---
title: "Install security updates by themselves · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates
updated: 2026-10-20
licence: "All rights reserved"
---

# Install security updates by themselves

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Servers](https://agentwranglers.se/playbook/infrastructure/servers)
- Rule: Let every server install security updates by itself every day, and reboot in a set window when the kernel needs it.
- How: Use the system's own tool, such as `unattended-upgrades` on Debian and Ubuntu or `dnf-automatic` on Red Hat family systems. Set a reboot time when traffic is low. On a fleet, replace the servers instead, as in [immutable servers](https://agentwranglers.se/playbook/infrastructure/servers/immutable-servers). Alert when a server has waited more than 7 days for a reboot. The deadlines for patches are in [keep software current](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions).
- Check: `apt list --upgradable` lists no package from a security pocket, or `dnf updateinfo list --security` lists none, outside the 24 hours after a release. No server has had `/var/run/reboot-required` for more than 7 days.

Example:

```sh
# Debian and Ubuntu: prints security updates still waiting. Expect nothing.
apt list --upgradable 2>/dev/null | grep -- '-security'
# Prints the age of a pending reboot in days, if one is pending
[ -f /var/run/reboot-required ] && echo $(( ($(date +%s) - $(stat -c %Y /var/run/reboot-required)) / 86400 ))
```

```ini
# /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

# /etc/apt/apt.conf.d/52unattended-upgrades-local
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
```

```ini
# /etc/dnf/automatic.conf, then: systemctl enable --now dnf-automatic.timer
[commands]
upgrade_type = security
apply_updates = yes
reboot = when-needed
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates`.

- Previous: [Rebuild any server from code](https://agentwranglers.se/playbook/infrastructure/servers/rebuild-from-scratch)
- Next: [Turn on a firewall on every host](https://agentwranglers.se/playbook/infrastructure/servers/host-firewall)
- [Servers](https://agentwranglers.se/playbook/infrastructure/servers)