When you run apt upgrade on Ubuntu, you may see messages like “Receive additional future security updates with Ubuntu Pro” or “N updates could be applied with ESM”. That’s Ubuntu Pro: Canonical’s subscription, which extends security patching beyond the standard coverage. Here’s what it actually covers, and whether your server needs it.

Standard LTS coverage vs ESM

Each Ubuntu LTS release (22.04, 24.04…) gets 5 years of standard security updates for packages in the main repository. Ubuntu Pro adds Expanded Security Maintenance (ESM):

Service Covers Period
esm-infra main packages after standard support ends Extends LTS to 10 years total (12 with the Legacy add-on)
esm-apps universe packages (community-maintained, e.g. many language runtimes, Redis, nginx-extras, and others) During the LTS lifetime and beyond
Livepatch Kernel security fixes without rebooting While subscribed
FIPS, CIS/USG hardening Compliance profiles For regulated environments

The important detail: packages from universe don’t get regular security updates without esm-apps, even on a current LTS. Many common server packages come from universe.

Check your status

pro status
pro security-status          # which installed packages are covered by what
apt list --upgradable | grep -i esm

pro security-status --esm-apps lists universe packages that would receive fixes under Pro.

Cost

  • Free for personal use on up to 5 machines (with an Ubuntu One account).
  • Paid subscriptions for businesses and more machines.

Check Canonical’s current terms for exact conditions.

Attach a server

  1. Get your token from the Ubuntu Pro dashboard (ubuntu.com/pro).
  2. On the server:
sudo pro attach <your-token>
pro status
sudo apt update && sudo apt upgrade

Enable or disable individual services:

sudo pro enable livepatch
sudo pro disable esm-apps
sudo pro detach                # remove the machine from your subscription

Livepatch

Livepatch applies critical kernel fixes in memory, so you can postpone reboots. It’s useful for servers that must stay up. You still need to reboot eventually, to run a fully updated kernel. Livepatch may not be supported on every VPS kernel or environment: check canonical-livepatch status after enabling it. See upgrade the Linux kernel.

Do you need it?

Situation Recommendation
Current LTS, few universe packages Optional: standard updates cover main
Many universe packages (check pro security-status) Worth enabling (free for personal use)
LTS past 5 years (e.g. 18.04, 20.04) and can’t upgrade yet ESM is the way to keep receiving security fixes
Compliance requirements (FIPS, CIS) Ubuntu Pro (paid)

The best long-term option is still to upgrade to a supported LTS release in time. See upgrade Ubuntu to a new release.

Hide the advertisement messages

If you don’t use Pro and want quieter apt output:

sudo pro config set apt_news=false

Combine with automatic security updates for the packages you do get. See automatic security updates.

Ubuntu Pro on VPS.DO servers

VPS.DO offers Ubuntu 20.04, 22.04 and 24.04 images. 20.04 is past its standard support window, so if you run it, either plan an upgrade to 24.04, or attach Ubuntu Pro to keep receiving security fixes in the meantime. On 22.04 and 24.04, check pro security-status to see whether the packages you use come from universe. If they do, the free personal subscription (or a paid one for business use) closes that gap.

Quick reference

Task Command
Status pro status
Coverage pro security-status
Attach sudo pro attach <token>
Enable Livepatch sudo pro enable livepatch
Detach sudo pro detach
Quiet apt news sudo pro config set apt_news=false

Related: Ubuntu VPS and Ubuntu 24.04 initial server setup.

  • Ubuntu
  • Security
  • Updates