Managing System Updates with DNF Plugins on CentOS

Keeping CentOS systems patched is easier when DNF plugins handle repeatable tasks instead of leaving every update to manual commands. Plugins can lock package versions, enable repositories, inspect advisories, and support safer maintenance workflows. Learn more about Regopenkeyexderejisutoriwo Dumi Shukisuru Shou Shun.html.

This approach suits administrators running CentOS Stream 8 or 9 on web servers, virtual machines, and development hosts. The commands below assume a user with sudo access and a working repository configuration.

Australian teams often schedule patching outside Sydney, Melbourne, or Brisbane business hours, while checking the difference between AEST and AEDT. A predictable DNF process helps make an after-hours “arvo” maintenance window shorter and easier to document.

Installing The DNF Plugin Package

The main collection is dnf-plugins-core. It provides commands such as config-manager, repoquery, and versionlock, although the exact plugin set can vary slightly between CentOS releases.

sudo dnf install -y dnf-plugins-core
dnf --version
dnf help

Before changing packages, inspect enabled repositories and refresh their metadata:

sudo dnf repolist --enabled
sudo dnf makecache

On CentOS Stream, repositories can change as packages move through the rolling stream. Confirm that the host uses the intended mirrors and repositories, particularly where an Australian organisation has internal mirrors or must keep workloads within a chosen data-centre region. General Linux administration guides can provide additional background on repository and command-line management.

Controlling Repositories With Config Manager

The config-manager plugin is useful for enabling, disabling, and inspecting DNF repositories without editing .repo files by hand. List repository definitions first:

sudo dnf config-manager --dump
sudo dnf repolist all

To enable a repository, use its exact identifier:

sudo dnf config-manager --set-enabled repository-id

You can disable a repository in the same way:

sudo dnf config-manager --set-disabled repository-id

Avoid enabling random third-party repositories on production machines. Mixing packages from unrelated sources can create dependency conflicts and complicate incident response. For systems supporting Australian government or regulated workloads, record repository changes alongside the server’s change ticket and patch evidence.

Applying Security Updates Safely

DNF can query advisory metadata when the configured repositories publish it. To display available security advisories, run:

sudo dnf updateinfo list security

To apply packages classified as security fixes:

sudo dnf upgrade --security

Some repositories do not expose complete advisory information, so an empty result does not always prove that no vulnerable package exists. Compare the installed package set with your vendor’s security notices and use a full upgrade when appropriate:

sudo dnf upgrade

For scheduled maintenance, the automatic update guide explains a related automation pattern. On current CentOS releases, dnf-automatic and a systemd timer are generally preferable to older yum-cron configurations.

Locking Versions During Change Windows

The versionlock plugin prevents selected packages from changing during routine upgrades. Install it if it is not already available:

sudo dnf install -y python3-dnf-plugin-versionlock

Lock a package after validating the currently installed version:

rpm -q nginx
sudo dnf versionlock add nginx
sudo dnf versionlock list

When the maintenance window ends, remove the lock so the package can receive future fixes:

sudo dnf versionlock delete nginx

Version locks are useful when a kernel module, application release, or Nginx configuration needs compatibility testing first. They should be reviewed regularly; an old lock can silently prevent important security updates from being installed.

Automating And Verifying Maintenance

For unattended updates, install the automation package and inspect its configuration:

sudo dnf install -y dnf-automatic
sudoedit /etc/dnf/automatic.conf

Set the upgrade mode according to your policy, then enable the timer:

sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer

After patching, check for services that need restarting:

sudo dnf needs-restarting
sudo dnf needs-restarting -r

The -r option reports whether a reboot is required, commonly after a kernel or core system library update. Review logs with journalctl, confirm application health, and test monitoring before declaring the change complete. If your team works across Perth and the eastern states, write the maintenance time with its time zone so a daylight-saving change does not create confusion.

A reliable workflow is to make a pre-update snapshot where appropriate, run sudo dnf makecache, review sudo dnf updateinfo list security, apply approved updates, and verify services. Begin that process on one test CentOS host by running sudo dnf install -y dnf-plugins-core.