Automatic security updates

#What gets installed

The automatic run installs security updates only. It never upgrades the distribution release and never removes packages.

On Debian/Ubuntu, updates from repositories without a security archive (PHP, MariaDB, Node.js and so on) are not installed automatically; install them yourself from the Operating system tab or the command line. The security sources in use are listed on the Security sources row.

Configuration files you have changed are kept: on Debian/Ubuntu the automatic run calls dpkg with --force-confdef --force-confold (only for the automatic run; your manual apt commands behave as before), and on EL rpm does not overwrite a modified file and leaves an .rpmnew next to it.

The feature is identical in Community and Pro. New installations get the component by default; existing ones install it once when the panel starts. It appears as Automatic security updates under Server Admin → System → Components, where it can be removed; removing it deletes the files the panel wrote and returns to the distribution defaults.

#Settings

The settings live in the Automatic security updates section of Server Admin → System → Updates → Operating system and only the server administrator can change them. Save and apply writes the settings to the system files and validates them; if validation fails, the previous files and setting are restored.

#How the window works

The panel adds an override to the tool’s own timer (apt-daily-upgrade.timer or dnf-automatic.timer). The run starts at a random moment in the first three quarters of the window, leaving the rest for the update to finish, so servers sharing a window do not hit the mirrors in the same minute. If the server is off during the window, the run is not caught up at boot; it waits for the next window. On Debian/Ubuntu the package lists are refreshed right before each run. The Next run time on screen is shown in server time.

#Excluded packages

Names may contain letters, digits and . _ + -; a single trailing * matches a prefix (for example linux-image-* or kernel*). On Debian/Ubuntu the list goes into the unattended-upgrades blacklist, on EL into the excludepkgs line of /etc/dnf/automatic.conf. Security updates for excluded packages must be installed by hand.

#Configuration drift

If someone edits the files the panel manages, the section shows The configuration does not match the settings with the affected files. They are rewritten when you save the settings, and automatically within an hour at the latest. Make lasting changes through the panel settings.

#Run now

Run now starts the same run the timer would, without waiting. The tool runs in a separate transient systemd unit, so the update is not cut short if the panel restarts, and its output streams live into the task log. At the end the log lists the updated packages, the service state and whether a reboot is needed. If the tool is not installed, the button returns an error and the section offers an Install button.

#Run history and notifications

Every run of the timer and of Run now is recorded in the Run history table: time, started by (Timer / Administrator), result, services and whether a reboot was required. Open a row to see each package’s previous and new version, plus any errors and warnings. The screen lists the last 30 runs; up to 200 are kept.

After each run the administrators get a panel notification: a success notice when packages were updated cleanly, a warning when a reboot is required or a stopped service had to be restarted, and an error when the run failed or a service could not be started. Runs that changed nothing produce no notification. The vulnerability inventory is also recalculated.

#Service health check

After every run the panel checks the critical services: the web server (Apache, Nginx, OpenLiteSpeed), PHP-FPM units, MySQL/MariaDB, PostgreSQL, Postfix, Dovecot, the DNS server, SSH and the panel itself. A service that should be running but is not gets restarted, and the outcome is recorded.

• Services you stopped from the panel, services not enabled at boot, and services the panel does not manage (such as an external database) are left alone.
• On Debian/Ubuntu, needrestart restarts services that use updated libraries during the update without prompting; the panel’s own unit is excluded. If needrestart is missing, the section shows a warning with an Install button.
• On EL the panel does the same with dnf needs-restarting -s; panel, session, network and firewall units are never restarted automatically.

#Reboots and kernel updates

Kernel security updates (linux-image-*, kernel*) are installed like any other package unless you exclude them, but the new kernel only runs after a reboot. The panel detects a pending reboot from /run/reboot-required on Debian/Ubuntu and from dnf needs-restarting -r on EL, and shows A reboot is required on screen.

• With automatic reboot off (the default), reboot at a convenient time from Server Admin → System → Reboot Server.
• With it on, the server is checked every day at the chosen time; if a reboot is required and no package manager is running, it reboots one minute later. Otherwise nothing happens that day. After the reboot the administrators are notified once.

Put the reboot time after the window, not inside it; the screen points it out when it overlaps.

#By installation type

#Installation heartbeat

The mandatory installation heartbeat carries only four fields from this feature: whether it is enabled, the time of the last run, the last run’s result (ok / error) and whether a reboot is pending. No package names or logs are sent. The heartbeat is sent early after each run. For the panel’s own version updates, see Panel updates.