Yum Cron CentOS: Set Up Automatic Updates

To configure automatic updates on CentOS with yum-cron, install the yum-cron package, enable the service, and edit its configuration files to control which updates are applied and when. The default setup checks for updates daily and can be set to automatically download and install security updates, giving you a hands-off patching routine.

What Is yum-cron and Why Use It?

yum-cron is a small daemon that runs yum commands on a schedule. It is part of the older yum ecosystem that CentOS 7 and earlier versions rely on, and it is still the standard tool for automatic updates on those systems. CentOS 8 and later use dnf, but the package is called dnf-automatic there. This article focuses on CentOS 7 and earlier, where yum-cron is the correct choice.

Running a server without updates leaves known vulnerabilities open. Manually running yum update every day is easy to forget, especially when you manage several machines. yum-cron automates that task in a controlled way. You can choose to only install security updates, which reduces the risk of a routine update breaking a service, while still keeping the box safe from known exploits.

How yum-cron Works

yum-cron is a Python script that runs via cron. The package installs a cron job in /etc/cron.daily that triggers the script once per day. The script reads two main configuration files:

• /etc/yum/yum-cron.conf – controls the daily job, which by default only checks for updates and sends a report.
• /etc/yum/yum-cron-hourly.conf – controls the hourly job, which by default is disabled.

Both files use the same format. The key directive is update_cmd, which determines what the job does when it runs. The options are:

• default – run yum update, install all available updates.
• security – install only packages that fix security issues.
• security-severity:Critical – install only critical security updates.
• minimal – install only the latest versions of packages that are already installed, not new packages.
• minimal-security – same as minimal but only security updates.

After the script runs, it can send an email report to the address you set in email_to. You can also set download_updates to yes or no. If you set it to no, yum-cron will only download the package metadata and tell you what updates are available; it will not install anything. That is useful if you want a daily email of available updates without applying them automatically.

Step-by-Step Setup

These steps assume you have root access to a CentOS 7 system. The commands are the same for CentOS 6, though the package name and service manager differ slightly (CentOS 6 uses service instead of systemctl).

1. Install the package: yum install yum-cron
2. Edit the main configuration file: vi /etc/yum/yum-cron.conf
3. Set update_cmd = security if you want only security updates, or leave it as default for all updates.
4. Set download_updates = yes and apply_updates = yes to actually install the updates.
5. Set email_to = your@email.com if you want a report. Leave email_from as root if you do not have a mail server configured.
6. Save the file and enable the service: systemctl enable yum-cron and systemctl start yum-cron

On CentOS 6, use chkconfig yum-cron on and service yum-cron start.

Choosing What to Update

The biggest decision is whether to install all updates or only security ones. Installing everything is simpler and keeps the system fully patched, but it carries a small risk. A non-security update might change behavior of a service you depend on, or introduce a regression that breaks your application. Security-only updates reduce that risk because they are usually more focused.

For a production server, a common approach is to set update_cmd = security and then manually run yum update during a maintenance window for the rest. This gives you the best of both: critical security patches are applied automatically, while other updates are reviewed before they go in.

If you run CentOS 8 or later, the equivalent package is dnf-automatic. The configuration file is at /etc/dnf/automatic.conf and the service is dnf-automatic.timer. The options are similar, but the syntax is slightly different. For example, the setting is apply_updates = yes instead of download_updates and apply_updates.

Common Problems and Fixes

One of the most frequent issues is that yum-cron runs but does nothing. This usually happens when the configuration file has a typo or the service is not enabled. Check the log at /var/log/yum.log to see if any updates were applied. You can also run the script manually with yum-cron to see any errors.

Another common problem is that the email report never arrives. yum-cron uses the local mail system. If you do not have a mail server like sendmail or postfix installed, the report goes nowhere. You can install a simple mail server, or you can ignore the email and check the log file periodically. Some people set up a cron job to run yum check-update and pipe the output to a logging service instead.

If you see an error about a lock file, it means another yum process is already running. This can happen if you run yum update manually while yum-cron is also running. Wait a few minutes and try again.

Safety and Best Practices

Automatic updates are generally safe, but you should take a few precautions. First, make sure you have a recent backup or a snapshot of the system. If an update breaks something, you want to be able to roll back. Second, test the configuration on a staging server before rolling it out to production. Third, consider setting update_cmd = security on production systems to minimize the chance of a bad non-security update.

Another good practice is to monitor the logs. Even with automatic updates, you should check /var/log/yum.log occasionally to confirm that updates are being applied. If you have a central log server, send the yum log there. Some teams also set up a weekly cron job that runs yum history and emails the summary.

Finally, remember that yum-cron only updates packages from the repositories you have configured. It will not update software installed from source or third-party scripts. You still need a process for updating those separately.

Alternatives to yum-cron

On CentOS 8 and later, dnf-automatic is the direct replacement. It works similarly but uses systemd timers instead of cron. You enable it with systemctl enable --now dnf-automatic.timer.

Another option is to use a configuration management tool like Ansible, Puppet, or Chef. These tools can run yum update on a schedule and also manage other aspects of your servers. They give you more control and visibility, but they are more complex to set up.

Some people prefer to use a third-party tool like Unattended Upgrades, which is more common on Debian/Ubuntu. That is not a direct fit for CentOS, but the idea is the same. You can also write your own cron job that runs yum -y update every night. That is simpler but gives you less control over what gets installed and no built-in email reporting.

Frequently Asked Questions

Will yum-cron automatically reboot my server after updates?

No. yum-cron does not reboot the system. If a kernel update is applied, the running kernel remains the old one until you reboot. You can set up a separate cron job to reboot if a new kernel is installed, but that is risky. Many administrators prefer to reboot manually during a maintenance window.

How do I see what updates were applied?

Run yum history to see a list of past transactions. The most recent transaction will show the updates that yum-cron applied. You can also check /var/log/yum.log for a plain text list of installed packages.

Can I make yum-cron run more than once a day?

Yes. The hourly configuration file is for that purpose. Edit /etc/yum/yum-cron-hourly.conf and set the same options you want. The hourly job is disabled by default, but you can enable it by setting update_cmd to something other than the default. The cron job for it is already in place.

Does yum-cron work with CentOS 8?

No. CentOS 8 uses dnf, so you should use dnf-automatic instead. The package name is dnf-automatic and the configuration file is /etc/dnf/automatic.conf. The service is a systemd timer.

What is the difference between yum-cron and dnf-automatic?

They are essentially the same tool for different package managers. yum-cron is for yum (CentOS 7 and earlier), and dnf-automatic is for dnf (CentOS 8 and later). The configuration options are similar, but the file locations and service names differ.

Related

• Disk Cloning vs Disk Imaging: Key Differences
• Joplin vs Google Keep: Offline-First Notes Explained
• Java to Python: A Practical Developer’s Guide