How to Enable Ubuntu Pro and Expanded Security Maintenance on Ubuntu

Ubuntu Pro is a comprehensive security and compliance subscription from Canonical that extends the standard Ubuntu support window and adds security coverage for thousands of additional packages beyond the default base operating system. While standard Ubuntu LTS releases receive five years of free security updates for packages in the Main repository, Ubuntu Pro extends this to ten years and adds security patching for packages in the Universe repository, covering over 25,000 additional software packages.

What Ubuntu Pro Provides Beyond Standard Ubuntu

Standard Ubuntu LTS (Long Term Support) releases include free security updates for the approximately 2,300 packages maintained by Canonical in the Main repository. However, the Universe repository — which contains popular software like Node.js, Rails, Django, Redis, Ansible, and thousands of other packages — does not receive guaranteed security patches under the free tier.

Ubuntu Pro addresses this gap by providing:

• Expanded Security Maintenance (ESM) for Infrastructure: Extended security patching for Main repository packages beyond the standard five-year window, covering years six through ten.
• Expanded Security Maintenance (ESM) for Applications: Security patches for Universe repository packages throughout the entire ten-year support period.
• Kernel Livepatch: Apply critical kernel security patches without rebooting. This is essential for servers that require maximum uptime.
• FIPS 140-2/140-3 certified cryptographic modules: Required for organisations handling government or regulated data.
• CIS hardening profiles: Pre-configured security benchmarks from the Centre for Internet Security.
• Landscape management: Canonical’s systems management tool for monitoring and managing Ubuntu deployments at scale.

Ubuntu Pro Pricing and the Free Tier

Canonical offers Ubuntu Pro at no cost for personal and small-scale use:

• Free tier: Up to 5 machines per Ubuntu One account. This includes all Ubuntu Pro features (ESM, Livepatch, etc.) for personal use.
• Paid subscriptions: Required for organisations with more than 5 machines. Pricing is per-machine, per-year, with discounts for volume commitments. Check ubuntu.com/pro for current pricing.
• Ubuntu community members: Recognised Ubuntu community contributors receive an expanded free allocation of up to 50 machines.

How to Check Your Current Ubuntu Pro Status

Before enabling Ubuntu Pro, check whether your system already has it configured:

pro status

This command displays the current status of each Ubuntu Pro service (ESM, Livepatch, FIPS, CIS). If Ubuntu Pro is not attached, it will indicate that the machine is not subscribed.

On Ubuntu 22.04 LTS and later, the pro command-line tool (previously called ua) is pre-installed. On older versions, install it with:

sudo apt update
sudo apt install ubuntu-advantage-tools

Step-by-Step: Enabling Ubuntu Pro

Get Your Ubuntu Pro Token

1. Visit ubuntu.com/pro.
2. Sign in with your Ubuntu One account (or create one for free).
3. Click Get Ubuntu Pro and select the free personal subscription (up to 5 machines) or a paid plan.
4. After subscribing, navigate to your Ubuntu Pro Dashboard.
5. Copy your token. This is a unique alphanumeric string associated with your subscription.

Attach Your Machine to Ubuntu Pro

On the Ubuntu machine you want to protect, run:

sudo pro attach YOUR_TOKEN_HERE

Replace YOUR_TOKEN_HERE with the token from your dashboard. The command contacts Canonical’s authentication service, validates your subscription, and enables all applicable Ubuntu Pro services for your machine.

Expected output:

Enabling default service esm-infra
Enabling default service esm-apps
Enabling default service livepatch
This machine is now attached to 'Ubuntu Pro - free personal subscription'

Verify the Attachment

Run pro status again to confirm all services are active:

pro status

You should see enabled next to ESM Infrastructure, ESM Applications, and Livepatch (if your kernel supports it).

Understanding ESM Security Updates

Once Ubuntu Pro is attached, ESM security updates are delivered through the standard apt package manager. You do not need to change your update workflow:

sudo apt update
sudo apt upgrade

ESM updates appear alongside regular updates. To see which updates are coming specifically from ESM repositories, run:

pro security-status

This command provides a detailed breakdown of which packages on your system have available security fixes, categorised by their source (Main, Universe, ESM).

Enabling Kernel Livepatch

Kernel Livepatch allows you to apply critical kernel security updates without rebooting your server. This is automatically enabled when you attach to Ubuntu Pro on supported kernels.

To check the current Livepatch status:

canonical-livepatch status

If Livepatch was not automatically enabled during attachment, enable it manually:

sudo pro enable livepatch

Livepatch is supported on 64-bit systems running the generic or low-latency kernel. Custom-compiled kernels or very old kernel versions may not be eligible.

Ubuntu Pro on Desktop vs Server

Ubuntu Pro works identically on both desktop and server installations. However, the benefits are most impactful for servers:

• Servers benefit from Livepatch (no reboots), extended security maintenance for server-side applications (Node.js, Python packages, databases), and compliance features (FIPS, CIS).
• Desktops benefit from ESM-Apps coverage for desktop applications from the Universe repository and extended overall security coverage.

Ubuntu Pro for Organisations

Organisations with more than 5 machines need a paid subscription. Additional enterprise features include:

• Landscape: Centrally manage Ubuntu Pro entitlements, package updates, and compliance reporting across hundreds of machines from a single dashboard.
• FIPS-certified packages: Enable FIPS 140-2 or 140-3 validated cryptographic modules for government and regulated industry requirements.
• CIS benchmarks: Apply automated security hardening based on Centre for Internet Security profiles. Enable with sudo pro enable cis.

Detaching a Machine from Ubuntu Pro

If you need to release a machine from your subscription (to reuse the slot on another machine):

sudo pro detach

This removes the machine from your Ubuntu Pro account and disables all Pro services. The machine reverts to standard Ubuntu security update coverage.

Troubleshooting Common Issues

“This Machine Is Already Attached”

If you receive this error, the machine is already subscribed to an Ubuntu Pro account. Run pro status to see which account it is attached to. If you need to switch accounts, detach first with sudo pro detach and then reattach with the new token.

ESM Updates Not Appearing

After attaching, run sudo apt update to refresh your package lists. ESM repositories are added automatically during attachment, but the package cache must be refreshed before new updates become visible.

Livepatch Cannot Be Enabled

Livepatch requires a supported 64-bit kernel. Virtual machines on certain hypervisors, very old kernel versions, or custom-compiled kernels may not be compatible. Run uname -r to check your kernel version and verify it against the Livepatch compatibility documentation.

Token Expired or Invalid

Tokens are tied to your Ubuntu One account and subscription. Log in to your Pro dashboard to generate a new token or verify your subscription status.

Ubuntu Pro transforms a standard Ubuntu installation into an enterprise-grade, compliance-ready platform with a decade of guaranteed security coverage. For personal users, the free five-machine tier provides immediate security benefits with no cost and minimal configuration effort.