Unattended upgrades on a VPS

Unattended upgrades install security updates on your VPS without you logging in for every patch. On a LogicWeb KVM VPS you have root, so you choose the tool, the reboot window, and which packages stay held. The point is timely security fixes without midday reboots or surprise major version jumps that take the site down.

Pick the package that matches your OS

Debian and Ubuntu use the unattended-upgrades package. AlmaLinux and Rocky Linux use dnf-automatic instead. Both can stay on the security pocket and leave third-party repositories alone if you configure them that way. After you enable either tool, read the mail the server sends and check the logs after each window so a failed service does not sit unnoticed.

On Debian and Ubuntu, review /var/log/unattended-upgrades/. On Alma and Rocky, use dnf history to see what landed. If a kernel update is waiting, the guest needs a reboot in the window you set, not during peak traffic.

Set the reboot time and hold sensitive packages

Kernel updates often need a reboot before they fully apply. Set Automatic-Reboot-Time on Debian-based systems, or the matching option in dnf-automatic, so reboots happen in a quiet hour you chose. If you do not want automatic reboots at all, say so in the config rather than discovering a restart in production.

Security fixes for packages such as OpenSSL belong on the automatic path. Major version jumps for MariaDB or PostgreSQL usually do not. Pin or hold those packages so a blind major upgrade does not break the application while customers are checking out.

Keep one updater in charge

On a plain KVM guest you own apt or dnf, so unattended upgrades stay under your control. If the VPS runs cPanel, that stack already has its own updater. Do not run two unattended systems that both believe they own Apache or the same services. Shared hosting with CloudLinux LVE is different, because you are not patching the node yourself.

Before a window that will reboot or touch the database, take a snapshot when you can. Rescue mode is for when a new kernel will not boot, not for cleaning up a lunch-hour surprise. Turn unattended upgrades on or off on purpose, with a time and with holds, and you get the security benefit without the outage.