I'm relatively new at this. Our system just got updated. (we never ask that)

Now, I need to disable auto-updates on CentOS Server 7.5.1804

I see a relevant question here but my system has no packagekit, so the solution does not work for me at least.

What I looking for

Question 1:

A way to disable updates but make sure security updates for the kernel are available

# /etc/yum/yum-cron.conf
#  What kind of update to use:
# default                            = yum upgrade
# security                           = yum --security upgrade
# security-severity:Critical         = yum --sec-severity=Critical upgrade
# minimal                            = yum --bugfix update-minimal
# minimal-security                   = yum --security update-minimal
# minimal-security-severity:Critical =  --sec-severity=Critical update-minimal
update_cmd = default

# Whether a message should be emitted when updates are available,
# were downloaded, or applied.
update_messages = yes

# Whether updates should be downloaded when they are available.
download_updates = yes

# Whether updates should be applied when they are available.  Note
# that download_updates must also be yes for the update to be applied.
apply_updates = yes

Do I have to change either of the following

  • download_updates (yes => no)
  • apply_updates (yes => no)
  • update_cmd (default => security)

To achieve that?

Question 2: If I have to disable an update of the specific packages, do I have to follow the below step?

> vi /etc/yum.conf 
> ## Added this inside yum.conf
> exclude=postgresql

If yes, how I can I be sure that the package name given is the correct one? (Essentially I want to disable postgresql.) i.e whether it is postgresql or postgresql-server or something else

1 Answer 1


Question 1: add includepkgs=kernel* to yum.conf. This will make it so that no packages are ever updated except for your kernel packages. It will also prevent installs of packages not beginning with the kernel, so make sure you've installed everything you need to install before adding this line. Alternatively, you can add this line to individual repo files, and it will only affect that repo.

Question 2: add exclude=postgresql* in the same way as includepkg. This will make it so no packages whose names begin with postgresql can be installed or updated.

  • Setting update_cmd=security will also work, right? May 16, 2018 at 7:23
  • You will want to set update_cmd=security as you write, yes, if your goal is only security updates of only the kernel* packages. Please understand the differences between updates in Enterprise Linux and updates in other linux distros. The risk factor is generally vastly different (although RHEL7/Centos7 are a step back). Be okay with updates that are as frequent as you want -- I've had a fleet of machines in production auto-updating nightly with no issues caused by packaging ... for 16 years. It IS possible. May 28, 2018 at 23:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .