apt vs dnf: package commands and automatic security updates

Debian and Ubuntu use apt with .deb packages. RHEL, Rocky Linux, AlmaLinux and Fedora use dnf with .rpm packages (older releases had yum, which is now an alias for dnf). The ideas are the same: refresh the list of available packages from repositories, install, upgrade, remove.

Everyday commands

# Debian / Ubuntu                    # RHEL / Rocky / Alma
sudo apt update                       # sudo dnf makecache   (dnf refreshes automatically)
apt list --upgradeable                # dnf check-update
sudo apt upgrade                      # sudo dnf upgrade
sudo apt full-upgrade                 # (dnf upgrade already handles removals)
sudo apt install nginx                # sudo dnf install nginx
sudo apt remove nginx                 # sudo dnf remove nginx
sudo apt purge nginx                  # (no equivalent; dnf leaves changed config files as .rpmsave)
sudo apt autoremove                   # sudo dnf autoremove
apt search nginx                      # dnf search nginx
apt show nginx                        # dnf info nginx
apt list --installed                  # dnf list --installed
sudo apt clean                        # sudo dnf clean all

• apt update only refreshes the package lists; it installs nothing. Always run it before apt upgrade or apt install.
• apt upgrade never removes installed packages; if an upgrade needs a removal, it is held back. apt full-upgrade allows removals to complete the upgrade.
• apt remove keeps configuration files; apt purge deletes them too.
• dnf check-update exits with code 100 when updates are available, 0 when there are none, which is handy in scripts.

Which package owns this file?

# Debian / Ubuntu
dpkg -S /usr/sbin/nginx

# RHEL / Rocky / Alma
rpm -qf /usr/sbin/nginx
dnf provides '*/bin/dig'        # also finds packages that are not installed yet

History and undo

# RHEL / Rocky / Alma
dnf history list
sudo dnf history undo 42        # reverse transaction 42

# Debian / Ubuntu: read the logs
less /var/log/apt/history.log

Security updates only

# RHEL / Rocky / Alma: needs repositories that publish advisories
dnf updateinfo --security
sudo dnf upgrade --security

Automatic updates on Debian and Ubuntu: unattended-upgrades

The unattended-upgrades package installs updates in the background. Ubuntu Server usually has it installed; on Debian, install it:

sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure unattended-upgrades     # answer Yes

This turns on two APT settings in a file under /etc/apt/apt.conf.d/; you can check with apt-config dump | grep Periodic:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

What gets installed is set in /etc/apt/apt.conf.d/50unattended-upgrades under Unattended-Upgrade::Origins-Pattern (Ubuntu uses Allowed-Origins); the default is security updates only. To reboot automatically when an update requires it (the file /var/run/reboot-required exists), uncomment and set:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Test the configuration without installing anything, and read the logs:

sudo unattended-upgrade --dry-run --debug
less /var/log/unattended-upgrades/unattended-upgrades.log

Automatic updates on RHEL, Rocky and AlmaLinux 8 and 9: dnf-automatic

sudo dnf install dnf-automatic
sudo nano /etc/dnf/automatic.conf

In [commands], choose what to install and whether to apply it:

[commands]
upgrade_type = security
download_updates = yes
apply_updates = yes
reboot = never

upgrade_type = default takes all updates; security only those with a security advisory. reboot can be never, when-changed or when-needed. Then enable the timer:

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers 'dnf-automatic*'

Alternative timers ignore the config file’s apply setting: dnf-automatic-notifyonly.timer only reports, dnf-automatic-download.timer downloads, and dnf-automatic-install.timer downloads and installs. Use only one. Releases that ship DNF 5 (recent Fedora and newer enterprise releases) package the automatic updater differently; check your release’s documentation.

Good practice

• Automate security updates, but schedule feature and major-version upgrades by hand.
• Kernel and C library updates need a reboot (or at least service restarts) to take effect. Plan reboot windows or enable automatic reboots.
• Watch the logs or the notification mail so failed automatic runs do not go unnoticed for months.

Official documentation

• apt(8) on Debian
• DNF Automatic
• unattended-upgrades project README