# Restart After Updates and Automatic Security Updates on cPanel, DirectAdmin, AlmaLinux and Debian (Tested)

Source: https://srvscripts.com/guides/restart-after-updates-automatic-security-updates/
Updated: 2026-10-18
Publisher: srvScripts (https://srvscripts.com/)

**Short answer:** a library or kernel update protects you only after the programs using it are restarted. On AlmaLinux, `dnf needs-restarting -r` tells you whether a reboot is needed and `dnf needs-restarting -s` lists the services to restart. On Debian, use `needrestart -b` and check for `/var/run/reboot-required`. For automatic security updates, use `dnf-automatic` with `upgrade_type = security` on AlmaLinux, or `unattended-upgrades` on Debian. On cPanel, OS packages are already updated every night, **except the kernel**, which cPanel skips by default.

We checked all of this on 11 October 2026 on three lab servers: cPanel 138 on AlmaLinux 9.8, DirectAdmin 1.712 on AlmaLinux 9.8, and Debian 12. We ran the automatic-update tools in report-only or dry-run mode and removed them afterwards.

## Why updates need restarts

When `dnf` or `apt` replaces a library such as OpenSSL or glibc, programs that are already running keep the old copy in memory until they restart. Kernel updates are only used after a reboot, unless you use live patching such as [KernelCare](/guides/kernelcare-setup-cpanel-directadmin/). A server can therefore be “fully updated” and still run vulnerable code.

## AlmaLinux, Rocky, CloudLinux: dnf needs-restarting

```
dnf needs-restarting -r     # reboot needed? (exit code 1 = yes)
dnf needs-restarting -s     # services using replaced files
dnf needs-restarting        # every process, with its PID
```

On both AlmaLinux labs, `-r` answered `Reboot is required to fully utilize these updates.` `-s` listed 13 services on the cPanel lab (including `cpanel`, `dnsadmin`, `queueprocd`, `jetbackup5d`, `auditd`) and 23 on the DirectAdmin lab (including `mariadb`, `httpd`, `dovecot`, `php-fpm74`, `lfd`).

Restart services one at a time in a quiet hour, and check each one, for example: `systemctl restart dovecot && systemctl is-active dovecot`. Restarting `dbus-broker` or `systemd-logind` by hand is not worth the risk; those are fixed by the next reboot.

**needrestart** (in EPEL) gives the same answer in a script-friendly format. On our DirectAdmin lab, `needrestart -b` printed `NEEDRESTART-KSTA: 1` (kernel is current) and one `NEEDRESTART-SVC:` line per service: `directadmin`, `exim`, `httpd`, `mariadb`, `sshd` and others.

## cPanel: nightly OS updates skip the kernel

With the default Update Preferences (`RPMUP=daily` in `/etc/cpupdate.conf`), cPanel’s nightly maintenance runs `/usr/local/cpanel/scripts/update-packages`, which runs a normal OS package update. Its log line on our lab showed what it excludes:

```
[/usr/local/cpanel/scripts/update-packages] excludes: bind-chroot dovecot* exim* filesystem kernel
kernel-xen ... kernel-core kernel-modules* kernel-devel* kmod-[a-z]* p0f php* proftpd* pure-ftpd*
```

Exim, Dovecot and PHP are excluded because cPanel ships its own builds. The kernel is excluded because of the Tweak Setting `rpmup_allow_kernel`, which is `0` by default (we found that default in cPanel’s `Cpanel/Config/CpConfGuard/Default.pm`). The result on our lab: every package was up to date, yet a kernel security update (`kernel-core 5.14.0-687.54.1`, a Moderate security notice) was waiting.

Your choices:

- Install kernel updates yourself in a maintenance window: `dnf update 'kernel*'`, then reboot.

- Let cPanel include the kernel: `whmapi1 set_tweaksetting key=rpmup_allow_kernel value=1` (check with `whmapi1 get_tweaksetting key=rpmup_allow_kernel`). You still have to reboot.

- Use live patching (KernelCare) so the running kernel is patched without a reboot.

## DirectAdmin: nothing updates the OS by itself

DirectAdmin and CustomBuild update their own software (Apache, PHP, Exim, Dovecot and so on). `/etc/dnf/dnf.conf` on our lab excluded `apache* httpd* php* exim* dovecot* mysql-server* nginx* pure-ftpd*` so that dnf never replaces them. Nothing on the server ran OS updates automatically: no dnf-automatic and no update cron job. Either run `dnf update` regularly or set up dnf-automatic (next section).

## dnf-automatic: automatic security updates on AlmaLinux

```
dnf install dnf-automatic
# /etc/dnf/automatic.conf
[commands]
upgrade_type = security      # default: all updates
download_updates = yes
apply_updates = yes          # default: no
reboot = never               # or when-needed, see below
[emitters]
emit_via = email             # or stdio, motd
[email]
email_to = you@example.com

systemctl enable --now dnf-automatic.timer
```

The package installs four timers, all **disabled** on our lab: `dnf-automatic.timer` (follows the config file), `dnf-automatic-download.timer`, `dnf-automatic-install.timer` and `dnf-automatic-notifyonly.timer`. Enable exactly one.

With `upgrade_type = security` and installing switched off, dnf-automatic on our cPanel lab reported exactly the pending kernel security update (install `kernel-core` and `kernel-modules-core` 5.14.0-687.54.1, remove the oldest kernel). **On cPanel this matters:** dnf-automatic does not follow `rpmup_allow_kernel`, so it will install kernel updates that cPanel’s own updater skips. The permanent excludes in `dnf.conf` (exim, php, dovecot) still apply. Decide which of the two should update the server, not both.

`reboot = when-needed` reboots after updates that need it (kernel, glibc, systemd), using `reboot_command` (by default `shutdown -r +5`). For a hosting server, prefer `never` plus a monthly planned reboot, unless you have live patching.

## Debian 12: unattended-upgrades and needrestart

Our Debian 12 lab had **neither installed**. Without `/etc/apt/apt.conf.d/20auto-upgrades`, the `apt-daily` and `apt-daily-upgrade` timers still fire, but the `APT::Periodic` settings are off, so they neither refresh the package lists nor install anything. After a manual `apt-get update`, the lab showed a pending kernel security update (6.1.115 → 6.1.187) that nothing would ever have installed.

```
apt install unattended-upgrades needrestart
cat > /etc/apt/apt.conf.d/20auto-upgrades