Ubuntu Pro and ESM History: What Each LTS Gets After Standard Support

Every Ubuntu LTS release gets five years of free standard security maintenance for the Main repository, then Ubuntu Pro extends security fixes to ten years for Main and Universe through Expanded Security Maintenance (ESM), and the paid Legacy add-on adds five more for a total of fifteen. On Canonical's release cycle page, that puts 14.04 LTS under Legacy coverage until May 2029 and 26.04 LTS under coverage until May 2041.

This post is the release-by-release history of that model: how the original Extended Security Maintenance became Ubuntu Pro, what the Legacy add-on changed, and what each LTS from 14.04 to 26.04 gets and until when, including its FIPS, DISA-STIG and CIS status. Every date and command comes from Canonical's own pages, fetched on 23 October 2026. Where those pages disagree, we say so and name the one we used.

Key takeaways

• Five years free, for Main only. Every LTS gets five years of standard security maintenance for packages in Main, with no subscription. This has been the promise since the first LTS in 2006, according to Canonical's Ubuntu Pro FAQ.
• ESM started as a Main-only extension. The original "Extended Security Maintenance" added five more years of fixes for Main. That stream is now called esm-infra, according to the Pro Client docs.
• Ubuntu Pro widened the scope to Universe. Pro entered public beta on 5 October 2022 and general availability on 26 January 2023. At GA, ESM was renamed Expanded Security Maintenance, and the esm-apps stream began covering Universe for ten years from release.
• Universe coverage starts at 16.04. The ESM page lists Universe as "n/a" for 14.04, and the Pro docs say esm-apps applies from 16.04 LTS onwards.
• The Legacy add-on adds five years. It takes the total to fifteen years, per the release cycle page, and the pricing page says a subscription with Legacy costs 50% more.
• Free for personal use. Ubuntu Pro is free on up to five machines for personal use, or 50 for official Ubuntu Community members, according to the Ubuntu Pro page.
• Interim releases get no Pro. They get nine months of updates, and pro security-status on an interim release prints "Ubuntu Pro is not available for non-LTS releases."
• Compliance status varies by release. On the release cycle page, 22.04 is the only LTS with FIPS 140-3, DISA-STIG and CIS all "Achieved"; 24.04 has FIPS 140-3 "Pending" and 26.04 has all three "Planned".

How did Ubuntu ESM and Ubuntu Pro develop over time?

The short history, using only what Canonical's current pages state:

The original ESM: Main only, five extra years

The Pro Client documentation explains the name change directly. In the earlier version of the subscription, "when security fixes were only guaranteed for packages in the 'main' repository, ESM used to be known as Extended Security Maintenance." It meant "the additional five years of security coverage" after the standard five years, for a total of ten. The docs add that this has "since become known as esm-infra."

That is still the shape of esm-infra today. The ESM page describes the lower-cost "Ubuntu Pro (infra-only)" subscription as the option "which equates to our original ESM offering."

When did ESM start? 12.04 is no longer on the official pages

The topic of when ESM first shipped comes up often, and the usual answer is Ubuntu 12.04 LTS. We could not confirm that from the current official pages. The release cycle page, the ESM page and the Pro documentation all start their tables at 14.04 LTS. The only place 12.04 still appears on the ESM page is in the contact form, under "Outdated or non-LTS releases." The 12.04 release notes say only that the release "is no longer supported." So in this post, the history table begins with 14.04, and we say "not stated on the current official pages" for the 12.04 ESM dates rather than fill them in from memory.

Ubuntu Advantage: the old name you still see on 14.04

On 14.04 the subscription still goes by its earlier name. The Trusty legacy guide says: "on Trusty, Ubuntu Pro is referred to by its previous name: 'Ubuntu Advantage' (or ua)." The client package there is ubuntu-advantage-tools and the command is ua. On later releases the client is pro, shipped in the ubuntu-pro-client package, according to the ESM how-to. The Pro attach tutorial still tells you to install ubuntu-advantage-tools, so expect to see both package names in Canonical's own docs.

The same guide says the Trusty client "is almost frozen" at version 19.7, with only critical fixes or Trusty features "like esm-infra-legacy in 2024."

Ubuntu Pro: beta in October 2022, GA in January 2023

The Ubuntu Pro FAQ, posted by Canonical on Ubuntu Discourse, gives both dates: Pro "was launched in public beta on 5 October, 2022, and moved to general availability on 26 January, 2023." The Pro Client docs say the same thing less precisely: when Pro "went into General Availability in early 2023 and became available to all, ESM became Expanded Security Maintenance."

Three things changed at GA:

1. Scope. Universe packages got "the same security maintenance commitment from Canonical as packages in Ubuntu Main," according to the ESM page. Before Pro, Universe had no commitment from Canonical, only "best-effort maintenance" from Canonical and the community.
2. Advisories. The FAQ says that with the GA release "we started publishing Ubuntu Security Notices (USNs) for packages in the 'Universe' repository." If your scanner or advisory feed started showing many more Ubuntu notices in 2023, this is why. Our guide on subscribing to Ubuntu and Debian security advisories covers the feeds.
3. APT messages. APT and Software Updater began listing updates "available with an Ubuntu Pro subscription" next to the ones you can install. The FAQ says these messages appear only when a package on your machine has a fix in Pro.

The FAQ also stresses what did not change: the free LTS still gets five years of Main updates, and Pro "doesn't take anything away from Ubuntu LTS."

The free personal tier

Canonical's pages describe the free tier in slightly different words:

The common ground is five machines for personal use.

The Legacy add-on: five years now, two in older docs

The Legacy add-on covers the years after the ten-year ESM window. Today, the release cycle page says: "At the end of the 10 year ESM period, the Legacy add-on can be purchased to cover additional 5 years of the lifetime of Ubuntu LTS, giving a total of 15 years security maintenance and support." The Ubuntu Pro page and the Livepatch page say the same.

Two older Canonical documents describe a shorter extension. The Trusty legacy guide says esm-infra-legacy grants "an additional two years of extended security coverage," and the Pro FAQ, last edited on 6 June 2025, still mentions "additional 2 year legacy extensions for industrial use cases." The current release cycle and ESM pages, however, list Legacy coverage for 14.04 to May 2029, five years after its May 2024 ESM end. We use the release cycle page's five years throughout this post.

On price, the pricing page states that an "Ubuntu Pro subscription with Legacy price is 50% more" and describes the add-on as "an additional five years of security maintenance and support, extending total coverage to 15 years."

What does each Ubuntu LTS get, and until when?

This is the master table, taken from the release cycle page on 23 October 2026. "Standard" is free Main coverage. "ESM" is Ubuntu Pro. "Break/bug" is the support column for Ubuntu Pro + Support. "Legacy" is the add-on.

The release cycle page marks 14.04 and 16.04 as "With legacy add-on" in their ESM columns, which is its way of saying that, in October 2026, the only coverage left for those releases is Legacy. It marks 20.04, 18.04, 16.04 and 14.04 as "With Ubuntu Pro" in the standard column, meaning standard support has ended and coverage continues only through Pro.

The ESM page has a matching "security maintenance schedule" table with the same months, labelled "End of Standard Support," "End of Ubuntu Pro Support" and "End of Legacy add-on coverage." It does not yet list 12.04.

Per-release coverage: Main, Universe, Livepatch and architectures

The ESM page has a second table, "What is covered?", which adds the repositories, the Livepatch architectures and the ESM architectures for each release:

Read the dates carefully. The "covered until" dates in this table are the Legacy add-on end dates, not the ESM end dates. With a standard Pro subscription and no Legacy add-on, 22.04 is covered to May 2032, not May 2037. 26.04 is not in this table yet. The 26.04 post notes that the 26.04 release adds ARM64 support for Livepatch.

A third set of dates in the Pro docs

The Pro documentation page "What is included in Ubuntu Pro?" has its own "Patched Until" table: 14.04 April 2024 (Main only), 16.04 April 2026, 18.04 May 2028, 20.04 April 2030, 22.04 April 2032 and 24.04 April 2034 (all Main and Universe). Four of those are a month earlier than the release cycle page. We use the release cycle page, because it is Canonical's dedicated lifecycle page and it matches the ESM page, and flag the difference here so nobody is surprised by an audit question.

What changed in Pro coverage from one LTS to the next?

Each LTS has picked up something the previous one did not. This table compares each release with the LTS before it, using the ESM page, the release cycle page and the Pro docs.

For what each release shipped, see the series posts on 20.04 LTS, 22.04 LTS, 24.04 LTS and 26.04 LTS. The hub page lists every release, and the lifecycle explainer covers HWE kernels and flavours.

What does Ubuntu Pro include?

The Ubuntu Pro page and the Pro docs list the components. The Pro docs give a side by side of the two subscription types:

So the only line that separates infra-only from full Pro is Universe coverage.

ESM: esm-infra and esm-apps

The ESM page defines the two streams. "The 'esm-apps' stream covers all 'Universe' packages for ten years from the release of the LTS." "The 'esm-infra' stream covers 'Main' packages for the period after the standard five year security maintenance of 'Main' packages ends." Our explainer on whether Ubuntu patches Universe packages goes deeper on the split, so here we only add the release history details above.

What ESM fixes is set by severity. The pages do not agree word for word:

• The Ubuntu Pro page says ESM covers "critical, high and selected medium vulnerabilities across the whole Ubuntu archive, as defined by Ubuntu Priority."
• The ESM page says ESM "continues security updates and kernel livepatching for high and critical CVEs," and elsewhere lists "quick fixes to critical, high, and selected medium CVEs."
• The release cycle page says "critical and high security patches."
• The FAQ says the security team "prioritises critical and high CVEs" and will "also tackle selected medium CVEs," and that enterprise customers can sponsor additional medium fixes, which Canonical does not withhold.

The safe reading is: critical and high are the commitment, some mediums are fixed, and low priority issues usually are not. The severity here is Ubuntu's own priority, not CVSS, which our post on Ubuntu priority versus CVSS explains.

How big are Main and Universe?

Canonical gives several figures, and they do not match:

None of the pages explains the difference. If you need one number, use the only dated one (36,000 as of 24.04) and cite it.

Kernel Livepatch

The Livepatch page describes it as patching "critical and high severity Linux kernel vulnerabilities" while the system runs, with coverage "for 10 years with Ubuntu Pro, and an additional five years with Ubuntu Pro's Legacy add-on." The Pro docs add an important caution: you "should also use the normal update tools to install all available standard updates to the Linux kernel, including lower severity vulnerabilities or vulnerabilities that cannot be live patched." Livepatch on-prem exists for air-gapped networks. Our Livepatch post covers what still needs a reboot.

Two limits from the Livepatch how-to: on an unsupported kernel "you will not receive any updates from Livepatch," and pro status shows the service as "n/a" where it cannot run, such as in a container, per the status explainer.

FIPS 140-2 and 140-3

From the Pro docs: "Canonical has FIPS 140-2 modules for Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS. We have FIPS 140-3 modules for Ubuntu 22.04 LTS and are in the process of obtaining FIPS 140-3 modules for 24.04 LTS." The FIPS page says "FIPS 140-2 will be sunsetted in September 2026," and that existing FIPS 140-2 installs stay security maintained for the lifetime of those releases. The release cycle page shows FIPS 140-2 as "Expired" on 16.04, 18.04 and 20.04.

There are two streams. fips holds the exact packages NIST validated; fips-updates holds the validated modules with security fixes applied after validation. The FIPS how-to now recommends fips-updates instead of fips for new enablements, and says "Jammy Jellyfish (22.04) and later releases will not have the legacy fips service available." Enabling either installs a FIPS kernel and needs a reboot, so plan it for a maintenance window.

Ubuntu Security Guide, CIS and DISA-STIG

The USG docs describe USG as "a new tool available with Ubuntu 20.04 LTS" for hardening and auditing against the CIS benchmark and DISA-STIG. The Pro docs say USG supports CIS on 20.04, 22.04 and 24.04 and DISA-STIG on 20.04 and 22.04, and that 16.04 and 18.04 use the older CIS hardening tool.

There are two inconsistencies to know about. First, the release cycle page shows DISA-STIG "Achieved" for 24.04, 18.04 and 16.04, while the Pro docs list USG DISA-STIG tooling only for 20.04 and 22.04. "Achieved" on the release cycle page may refer to a published benchmark rather than USG automation, but the page does not define it. Second, the which services page says the separate cis service "can be used up to (and including) 20.04 LTS," while the CIS how-to says "On Ubuntu 20.04 LTS (Focal) and later releases, CIS was replaced by USG." On 20.04, use usg.

Landscape, Common Criteria and support

• Landscape is the fleet management tool included with Pro. The which services page says it "can manage up to 40,000 Ubuntu machines with a single interface."
• Common Criteria EAL2 tooling is available as cc-eal; the same page says "The Ubuntu 18.04 LTS and 16.04 LTS have both been certified."
• Ubuntu Pro + Support is a separate paid tier. The Ubuntu Pro page describes it as 24/7 "break fix and bug fix support." The release cycle page's "Break/bug support" column tracks how long it runs for each LTS.

What Ubuntu Pro does not cover

From the same pages, these are outside Pro's security commitment:

• Interim releases. "Ubuntu Pro is not available for non-LTS releases," per the security-status explainer.
• Third-party packages and PPAs. pro security-status counts them separately; the docs describe them as "not provided by the official Ubuntu archive."
• Packages "no longer available for download." These are also counted separately, and nothing patches them.
• Your application dependencies. Packages you install with npm, pip, Maven, Go modules, Cargo or similar never pass through the Ubuntu archive, so no Ubuntu Pro stream patches them.

How do you attach a machine and check what is enabled?

Every command in this section comes from Canonical's Pro Client documentation or Pro docs, linked at each step.

Step 1: Update the Pro client

From the ESM how-to, which says all systems come with pro preinstalled through ubuntu-pro-client:

sudo apt update && sudo apt install ubuntu-pro-client

Step 2: See where your packages come from, before attaching

The security-status explainer shows this works on an unattached machine. It counts packages by Main/Restricted, Universe/Multiverse, third party and "no longer available for download," and tells you how many pending updates Pro would bring:

pro security-status
pro security-status --esm-infra
pro security-status --esm-apps
pro security-status --thirdparty

On an LTS past standard support without esm-infra, the output says: "This machine is NOT receiving security patches because the LTS period has ended and esm-infra is not enabled." That one line is the fastest audit you can run on an old server.

Step 3: Attach

From the attach how-to. Run the command, open the link it prints, enter the code and choose a subscription. The free personal token is selected by default.

sudo pro attach

The Pro docs tutorial shows the token form, using the token from the Pro dashboard:

sudo pro attach [YOUR_TOKEN]

By default, attaching enables the recommended services: esm-apps, esm-infra and livepatch in the docs' example output. To attach without auto-enabling anything:

sudo pro attach --no-auto-enable

Step 4: Check what is enabled

From the status explainer. Attached output shows SERVICE, ENTITLED, STATUS and DESCRIPTION; STATUS is enabled, disabled or n/a. Hidden "n/a" rows appear with the all flag.

pro status
pro status --all

Step 5: Enable or disable individual services

From the ESM how-to, the Livepatch how-to, the FIPS how-to and the CIS/USG how-to:

sudo pro enable esm-infra
sudo pro enable esm-apps
sudo pro enable livepatch
sudo canonical-livepatch status
sudo pro enable usg
sudo pro enable fips-updates

Only enable fips-updates on machines that must meet FIPS; the docs say disabling FIPS "is not recommended" and the enable step requires a reboot into the FIPS kernel. Disabling a service with pro disable removes the APT sources but leaves installed packages in place.

Step 6: Install the ESM updates you just unlocked

The ESM how-to warns that on 14.04 and 16.04 especially "you may see a number of package updates available that were not available previously," even on a system that said it was up to date:

sudo apt upgrade

ESM packages are pinned to win. The About ESM page says the client installs /etc/apt/preferences.d/ubuntu-pro-esm-infra and /etc/apt/preferences.d/ubuntu-pro-esm-apps, so APT and unattended-upgrades always pick the highest ESM version, "even if the PPA version is higher." If you rely on a PPA build of a package that also exists in ESM, check which version you get after attaching. Our post on unattended-upgrades settings covers the automatic side.

Step 7: Check and fix a specific CVE

From the pro fix how-to, which uses CVE-2020-25686 in dnsmasq as its example. The command describes the CVE, lists affected installed packages, says where the fix is (standard updates or ESM), applies it and confirms whether the CVE is resolved:

sudo pro fix CVE-2020-25686

The docs also describe a dry run mode that shows what the command would change before it changes anything. Use that first on production. Livepatch has its own check for whether a kernel CVE has been live patched, per the Pro docs:

canonical-livepatch status --verbose

On 14.04 only: the ua client and esm-infra-legacy

From the Trusty legacy guide. After buying the Legacy add-on, refresh the contract, confirm entitlement, then enable:

sudo apt update && sudo apt install ubuntu-advantage-tools
sudo ua refresh
sudo ua status
sudo ua enable esm-infra-legacy

The guide notes that disabling esm-infra also disables esm-infra-legacy, and that a do-release-upgrade from 14.04 fails if packages are installed from esm-infra unless you allow third-party sources, after which you re-enable Pro services by hand on 16.04.

When should you pay for ESM, upgrade, or retire?

ESM buys time; it does not make an old release new. Here is a decision table built from the coverage facts above:

Two constraints shape the upgrade route. The Server upgrade guide says "You can only upgrade from one LTS release directly to the next sequential LTS release," and LTS to LTS upgrades "are only available after the first point release." So an 18.04 machine has three upgrades ahead of it to reach 24.04, each with its own testing. The same guide gives the commands:

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
sudo do-release-upgrade

Our general framework for upgrade, extend, isolate or retire applies here, and the post on checking whether a base image OS is end of life covers containers.

Common mistakes

• Reading the ESM coverage table as ESM end dates. On the ESM page's "What is covered?" table, the dates are Legacy add-on end dates. 22.04 ESM ends May 2032, not May 2037.
• Assuming standard support covers Universe. It covers Main. Universe has had a Canonical commitment only through esm-apps since Pro's GA in January 2023.
• Expecting Universe coverage on 14.04. The ESM page lists it as "n/a"; esm-apps starts at 16.04.
• Attaching Pro and not running an upgrade. Attaching adds sources. Run sudo apt upgrade, or let unattended-upgrades do it, to actually install the backlog.
• Treating Livepatch as a replacement for kernel updates. The Pro docs say to keep installing standard kernel updates and reboot into them eventually.
• Enabling FIPS on every machine. The docs recommend it only for machines intended for FIPS, and recommend fips-updates over fips.
• Forgetting the PPA pin. ESM versions beat higher PPA versions after you attach, which can change what a box runs.
• Counting on Pro for application dependencies. It patches the Ubuntu archive. Your lockfiles are yours.
• Leaving interim releases in production. There is no Pro for them at any price.

FAQ

Is Ubuntu Pro free?

For personal use, yes: free on up to five machines, or 50 for official Ubuntu Community members, according to the Ubuntu Pro page. The FAQ says the personal tier also covers any business you own, on up to five physical machines with unlimited VMs and containers. Commercial fleets need a paid subscription.

What is the difference between ESM and Ubuntu Pro?

ESM is one service inside Ubuntu Pro. Pro also includes Livepatch, FIPS modules, USG hardening, Landscape and more. ESM itself has two streams: esm-infra for Main after year five and esm-apps for Universe from release.

When did Ubuntu Pro become generally available?

On 26 January 2023, after a public beta that began on 5 October 2022, according to the Ubuntu Pro FAQ.

Is Ubuntu 16.04 still supported in 2026?

Only with the Legacy add-on. Its ESM ended in May 2026, and Legacy coverage runs to May 2031, per the release cycle page.

Is Ubuntu 14.04 still getting security updates?

Only with the Legacy add-on and the esm-infra-legacy service, until May 2029. Universe packages on 14.04 are not covered.

How long is Ubuntu 24.04 supported with Ubuntu Pro?

Standard support to May 2029, ESM to May 2034 and the Legacy add-on to May 2039. 24.04 has DISA-STIG and CIS "Achieved" and FIPS 140-3 "Pending" on the release cycle page.

Does Ubuntu Pro work on interim releases like 26.10?

No. The Pro Client docs say "Ubuntu Pro is not available for non-LTS releases." 26.10 is supported until July 2027.

How do I check if my Ubuntu machine is still getting security updates?

Run pro security-status. It states whether Main is covered and until when, whether esm-infra and esm-apps are enabled, and how many installed packages fall outside Ubuntu's coverage.

Fix it without waiting for upstream

An Ubuntu Pro subscription keeps the archive patched on an old LTS, but it stops at the archive. The npm, PyPI, Maven, Go and Rust dependencies inside your services, and the third-party packages that pro security-status counts separately, are never in an ESM stream, and that gap gets wider the longer a release lives on.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

Safeguard scans repositories, container images and SBOM files and matches the components it finds against vulnerability databases, so an image built on an Ubuntu base shows which OS packages and versions it carries next to your application dependencies:

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard scan --sbom sbom.json

Results are written as JSON under ./output, and the platform shows every project that contains a given component and version. That makes it easier to find which images still sit on 18.04 or 20.04 bases while you plan the move. Safeguard does not attach machines to Ubuntu Pro, deliver ESM packages or patch the host kernel; that stays with Canonical's archive, ESM and Livepatch.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. This is the application layer that ESM never reaches, on a server you keep alive with Pro.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. If you run long-lived LTS hosts under ESM, one of them can act as the runner, so repositories and images are scanned inside your own network. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once connected, you can ask Claude which of your projects still carry a component version you are tracking, for example while you work out which services need to move off an LTS before its ESM date.

Click through it at your own pace, or open it full screen.

To try it yourself, download Safeguard from safeguard.sh/download and follow the CLI docs.

Quick check

Sources

• Ubuntu: Ubuntu Pro
• Ubuntu: Expanded Security Maintenance
• Ubuntu: Release cycle
• Ubuntu: Livepatch
• Ubuntu: Ubuntu Pro pricing
• Ubuntu: FIPS compliance with Ubuntu Pro
• Ubuntu: Ubuntu Security Guide documentation
• Ubuntu Discourse: Ubuntu Pro FAQ
• Ubuntu Pro documentation
• Ubuntu Pro documentation: What is included in Ubuntu Pro?
• Ubuntu Pro documentation: Attach a machine to your subscription
• Ubuntu Pro Client documentation
• Ubuntu Pro Client documentation: About ESM, esm-apps and esm-infra
• Ubuntu Pro Client documentation: Which services are for me?
• Ubuntu Pro Client documentation: How to attach a machine
• Ubuntu Pro Client documentation: How to manage ESM services
• Ubuntu Pro Client documentation: How to manage Livepatch
• Ubuntu Pro Client documentation: How to manage FIPS
• Ubuntu Pro Client documentation: How to enable CIS or USG
• Ubuntu Pro Client documentation: How to enable esm-infra-legacy on Trusty
• Ubuntu Pro Client documentation: The pro status output explained
• Ubuntu Pro Client documentation: What does security-status do?
• Ubuntu Pro Client documentation: How to resolve a specific CVE or USN
• Ubuntu Server documentation: How to upgrade your Ubuntu release
• Ubuntu release notes: Ubuntu 12.04 LTS

Last reviewed: 23 October 2026.