How to Install and Configure Canonical Landscape Client on Ubuntu for Centralised Server Management

Managing multiple Ubuntu servers, edge appliances, and virtual compute instances across hybrid clouds requires substantial operational effort when handling individual SSH sessions for package updates, security CVE audits, and hardware health monitoring. Canonical Landscape is the official systems management tool for Ubuntu that enables automated package provisioning, compliance reporting, security patching, and live fleet telemetry. Enrolling your machines into Landscape via the lightweight landscape-client daemon establishes secure, centralised administration.

Landscape Architecture: SaaS vs Self-Hosted Landscape Server

Before installing the client daemon on your servers, ensure you have access to an operational Landscape management controller:

• Landscape SaaS: Hosted directly by Canonical and included automatically with Ubuntu Pro subscriptions (free for up to 5 personal machines). Accessible at landscape.canonical.com.
• Landscape Self-Hosted: Deployed on-premises using dedicated Ubuntu Server hardware or containerized microk8s clusters for air-gapped or strict regulatory environments.

Installing the landscape-client Daemon on Ubuntu

The Landscape client software is packaged in official Ubuntu repositories across LTS and standard releases.

Update your local package lists and install the package:

sudo apt update
sudo apt install landscape-client

Confirm that the client binary and associated systemd services were installed successfully:

landscape-client --version

Configuring and Registering with Canonical Landscape

To register your Ubuntu node, launch the interactive configuration assistant:

sudo landscape-config

The interactive setup prompts you for essential registration details:

1. Computer title: Enter a human-readable display name for this host (e.g. web-gateway-lon-01).
2. Landscape URL:
   • If using Landscape SaaS, accept the default: https://landscape.canonical.com/message-system.
   • If using self-hosted Landscape, enter your internal server URL: https://landscape.internal.domain/message-system.
3. Account name: Enter your registered Canonical Landscape account name.
4. Registration key: Input your pre-shared account registration secret (generated within the Landscape web dashboard under Settings > Account).
5. SSL CA certificate: If your self-hosted Landscape uses an internal corporate certificate authority, supply the path to the root CA file (e.g. /etc/ssl/certs/internal-ca.pem).
6. HTTP proxy: Specify proxy details if the host routes outbound traffic through a firewall gateway.
7. Access tags: Input comma-separated tags to classify the machine automatically (e.g. production, web, london).

Non-Interactive Registration via Command Line

For automated provisioning scripts, cloud-init user data, or Ansible playbooks, enroll systems non-interactively using explicit command-line flags:

sudo landscape-config --silent \
    --computer-title="db-primary-node" \
    --account-name="mycompany-ops" \
    --registration-key="SecretAuthToken123" \
    --tags="production,database" \
    --url="https://landscape.canonical.com/message-system" \
    --ok-no-register

Enable and start the background client daemon:

sudo systemctl enable landscape-client
sudo systemctl restart landscape-client

Approving Pending Computers in the Landscape Dashboard

To prevent rogue nodes from registering into your management portal, newly connected machines appear in an authorization queue:

1. Sign into your Landscape web management dashboard.
2. Click the Computers tab in the navigation bar.
3. Click Pending computers in the left sidebar.
4. Select the newly enrolled computer and click Accept.

Within several minutes, the client completes its initial inventory scan, transmitting hardware specifications, storage metrics, kernel parameters, and installed package manifests.

Executing Remote Package Updates and Script Profiles

With Landscape client functioning, fleet maintenance can be orchestrated entirely through the web interface:

• Security Updates: Navigate to Packages > Upgrades to review available USN (Ubuntu Security Notice) patches and schedule fleet-wide zero-downtime updates.
• Custom Scripts: Push shell scripts or compliance audits across hundreds of tagged systems simultaneously under Scripts.
• Hardware Monitoring: View real-time graphs displaying CPU load, physical RAM utilisation, network throughput, and temperature readings.

Troubleshooting Client Connections and Logs

If a machine shows as disconnected or fails initial handshake verification, inspect the client system logs:

sudo cat /var/log/landscape/broker.log
sudo cat /var/log/landscape/monitor.log

Check the active registration state directly from the terminal:

landscape-config --is-registered && echo "Node registered" || echo "Not registered"