Ubuntu Pro (canonical/ubuntu-pro-docs)

Ubuntu Pro

https://github.com/canonical/ubuntu-pro-docs
Admin
Ubuntu Pro is a comprehensive subscription for open-source software security and management running...

Tokens:11,014
Snippets:212
Trust Score:9.2
Update:1 week ago
Show doc for...
Context Summary (auto-generated)
Raw
# Ubuntu Pro

Ubuntu Pro is Canonical's comprehensive subscription service for open-source software security and systems management running on Ubuntu LTS. It extends the standard 5-year Ubuntu LTS security lifecycle to 10 years, adds compliance tooling (FIPS, CIS, DISA-STIG), live kernel patching, and enterprise systems management via Landscape — all accessible through a single Pro token. Ubuntu Pro is free for personal and small-scale commercial use on up to 5 machines, with paid tiers for larger commercial deployments.

The service is managed through three portals: the Ubuntu Pro dashboard (token retrieval and subscription management), the Canonical Support Portal (knowledge base and ticket support), and Landscape SaaS (machine fleet management). On each Ubuntu LTS machine, the `ubuntu-advantage-tools` package (providing the `pro` CLI) is the primary interface for attaching subscriptions and enabling or disabling individual services such as ESM, Livepatch, FIPS, and USG.

---

## Install and Update the Ubuntu Pro Client

Ensures the `pro` CLI (`ubuntu-advantage-tools`) is present and up to date before any attach or enable operations.

```bash
# Install or upgrade the Pro client
sudo apt install ubuntu-advantage-tools

# Refresh package index after upgrading the client
sudo apt update
```

---

## Attach a Machine to an Ubuntu Pro Subscription

Connects an Ubuntu LTS machine to a subscription using the token from the Ubuntu Pro dashboard, automatically enabling default services such as ESM Infra and Livepatch.

```bash
# Attach a machine (replace YOUR_TOKEN with the token from ubuntu.com/pro/dashboard)
sudo pro attach YOUR_TOKEN

# Example output:
# Enabling default service esm-infra
# Updating package lists
# Ubuntu Pro: ESM Infra enabled
# Enabling default service livepatch
# Canonical livepatch enabled.
# This machine is now attached to 'Ubuntu Pro - free personal subscription'
#
# SERVICE          ENTITLED  STATUS    DESCRIPTION
# esm-apps         yes       enabled   Expanded Security Maintenance for Applications
# esm-infra        yes       enabled   Expanded Security Maintenance for Infrastructure
# fips             yes       disabled  NIST-certified core packages
# fips-updates     yes       disabled  NIST-certified core packages with priority security updates
# livepatch        yes       enabled   Canonical Livepatch service
# usg              yes       disabled  Security compliance and audit tools
#
# Account: user@example.com
# Subscription: Ubuntu Pro - free personal subscription
```

---

## Check Subscription and Service Status

Displays the current attachment status, which services are entitled, and which are enabled or disabled on the machine.

```bash
# Show full service status table
pro status

# Example output:
# SERVICE          ENTITLED  STATUS       DESCRIPTION
# esm-apps         yes       enabled      Expanded Security Maintenance for Applications
# esm-infra        yes       enabled      Expanded Security Maintenance for Infrastructure
# fips-updates     yes       disabled     FIPS compliant crypto packages with stable security updates
# landscape        yes       enabled      Management and administration tool for Ubuntu
# livepatch        yes       enabled      Canonical Livepatch service
# realtime-kernel* yes       disabled     Ubuntu kernel with PREEMPT_RT patches integrated
# usg              yes       disabled     Security compliance and audit tools
```

---

## Check Security Status and ESM Coverage

Audits installed packages to show how many receive security patches from Ubuntu Main and Universe repositories, and which are covered by ESM services.

```bash
# General security status overview
pro security-status

# Show Universe package coverage under ESM Apps
pro security-status --esm-apps

# Show Main package coverage under ESM Infra
pro security-status --esm-infra
```

---

## Enable a Specific Ubuntu Pro Service

Activates an individual Pro service (e.g., FIPS, USG, Livepatch, Landscape, realtime-kernel) on the attached machine.

```bash
# Enable a service by name (examples: esm-apps, fips, fips-updates, livepatch, usg, landscape, realtime-kernel)
sudo pro enable fips

# After enabling, verify status
pro status
```

---

## Update (Rotate) the Ubuntu Pro Token

Detaches the current token and attaches a new one — required when upgrading or changing subscription tier — while preserving previously enabled services.

```bash
# Step 1: Record currently enabled services before detaching
pro status

# Step 2: Detach old token and attach new token in one command
sudo pro detach && sudo pro attach NEW_TOKEN

# Step 3: Verify that the expected services are still enabled
pro status

# Step 4 (Landscape-registered machines only): restart the Landscape client
sudo systemctl enable landscape-client
sudo systemctl start landscape-client

# For bulk token rotation across many machines, run via Landscape scripts
# or any automation tool (Ansible, Puppet, etc.)
```

---

## Apply All Available Security Updates After Attaching

After attaching a Pro token, runs a full package upgrade to apply all CVE fixes now available from the ESM repositories.

```bash
# Update package lists and apply all available security patches
sudo apt update && sudo apt upgrade
```

---

## Check Livepatch Status

Verifies which live kernel patches have been applied to the running kernel without requiring a reboot, and shows coverage for specific CVEs.

```bash
# Show verbose Livepatch status including patched CVEs
canonical-livepatch status --verbose
```

---

## Enable Landscape via the Pro Client (Self-Hosted, v23.03+)

Registers a machine with a self-hosted Landscape server using the Pro token as the licensing mechanism (requires Landscape ≥ 23.03 and landscape-client ≥ 23.02).

```bash
# Step 1: Ensure machine is already attached to a Pro token
pro status   # confirm "landscape" row shows ENTITLED: yes

# Step 2: Enable Landscape service via the Pro client
sudo pro enable landscape

# Landscape detects the Pro entitlement and creates a licence automatically.
# No license.txt file download needed for this method.
```

---

## Generate a Sosreport for Canonical Support

Collects system logs and configuration data into a portable report to attach to a Canonical Support Portal ticket, accelerating diagnosis.

```bash
# Install the sos tool if not present
sudo apt install sosreport

# Generate a sosreport (saved to /tmp/sosreport-*.tar.xz by default)
sudo sosreport

# Obfuscate sensitive data before sending
sudo sos report --clean

# Upload the report to Canonical via the Support Portal secure transfer service:
# https://support-portal.canonical.com/knowledge-base/sending-files-sts
```

---

## Manage Users on the Ubuntu Pro Dashboard (Portal)

User management is performed through the web dashboard at `ubuntu.com/pro/dashboard`. Each of the three portals (Ubuntu Pro dashboard, Support Portal, Landscape SaaS) has an independent user database.

```
# Ubuntu Pro Dashboard – add a user:
# 1. Open "Billing and users" > "Users"
# 2. Click "+ Add new user"
# 3. Enter name, email, and assign a role:
#    - Administrator: full access (token, users, billing)
#    - Technical contact: token access only
#    - Billing contact: billing/invoices only, no token access

# Ubuntu Pro Dashboard – remove a user:
# 1. Open "Billing and users" > "Users"
# 2. Click "Edit" on the target user, then click the trash bin icon

# Landscape SaaS – invite an administrator:
# 1. Navigate to Administrators > "Invite an administrator"
# 2. Enter name, email, and role; send invitation

# Landscape SaaS – disable a user:
# 1. Navigate to Administrators, select the user, click "Disable"
```

---

## Manage Subscription Seats and Renewal (Online Shop Customers)

Seat counts, renewal settings, payment methods, and cancellation are all managed on the Ubuntu Pro dashboard.

```
# Increase or decrease machine seats:
# Dashboard > select subscription > "Edit subscription" > update quantity

# Disable auto-renewal:
# Dashboard > select subscription > "Renewal settings" > toggle off

# Renew an expired subscription:
# Dashboard > click "Renew subscription"  (or purchase at ubuntu.com/pro/subscribe)

# Cancel a subscription:
# Dashboard > "Edit subscription" > click "You can cancel this subscription online..."
# (subscription remains active until expiry date)

# Update payment method:
# Dashboard > "Billing and users" > "Payment methods" > edit or add card

# Update billing address / VAT number:
# Dashboard > "Billing and users" > "Invoices" > "Edit billing details"
```

---

## Summary

Ubuntu Pro is primarily used by enterprise and government organisations that need long-term security coverage (up to 10 years) for Ubuntu LTS systems, NIST-certified cryptographic modules (FIPS 140-2/140-3), automated compliance hardening against CIS and DISA-STIG benchmarks, and live kernel patching to eliminate unscheduled reboots. It is also adopted by DevOps and cloud teams managing large Ubuntu fleets through Landscape for patch management, remote script execution, hardware/software inventory, and compliance reporting. The free personal tier (up to 5 machines) makes the same security tooling accessible to individual developers and hobbyists.

From an integration standpoint, Ubuntu Pro fits into existing automation pipelines via the `pro` CLI: Ansible playbooks, Puppet manifests, cloud-init user data, and Landscape's remote script execution can all invoke `pro attach`, `pro enable`, and `pro status` to manage subscription state at scale. Airgapped or network-restricted environments are supported through locally mirrored Pro service repositories, configured by following Canonical's Knowledge Base guides. The three customer portals are accessed independently, each authenticated via Ubuntu One SSO, so user provisioning scripts must address the dashboard, Support Portal, and Landscape SaaS separately.