Automatic Security Updates

Timely installation of security updates is a fundamental measure for maintaining server security. dnf-automatic is the official tool for automating updates in the RHEL/CentOS/Rocky Linux/AlmaLinux family, supporting automatic downloading, automatic installation, and email notifications.

Install dnf-automatic

sudo dnf install dnf-automatic -y

Verify the installation:

rpm -qi dnf-automatic

Configuration File Explained

The main configuration file for dnf-automatic is located at /etc/dnf/automatic.conf.

sudo vi /etc/dnf/automatic.conf

Complete Configuration File Breakdown

[commands]
# Update type:
#   default  - all available updates
#   security - security updates only
upgrade_type = security

# Random delay in seconds before execution (0 means no delay)
random_sleep = 0

# Whether to automatically install after downloading
# yes = automatically download and install
# no  = download only, do not install
apply_updates = yes

# When apply_updates=no, whether to only download updates
download_updates = yes

# Reboot policy after updates (dnf-automatic 3.0+)
# never   - never reboot
# when-changed - reboot when kernel or similar updates require it
# when-needed  - reboot after installing updates that require it
reboot = never

# Wait time before reboot (seconds)
reboot_command = "shutdown -r +5 'Rebooting after applying updates'"

[emitters]
# Notification method:
#   stdio    - output to stdout (logged)
#   email    - send email
#   motd     - update /etc/motd
#   command_email - use an external command to send email
emit_via = email

[email]
# Sender address
email_from = dnf-automatic@hostname
# Recipient address
email_to = [email protected]
# SMTP server
email_host = localhost

[command_email]
# External mail command (when emit_via = command_email)
command_format = "cat"
email_from = dnf-automatic@hostname
email_to = [email protected]
stdin_encoding = utf-8

[base]
# Debug level (0-10)
debuglevel = 1
# Excluded packages (not automatically updated)
# exclude = kernel* php*

Configuration Policies Explained

download_updates vs apply_updates

These two options determine the behavior of dnf-automatic:

Combination	Behavior	Use Case
`download_updates=yes` + `apply_updates=no`	Download updates only, do not install	Manual confirmation required before installation
`download_updates=yes` + `apply_updates=yes`	Automatically download and install	Fully automated security update handling

Install Security Updates Only (Recommended)

[commands]
upgrade_type = security
apply_updates = yes

Download All Updates Without Installing

[commands]
upgrade_type = default
download_updates = yes
apply_updates = no

Exclude Specific Packages

Add exclusions in the [base] section to prevent automatic updates of critical software that might affect services:

[base]
# Exclude kernel and specific applications
exclude = kernel* mysql* nginx*

Activate Timers

dnf-automatic uses systemd timers for periodic execution. Several predefined timers are provided.

Available Timer Units

Timer	Description
`dnf-automatic.timer`	Runs according to `apply_updates` in `/etc/dnf/automatic.conf` (default `False`: check/download only, no install)
`dnf-automatic-download.timer`	Download updates only
`dnf-automatic-install.timer`	Download and install updates
`dnf-automatic-notifyonly.timer`	Check and notify only, no download or install

Enable the Auto-Install Timer

sudo systemctl enable --now dnf-automatic-install.timer

Enable the Download-Only Timer

sudo systemctl enable --now dnf-automatic-download.timer

Enable the Notify-Only Timer

sudo systemctl enable --now dnf-automatic-notifyonly.timer

Check Timer Status

sudo systemctl status dnf-automatic-install.timer
sudo systemctl list-timers --all | grep dnf

Customize Execution Time

The default timer typically runs daily in the early morning with a random delay. To customize the time:

sudo systemctl edit dnf-automatic-install.timer

Add the override configuration:

[Timer]
# Clear default settings
OnCalendar=
RandomizedDelaySec=0
# Set to run daily at 3:00 AM
OnCalendar=*-*-* 03:00:00

Verify the timer configuration:

sudo systemctl daemon-reload
sudo systemctl list-timers | grep dnf

Configure Email Notifications

Using a Local Mail Service

Ensure the system has a mail transfer agent (MTA) installed and configured:

sudo dnf install postfix mailx -y
sudo systemctl enable --now postfix

Configure in automatic.conf:

[emitters]
emit_via = email

[email]
email_from = dnf-automatic@$(hostname)
email_to = [email protected]
email_host = localhost

Using an External SMTP Server

If you need to send email through an external SMTP server:

[emitters]
emit_via = email

[email]
email_from = [email protected]
email_to = [email protected]
# hostname and port are separate options; host:587 will not connect
default = smtp.example.com
email_port = 587
email_tls = True

Using MOTD Notification

Write update information to /etc/motd so users see it upon login:

[emitters]
emit_via = motd

Combining Multiple Notification Methods

You can use multiple notification methods simultaneously:

[emitters]
emit_via = email,motd

Manual Testing

Dry Run

dnf-automatic has no dry-run mode. --timer is a control parameter for the systemd timer (it runs according to automatic.conf), not a simulation:

# To see what would happen without touching the system, use dnf's own check/download commands
sudo dnf check-update
sudo dnf --refresh makecache

# What --timer really does: run once according to automatic.conf (with apply_updates=yes it installs)
sudo dnf-automatic --timer

Manually Trigger the Timer

sudo systemctl start dnf-automatic-install.service

View Execution Logs

sudo journalctl -u dnf-automatic-install.service --no-pager -l
sudo journalctl -u dnf-automatic-install.timer --no-pager -l

View dnf History

# View recent update history
sudo dnf history

# View details of the most recent update
sudo dnf history info last

Hands-On: Deploying Automatic Security Updates

Install dnf-automatic:
Terminal window
```
sudo dnf install dnf-automatic -y
```

Configure the automatic security update policy:

sudo cp /etc/dnf/automatic.conf /etc/dnf/automatic.conf.bak
sudo tee /etc/dnf/automatic.conf <<'EOF'
[commands]
upgrade_type = security
apply_updates = yes
random_sleep = 300
reboot = never

[emitters]
emit_via = email,motd

[email]
email_from = [email protected]
email_to = [email protected]
email_host = localhost

[command_email]
command_format = "cat"
email_from = [email protected]
email_to = [email protected]
stdin_encoding = utf-8

[base]
debuglevel = 1
# Exclude kernel updates for manual handling
exclude = kernel*
EOF

Install and start the mail service (if email notifications are needed):
Terminal window
```
sudo dnf install postfix mailx -y
sudo systemctl enable --now postfix
```

Enable the auto-install timer:

sudo systemctl enable --now dnf-automatic-install.timer

Customize the execution time to 2:00 AM daily:

sudo mkdir -p /etc/systemd/system/dnf-automatic-install.timer.d
sudo tee /etc/systemd/system/dnf-automatic-install.timer.d/override.conf <<'EOF'
[Timer]
OnCalendar=
RandomizedDelaySec=0
OnCalendar=*-*-* 02:00:00
EOF
sudo systemctl daemon-reload

Verify the configuration:

# Check timer status
sudo systemctl status dnf-automatic-install.timer
sudo systemctl list-timers | grep dnf

# Manual test run
sudo systemctl start dnf-automatic-install.service
sudo journalctl -u dnf-automatic-install.service --no-pager -l

Periodically check update history:
Terminal window
```
sudo dnf history
sudo dnf history info last
```

By properly configuring dnf-automatic, you can maintain server security while reducing operational burden. Automatic installation is recommended for security updates, while kernel and critical business software should be excluded for manual handling.