System updates and automatic security updates

Many attacks on servers exploit vulnerabilities that the operating system vendor has already published a fix for. This guide shows how to update Ubuntu, Debian, AlmaLinux and CentOS Stream, how to find out whether the server needs a reboot, and how to turn on automatic updates. Run the commands on the server as root, in an SSH session (Connecting to your server over SSH (Windows, macOS, Linux)). You can also reboot from the app.blackbox.md panel: “My Servers” (app.blackbox.md/my-servers) → the server card → “Reboot”.

Available to: the server owner, with root access over SSH. BLACKBOX does not install updates on your server: keeping it updated is up to you. For a server marked “Managed”, ask support for any change.

Updating manually

Update the system right after you receive the server, and then regularly, for example once a week. Don't close the SSH session while the update is running.

Updated services (for example the web server or the database) are restarted and may be unavailable for a short time. Packages from repositories you added yourself, such as Docker, are updated too: when Docker is updated, the docker service restarts and your containers stop for a short time. Choose a time with low traffic.

Ubuntu and Debian

apt update
apt upgrade -y

The first command downloads the package list, and the second installs the new versions. On Ubuntu, a needrestart window may appear and ask which services to restart: keep the proposed selection and press Enter. You can see what was installed in the history:

tail -n 30 /var/log/apt/history.log

AlmaLinux and CentOS Stream

dnf upgrade -y

You can see what was installed in the history:

dnf history

Does the server need a reboot?

Most updated programs restart on their own. A new kernel and some system libraries take effect only after the server reboots.

Ubuntu and Debian

cat /var/run/reboot-required
cat /var/run/reboot-required.pkgs

If a reboot is needed, the file exists: on Ubuntu the first command prints *** System restart required *** (on Debian the file may be empty), and the second prints the packages that require the reboot. The message “No such file or directory” from the first command means that no reboot is needed. On Ubuntu, the reboot warning also appears when you connect over SSH. On Debian without the unattended-upgrades package (see “Automatic updates on Ubuntu and Debian”), the file may be missing even when a reboot is needed: if apt installed a linux-image-… package, reboot anyway.

AlmaLinux and CentOS Stream

The needs-restarting command comes from the dnf-utils package:

dnf install -y dnf-utils
needs-restarting -r

The result “Reboot is required to fully utilize these updates.” means the server needs a reboot; “Reboot should not be necessary.” means it doesn't.

How to reboot

1. Reboot from the SSH session or, in the panel, click “Reboot” on the server card and confirm “Reboot SERVER_NAME?”.

   reboot

2. Wait 30–60 seconds and connect again.

3. Check the version of the running kernel:

   uname -r

More about the panel buttons: Rebooting, stopping and starting a server.

Important The panel has no web or VNC console. If the server stops responding over SSH after an update or a reboot, follow I can't connect over SSH; if that doesn't help, only the BLACKBOX team can step in: How to contact BLACKBOX support.

Automatic updates on Ubuntu and Debian

The unattended-upgrades package downloads and installs updates every day, in the background.

1. Install the package. If it is already installed, the command changes nothing.

   apt update
   apt install -y unattended-upgrades

2. Turn on automatic updates. When asked “Automatically download and install stable updates?”, choose “Yes” and press Enter.

   dpkg-reconfigure -plow unattended-upgrades

3. Check the file that was created:

   cat /etc/apt/apt.conf.d/20auto-upgrades

   Both lines must have the value “1”:

   APT::Periodic::Update-Package-Lists "1";
   APT::Periodic::Unattended-Upgrade "1";

4. Run a test. It doesn't install anything:

   unattended-upgrade --dry-run --debug

The settings are in /etc/apt/apt.conf.d/50unattended-upgrades. By default, Ubuntu installs only security updates, while Debian installs security updates and the fixes from the distribution's point releases (for example 12.7 → 12.8). Packages from repositories you added yourself (for example Docker) are not updated automatically: run apt upgrade manually for them.

Automatic reboot at a set time

By default, the server is not rebooted automatically. To have it reboot at night when an update requires it:

1. Open the settings file:

   nano /etc/apt/apt.conf.d/50unattended-upgrades

2. Find the lines below, delete the // at the start of each one, and set the values:

   Unattended-Upgrade::Automatic-Reboot "true";
   Unattended-Upgrade::Automatic-Reboot-Time "03:00";

3. Save with Ctrl+O and Enter, then exit with Ctrl+X.

The server reboots at the chosen time only if an update has required a reboot. The time is the server's own time; you can see its time zone with:

timedatectl

Logs

The logs are in /var/log/unattended-upgrades/: unattended-upgrades.log (what was installed) and unattended-upgrades-dpkg.log (installation details). The first command shows the latest entries, and the second shows when the next automatic update runs:

tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.log
systemctl list-timers 'apt-daily*'

Automatic updates on AlmaLinux and CentOS Stream

The dnf-automatic package checks for updates every day. By default, it only downloads them and doesn't install them.

1. Install the package:

   dnf install -y dnf-automatic

2. Set apply_updates = yes in /etc/dnf/automatic.conf so that updates are also installed:

   sed -i 's/^apply_updates = .*/apply_updates = yes/' /etc/dnf/automatic.conf

3. Optional, AlmaLinux only: install only security updates automatically.

   sed -i 's/^upgrade_type = .*/upgrade_type = security/' /etc/dnf/automatic.conf

4. Optional: reboot automatically when an update requires it.

   sed -i 's/^reboot = .*/reboot = when-needed/' /etc/dnf/automatic.conf

   The server reboots a few minutes after the updates are installed, that is, at the time of the daily schedule (you can see it in step 6).

5. Check the settings. If the reboot line is missing, your version doesn't have this option: reboot manually.

   grep -E '^(upgrade_type|apply_updates|reboot) ' /etc/dnf/automatic.conf

6. Turn on the daily schedule and see when it runs:

   systemctl enable --now dnf-automatic.timer
   systemctl list-timers dnf-automatic.timer

To see what happened during the last runs:

journalctl -u dnf-automatic.service

Tip On CentOS Stream, leave upgrade_type = default: CentOS Stream doesn't publish security markings for its updates, so the security option may install nothing. With default, dnf-automatic installs all updates, including those from repositories you added yourself (for example Docker).

Moving to a new major version

Regular updates keep the system version: Ubuntu 22.04 stays 22.04. Moving to a new version (for example Ubuntu 20.04 → 22.04) replaces almost all packages.

Risk Moving to a new major version can take your sites and applications down or leave the server without SSH access, and BLACKBOX does not make automatic backups of the server. Back up to another system first: Backup strategy for your server. For a production server, a new server with the data moved over is often the safer choice.

Ubuntu: do-release-upgrade

1. Make a backup.

2. Install all updates for the current version:

   apt update
   apt full-upgrade -y

3. Reboot the server, from SSH or with “Reboot” in the panel, and connect again.

4. Start the upgrade:

   do-release-upgrade

5. The program warns that it is running over SSH and says that it will start an additional SSH server on port 1022. By default, the network filter managed by BLACKBOX lets through only SSH (22), HTTP (80), HTTPS (443) and ping (Firewall: network filtering and ufw/firewalld on the server), so don't count on that port: keep a second SSH session open on port 22. Type y to continue.

6. Answer the other questions with y as well. For modified configuration files, keep the local version (see “Common messages”). Repositories you added yourself (for example Docker) are disabled during the upgrade; turn them back on afterwards by following the vendor's documentation.

7. At the end, accept the reboot, connect again and check the version:

   cat /etc/os-release

The message “No new release found.” means that no newer LTS version is available to upgrade to yet.

A new server instead of an upgrade

Order a new server with the version you want (Available operating systems), move your data (Moving a site to a BLACKBOX server), point your domain to the new IP address (How to point your domain to the server), and only then delete the old server (Permanently deleting a server). Until you delete it, both servers are billed.

Applications and panels are updated separately

apt and dnf update only the packages installed from repositories. Applications, websites and some panels are updated separately:

docker compose pull
docker compose up -d

Make a backup before you update a CMS or an application, too.

Common messages

After an interrupted update:

dpkg --configure -a
apt upgrade -y

Frequently asked questions

Does the “Upgrade” button in the panel update the system? No. “Upgrade” moves the server to a larger plan and leaves the system as it is: Server upgrade: moving to a larger plan.

I have Ubuntu 20.04 or Debian 11. Is it still worth updating? Yes, but the vendor's standard support for these versions has ended. Plan a move to a new version (see the section above). The support dates are published by the vendors: Ubuntu release cycle and Debian releases.

Is the Monitoring service agent updated too? If the alloy agent was installed from the vendor's repository, apt upgrade updates it like any other package. This is normal. If you're asked about the /etc/alloy/config.alloy file, keep the local version (see “Common messages”). Don't stop or uninstall the agent: The Monitoring service: the agent installed on the server.

Can the BLACKBOX team take care of updates? Server maintenance can be requested as a separate service: Professional services on request: administration, DevOps, migration.