deliver security fixes for the kernel, OpenSSH, web servers, PHP and everything else you run. Automating at least the security subset keeps the window between disclosure and patching short without you logging in daily. Kernel and libc updates additionally need a reboot to take effect.

Before you start

• Root/sudo access.
• A maintenance habit: know when your apps tolerate a service restart or reboot.
• Backups — updates rarely break things, but rollback beats regret.

Step-by-step guide

1. Manual update, Ubuntu/Debian:

   apt update
   apt upgrade -y
   apt autoremove -y

2. Manual update, AlmaLinux/Rocky:

   dnf upgrade -y

3. Automate security updates, Ubuntu/Debian:

   apt install unattended-upgrades -y
   dpkg-reconfigure -plow unattended-upgrades

   Fine-tune /etc/apt/apt.conf.d/50unattended-upgrades (e.g. automatic reboot windows).
4. Automate, Alma/Rocky:

   dnf install dnf-automatic -y
   systemctl enable --now dnf-automatic.timer

   Set apply_updates = yes in /etc/dnf/automatic.conf.
5. Check reboot need: Ubuntu/Debian create /var/run/reboot-required; dnf needs-restarting -r on Alma/Rocky. Schedule reboots for kernel updates.

Common issues

• Service restarted unexpectedly: unattended-upgrades restarts patched services — pin critical ones or set quiet hours.
• Held-back packages: apt full-upgrade handles changed dependencies; read what it plans to remove first.
• Old kernel still running: updates install the new kernel but only a reboot activates it.

When to contact support

OS updates are customer-managed on unmanaged services. If a kernel update leaves the VPS unbootable, use the KVM Console to select the previous kernel in GRUB, and open a ticket if you cannot recover.

Frequently asked questions

Should security updates be installed automatically?

For most servers yes — unattended-upgrades on Ubuntu/Debian or dnf-automatic on AlmaLinux/Rocky patch vulnerabilities within hours of release, far faster than manual routines.

Do updates require a server reboot?

Only kernel and core library updates do. Ubuntu creates /var/run/reboot-required, and dnf needs-restarting -r tells you on AlmaLinux/Rocky. Schedule the reboot at a quiet hour.

Can an update break my applications?

Rarely within one distro release, since only compatible fixes ship. Keep backups, read the change list for major services, and test risky upgrades on a staging server first.

Related articles

• How to update Linux packages
• How to harden a Linux server
• VPS security checklist after deployment
• How to scan a server for malware

Need a hand? Contact Cloud2Y support →