Restart After Updates and Automatic Security Updates on cPanel, DirectAdmin, AlmaLinux and Debian (Tested)

Short answer: a library or kernel update protects you only after the programs using it are restarted. On AlmaLinux, dnf needs-restarting -r tells you whether a reboot is needed and dnf needs-restarting -s lists the services to restart. On Debian, use needrestart -b and check for /var/run/reboot-required. For automatic security updates, use dnf-automatic with upgrade_type = security on AlmaLinux, or unattended-upgrades on Debian. On cPanel, OS packages are already updated every night, except the kernel, which cPanel skips by default.

Applies to AlmaLinux 9.8 with cPanel 138 and DirectAdmin 1.712: dnf 4.14 (needs-restarting, dnf-automatic 4.14.0), needrestart 3.8; Debian 12: unattended-upgrades 2.9.1, needrestart 3.6; lab test 11 Oct 2026

We checked all of this on 11 October 2026 on three lab servers: cPanel 138 on AlmaLinux 9.8, DirectAdmin 1.712 on AlmaLinux 9.8, and Debian 12. We ran the automatic-update tools in report-only or dry-run mode and removed them afterwards.

Why updates need restarts

When dnf or apt replaces a library such as OpenSSL or glibc, programs that are already running keep the old copy in memory until they restart. Kernel updates are only used after a reboot, unless you use live patching such as KernelCare. A server can therefore be “fully updated” and still run vulnerable code.

AlmaLinux, Rocky, CloudLinux: dnf needs-restarting

dnf needs-restarting -r     # reboot needed? (exit code 1 = yes)
dnf needs-restarting -s     # services using replaced files
dnf needs-restarting        # every process, with its PID

On both AlmaLinux labs, -r answered Reboot is required to fully utilize these updates. -s listed 13 services on the cPanel lab (including cpanel, dnsadmin, queueprocd, jetbackup5d, auditd) and 23 on the DirectAdmin lab (including mariadb, httpd, dovecot, php-fpm74, lfd).

Restart services one at a time in a quiet hour, and check each one, for example: systemctl restart dovecot && systemctl is-active dovecot. Restarting dbus-broker or systemd-logind by hand is not worth the risk; those are fixed by the next reboot.

needrestart (in EPEL) gives the same answer in a script-friendly format. On our DirectAdmin lab, needrestart -b printed NEEDRESTART-KSTA: 1 (kernel is current) and one NEEDRESTART-SVC: line per service: directadmin, exim, httpd, mariadb, sshd and others.

cPanel: nightly OS updates skip the kernel

With the default Update Preferences (RPMUP=daily in /etc/cpupdate.conf), cPanel’s nightly maintenance runs /usr/local/cpanel/scripts/update-packages, which runs a normal OS package update. Its log line on our lab showed what it excludes:

[/usr/local/cpanel/scripts/update-packages] excludes: bind-chroot dovecot* exim* filesystem kernel
kernel-xen ... kernel-core kernel-modules* kernel-devel* kmod-[a-z]* p0f php* proftpd* pure-ftpd*

Exim, Dovecot and PHP are excluded because cPanel ships its own builds. The kernel is excluded because of the Tweak Setting rpmup_allow_kernel, which is 0 by default (we found that default in cPanel’s Cpanel/Config/CpConfGuard/Default.pm). The result on our lab: every package was up to date, yet a kernel security update (kernel-core 5.14.0-687.54.1, a Moderate security notice) was waiting.

Your choices:

• Install kernel updates yourself in a maintenance window: dnf update 'kernel*', then reboot.
• Let cPanel include the kernel: whmapi1 set_tweaksetting key=rpmup_allow_kernel value=1 (check with whmapi1 get_tweaksetting key=rpmup_allow_kernel). You still have to reboot.
• Use live patching (KernelCare) so the running kernel is patched without a reboot.

DirectAdmin: nothing updates the OS by itself

DirectAdmin and CustomBuild update their own software (Apache, PHP, Exim, Dovecot and so on). /etc/dnf/dnf.conf on our lab excluded apache* httpd* php* exim* dovecot* mysql-server* nginx* pure-ftpd* so that dnf never replaces them. Nothing on the server ran OS updates automatically: no dnf-automatic and no update cron job. Either run dnf update regularly or set up dnf-automatic (next section).

dnf-automatic: automatic security updates on AlmaLinux

dnf install dnf-automatic
# /etc/dnf/automatic.conf
[commands]
upgrade_type = security      # default: all updates
download_updates = yes
apply_updates = yes          # default: no
reboot = never               # or when-needed, see below
[emitters]
emit_via = email             # or stdio, motd
[email]
email_to = you@example.com

systemctl enable --now dnf-automatic.timer

The package installs four timers, all disabled on our lab: dnf-automatic.timer (follows the config file), dnf-automatic-download.timer, dnf-automatic-install.timer and dnf-automatic-notifyonly.timer. Enable exactly one.

With upgrade_type = security and installing switched off, dnf-automatic on our cPanel lab reported exactly the pending kernel security update (install kernel-core and kernel-modules-core 5.14.0-687.54.1, remove the oldest kernel). On cPanel this matters: dnf-automatic does not follow rpmup_allow_kernel, so it will install kernel updates that cPanel’s own updater skips. The permanent excludes in dnf.conf (exim, php, dovecot) still apply. Decide which of the two should update the server, not both.

reboot = when-needed reboots after updates that need it (kernel, glibc, systemd), using reboot_command (by default shutdown -r +5). For a hosting server, prefer never plus a monthly planned reboot, unless you have live patching.

Debian 12: unattended-upgrades and needrestart

Our Debian 12 lab had neither installed. Without /etc/apt/apt.conf.d/20auto-upgrades, the apt-daily and apt-daily-upgrade timers still fire, but the APT::Periodic settings are off, so they neither refresh the package lists nor install anything. After a manual apt-get update, the lab showed a pending kernel security update (6.1.115 → 6.1.187) that nothing would ever have installed.

apt install unattended-upgrades needrestart
cat > /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
unattended-upgrade --dry-run -d      # see what it would do

Installing the package with DEBIAN_FRONTEND=noninteractive did not create 20auto-upgrades, so write it yourself (or run dpkg-reconfigure unattended-upgrades). The default 50unattended-upgrades allows the Debian and Debian-Security origins, so point-release updates are installed too, not only security fixes. Our dry run reported:

Allowed origins are: origin=Debian,codename=bookworm,label=Debian, ...,label=Debian-Security
Packages that will be upgraded: libpng16-16 linux-image-amd64
Option --dry-run given, *not* performing real actions

Two things to know. First, the dry run still wrote entries to /var/log/apt/history.log as if it had upgraded, but nothing was installed: check with dpkg -l, not the history file. Second, Debian 12 is now “oldstable”, and its security updates come from oldstable-security; the default configuration matches them by codename, so they are still picked up.

Useful settings in /etc/apt/apt.conf.d/50unattended-upgrades: Unattended-Upgrade::Mail "you@example.com"; for a report, Unattended-Upgrade::Package-Blacklist for packages that must not change (for example a PBX or database you upgrade by hand), and Unattended-Upgrade::Automatic-Reboot (default false).

needrestart -b on our Debian lab listed fail2ban, freepbx and sangoma-pnpd. By default ($nrconf{restart} = 'i'), needrestart asks interactively after each apt run. Set 'l' to only list, or 'a' to restart automatically, in /etc/needrestart/needrestart.conf.

A sensible routine for a hosting server

1. Security updates daily: cPanel’s nightly updates, dnf-automatic with upgrade_type = security, or unattended-upgrades.
2. Kernel: live patching, or a planned reboot after each kernel update (check dnf needs-restarting -r or /var/run/reboot-required weekly).
3. Services: after big library updates (OpenSSL, glibc), restart what needs-restarting -s or needrestart -b lists, in a quiet hour.
4. Panel software (PHP, Exim, Apache) follows the panel’s own updater: upcp/EasyApache on cPanel, CustomBuild on DirectAdmin.
5. Before any reboot, check backups and have console access ready. See cPanel update tiers for the panel side.

Frequently asked questions

Next step: if dnf itself stops with “required file not found”, see fix dnf on AlmaLinux 10.

Reading a lot of our guides? Go ad-free with srvScripts Pro for $6 a month. It also pays for new guides. Cancel any time.