# Ubuntu Pro Ubuntu Pro is Canonical's comprehensive subscription service for open-source software security and systems management running on Ubuntu LTS. It extends the standard 5-year Ubuntu LTS security lifecycle to 10 years, adds compliance tooling (FIPS, CIS, DISA-STIG), live kernel patching, and enterprise systems management via Landscape — all accessible through a single Pro token. Ubuntu Pro is free for personal and small-scale commercial use on up to 5 machines, with paid tiers for larger commercial deployments. The service is managed through three portals: the Ubuntu Pro dashboard (token retrieval and subscription management), the Canonical Support Portal (knowledge base and ticket support), and Landscape SaaS (machine fleet management). On each Ubuntu LTS machine, the `ubuntu-advantage-tools` package (providing the `pro` CLI) is the primary interface for attaching subscriptions and enabling or disabling individual services such as ESM, Livepatch, FIPS, and USG. --- ## Install and Update the Ubuntu Pro Client Ensures the `pro` CLI (`ubuntu-advantage-tools`) is present and up to date before any attach or enable operations. ```bash # Install or upgrade the Pro client sudo apt install ubuntu-advantage-tools # Refresh package index after upgrading the client sudo apt update ``` --- ## Attach a Machine to an Ubuntu Pro Subscription Connects an Ubuntu LTS machine to a subscription using the token from the Ubuntu Pro dashboard, automatically enabling default services such as ESM Infra and Livepatch. ```bash # Attach a machine (replace YOUR_TOKEN with the token from ubuntu.com/pro/dashboard) sudo pro attach YOUR_TOKEN # Example output: # Enabling default service esm-infra # Updating package lists # Ubuntu Pro: ESM Infra enabled # Enabling default service livepatch # Canonical livepatch enabled. # This machine is now attached to 'Ubuntu Pro - free personal subscription' # # SERVICE ENTITLED STATUS DESCRIPTION # esm-apps yes enabled Expanded Security Maintenance for Applications # esm-infra yes enabled Expanded Security Maintenance for Infrastructure # fips yes disabled NIST-certified core packages # fips-updates yes disabled NIST-certified core packages with priority security updates # livepatch yes enabled Canonical Livepatch service # usg yes disabled Security compliance and audit tools # # Account: user@example.com # Subscription: Ubuntu Pro - free personal subscription ``` --- ## Check Subscription and Service Status Displays the current attachment status, which services are entitled, and which are enabled or disabled on the machine. ```bash # Show full service status table pro status # Example output: # SERVICE ENTITLED STATUS DESCRIPTION # esm-apps yes enabled Expanded Security Maintenance for Applications # esm-infra yes enabled Expanded Security Maintenance for Infrastructure # fips-updates yes disabled FIPS compliant crypto packages with stable security updates # landscape yes enabled Management and administration tool for Ubuntu # livepatch yes enabled Canonical Livepatch service # realtime-kernel* yes disabled Ubuntu kernel with PREEMPT_RT patches integrated # usg yes disabled Security compliance and audit tools ``` --- ## Check Security Status and ESM Coverage Audits installed packages to show how many receive security patches from Ubuntu Main and Universe repositories, and which are covered by ESM services. ```bash # General security status overview pro security-status # Show Universe package coverage under ESM Apps pro security-status --esm-apps # Show Main package coverage under ESM Infra pro security-status --esm-infra ``` --- ## Enable a Specific Ubuntu Pro Service Activates an individual Pro service (e.g., FIPS, USG, Livepatch, Landscape, realtime-kernel) on the attached machine. ```bash # Enable a service by name (examples: esm-apps, fips, fips-updates, livepatch, usg, landscape, realtime-kernel) sudo pro enable fips # After enabling, verify status pro status ``` --- ## Update (Rotate) the Ubuntu Pro Token Detaches the current token and attaches a new one — required when upgrading or changing subscription tier — while preserving previously enabled services. ```bash # Step 1: Record currently enabled services before detaching pro status # Step 2: Detach old token and attach new token in one command sudo pro detach && sudo pro attach NEW_TOKEN # Step 3: Verify that the expected services are still enabled pro status # Step 4 (Landscape-registered machines only): restart the Landscape client sudo systemctl enable landscape-client sudo systemctl start landscape-client # For bulk token rotation across many machines, run via Landscape scripts # or any automation tool (Ansible, Puppet, etc.) ``` --- ## Apply All Available Security Updates After Attaching After attaching a Pro token, runs a full package upgrade to apply all CVE fixes now available from the ESM repositories. ```bash # Update package lists and apply all available security patches sudo apt update && sudo apt upgrade ``` --- ## Check Livepatch Status Verifies which live kernel patches have been applied to the running kernel without requiring a reboot, and shows coverage for specific CVEs. ```bash # Show verbose Livepatch status including patched CVEs canonical-livepatch status --verbose ``` --- ## Enable Landscape via the Pro Client (Self-Hosted, v23.03+) Registers a machine with a self-hosted Landscape server using the Pro token as the licensing mechanism (requires Landscape ≥ 23.03 and landscape-client ≥ 23.02). ```bash # Step 1: Ensure machine is already attached to a Pro token pro status # confirm "landscape" row shows ENTITLED: yes # Step 2: Enable Landscape service via the Pro client sudo pro enable landscape # Landscape detects the Pro entitlement and creates a licence automatically. # No license.txt file download needed for this method. ``` --- ## Generate a Sosreport for Canonical Support Collects system logs and configuration data into a portable report to attach to a Canonical Support Portal ticket, accelerating diagnosis. ```bash # Install the sos tool if not present sudo apt install sosreport # Generate a sosreport (saved to /tmp/sosreport-*.tar.xz by default) sudo sosreport # Obfuscate sensitive data before sending sudo sos report --clean # Upload the report to Canonical via the Support Portal secure transfer service: # https://support-portal.canonical.com/knowledge-base/sending-files-sts ``` --- ## Manage Users on the Ubuntu Pro Dashboard (Portal) User management is performed through the web dashboard at `ubuntu.com/pro/dashboard`. Each of the three portals (Ubuntu Pro dashboard, Support Portal, Landscape SaaS) has an independent user database. ``` # Ubuntu Pro Dashboard – add a user: # 1. Open "Billing and users" > "Users" # 2. Click "+ Add new user" # 3. Enter name, email, and assign a role: # - Administrator: full access (token, users, billing) # - Technical contact: token access only # - Billing contact: billing/invoices only, no token access # Ubuntu Pro Dashboard – remove a user: # 1. Open "Billing and users" > "Users" # 2. Click "Edit" on the target user, then click the trash bin icon # Landscape SaaS – invite an administrator: # 1. Navigate to Administrators > "Invite an administrator" # 2. Enter name, email, and role; send invitation # Landscape SaaS – disable a user: # 1. Navigate to Administrators, select the user, click "Disable" ``` --- ## Manage Subscription Seats and Renewal (Online Shop Customers) Seat counts, renewal settings, payment methods, and cancellation are all managed on the Ubuntu Pro dashboard. ``` # Increase or decrease machine seats: # Dashboard > select subscription > "Edit subscription" > update quantity # Disable auto-renewal: # Dashboard > select subscription > "Renewal settings" > toggle off # Renew an expired subscription: # Dashboard > click "Renew subscription" (or purchase at ubuntu.com/pro/subscribe) # Cancel a subscription: # Dashboard > "Edit subscription" > click "You can cancel this subscription online..." # (subscription remains active until expiry date) # Update payment method: # Dashboard > "Billing and users" > "Payment methods" > edit or add card # Update billing address / VAT number: # Dashboard > "Billing and users" > "Invoices" > "Edit billing details" ``` --- ## Summary Ubuntu Pro is primarily used by enterprise and government organisations that need long-term security coverage (up to 10 years) for Ubuntu LTS systems, NIST-certified cryptographic modules (FIPS 140-2/140-3), automated compliance hardening against CIS and DISA-STIG benchmarks, and live kernel patching to eliminate unscheduled reboots. It is also adopted by DevOps and cloud teams managing large Ubuntu fleets through Landscape for patch management, remote script execution, hardware/software inventory, and compliance reporting. The free personal tier (up to 5 machines) makes the same security tooling accessible to individual developers and hobbyists. From an integration standpoint, Ubuntu Pro fits into existing automation pipelines via the `pro` CLI: Ansible playbooks, Puppet manifests, cloud-init user data, and Landscape's remote script execution can all invoke `pro attach`, `pro enable`, and `pro status` to manage subscription state at scale. Airgapped or network-restricted environments are supported through locally mirrored Pro service repositories, configured by following Canonical's Knowledge Base guides. The three customer portals are accessed independently, each authenticated via Ubuntu One SSO, so user provisioning scripts must address the dashboard, Support Portal, and Landscape SaaS separately.