Install dnf-automatic Package
Ensures the dnf-automatic package is installed so security updates can be downloaded and applied automatically on a schedule.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
dnf-automatic is an alternative command-line interface to dnf upgrade suitable for automatic, regular execution, ensuring security updates are applied promptly without manual intervention.
What Pavois checks
Pavois verifies that the dnf-automatic package is present via rpm. Automatic patching closes the window between disclosure and remediation; the package provides the systemd timer that drives it. (Installation makes the capability available, you still configure /etc/dnf/automatic.conf and enable the timer.)
describe package('dnf5-plugin-automatic') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q dnf-automatic, which should return an installed version. Confirm the scheduled run with systemctl is-enabled dnf-automatic.timer (expected enabled) and systemctl list-timers dnf-automatic.timer.
Inspect & investigate
Confirm the package with rpm -q dnf-automatic; automatic update runs are logged via journalctl -u dnf-automatic.service and the timer state via systemctl list-timers.
Remediation
Pavois's harden plan installs the dnf-automatic package (resource package, action install) and is applied with pavois harden apply. After installation, configure /etc/dnf/automatic.conf and enable dnf-automatic.timer so updates actually run.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | dnf5-plugin-automatic |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without automatic updates, hosts stay vulnerable until someone patches manually. Installing the package is non-disruptive. Be aware that enabling unattended apply (rather than download-only) can restart services or, rarely, introduce regressions, on critical systems prefer staged rollouts and maintenance windows, and review /etc/dnf/automatic.conf before enabling apply mode.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R61 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.