SEC.01

The playbook

The run starts read-only: the recon probes decide what happens next. The steps that follow are adapted to the distribution and state found — a real machine is rarely clean.

1. 01reconthe distribution: apt (Debian/Ubuntu) or dnf (RHEL/Fedora/Rocky/Alma)
2. 02reconunattended-upgrades (apt) or dnf-automatic / dnf5-plugin-automatic already installed?
3. 03reconexisting config and where (do not overwrite it without a backup)
4. 04reconautomatic reboot already enabled? security origins present?
5. 05reconupdate timers present and active
6. 06recona package manager is already running (wait rather than kill)
7. 07actInstallverify
8. 08actEnable (Debian/Ubuntu)verify
9. 09actDry run (Debian/Ubuntu)verify
10. 10actConfigure dnf-automatic for security only (RHEL/Fedora)verify
11. 11actEnable the dnf-automatic timer (RHEL/Fedora)verify

SEC.02

What it verifies

Each step ships its own check. The run only moves on when the check passes, so what the recipe reports as done is what is actually on the server.

1. 01verifyInstallVerified bydpkg -s unattended-upgrades 2>/dev/null | grep '^Status' || rpm -q dnf-automatic dnf5-plugin-automatic
2. 02verifyEnable (Debian/Ubuntu)Verified byapt-config dump | grep -cE '^APT::Periodic::(Update-Package-Lists|Unattended-Upgrade) "1";'
3. 03verifyDry run (Debian/Ubuntu)Verified bysystemctl is-active apt-daily.timer apt-daily-upgrade.timer
4. 04verifyConfigure dnf-automatic for security only (RHEL/Fedora)Verified bygrep -hE '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf /etc/dnf/dnf5-plugins/automatic.conf 2>/dev/null
5. 05verifyEnable the dnf-automatic timer (RHEL/Fedora)Verified bysystemctl is-active dnf-automatic.timer dnf5-automatic.timer 2>/dev/null

SEC.03

Guardrails

Non-negotiable instructions the run must respect, whatever it finds on the server.

SEC.04

How a recipe runs in Servor

Servor is zero-knowledge: the platform cannot execute anything on its own. When you launch this recipe, a run reads the reconnaissance, plans the steps and asks for your approval. Each approved command is signed by your browser — with a key the server never sees — then relayed verbatim to the agent, which verifies the signature locally before executing.

SEC.05

Deploy on Servor button

Maintain Automatic security updates or a project that needs it? Put this button in your README or on your site: one click and your users install it on their own server.

SEC.06

More security recipes

1. 01Harden SSHTurns off password login and root password login, keeps keys. Destructive: verify your key access first.
2. 02fail2banfail2ban with the SSH jail on the right port, active and verified.
3. 03UFW firewallUFW: denies incoming by default, allows the real SSH port + chosen ports, with a safety net. Destructive: keeps SSH open.
4. 04CrowdSecCrowdSec collaborative IPS, SSH collections and firewall bouncer.
5. 05ClamAVClamAV antivirus with signatures kept up to date, optional daemon.