UBUNTU-PRO(1)

💖 Ubuntu Pro ✨ (UBUNTU-PRO(1)) ✨

👑 NAME

pro - Manage Ubuntu Pro services from Canonical 💅

🧚 SYNOPSIS

pro [-h] [--debug] [--version] <command> ...

🌸 DESCRIPTION

Okay so Ubuntu Pro is a bundle of services that Canonical offers to Ubuntu users 🫶 The Ubuntu Pro command line tool is how you attach a system to an Ubuntu Pro contract, and then turn services on and off from Canonical whenever you want ✨ The commands and services get the full breakdown further down, so keep scrolling bestie 🦋

✨ OPTIONS ✨

• -h, --help — Shows help for pro, or for whichever pro command you name 🙈
• --debug — Sends all the debugging logs straight to the console 🔍
• --version — Shows the Pro Client version and then exits 🎀

🎀 COMMANDS 🎀

🌈 api

api [-h] [--show-progress] [--args [OPTIONS ...]] [--data DATA] endpoint

This one calls the Client API endpoints 💜

If you want the full list of supported endpoints and how each one is structured, check out the Pro Client API reference guide: https://canonical-ubuntu-pro-client.readthedocs-hosted.com/en/latest/references/api/ 📚

🔥 attach

attach [-h] [--no-auto-enable] [--attach-config ATTACH_CONFIG] [--format {cli,json}] [token]

This is how you attach your machine to an Ubuntu Pro subscription 💅 Grab your token from https://ubuntu.com/pro/dashboard and you're giving main character energy ✨

No token? No stress. Running it without one gives you a short code and prompts you to attach the machine through a web browser, using your Ubuntu Pro account 🌸

The attach-config option lets you point to a file that holds the token and, if you want, a list of services to enable right after attaching 🫶 Want the deets? Visit https://canonical-ubuntu-pro-client.readthedocs-hosted.com/en/latest/howtoguides/how_to_attach_with_config_file/ 🦋

The exit codes go like this:

• 0: attach was successful 🎉
• 1: something went wrong while trying to attach 💀
• 2: the machine is already attached 🙈

🧁 auto-attach

auto-attach [-h]

Automatically attaches an Ubuntu Pro cloud instance, no fuss 🍓

🔍 collect-logs

collect-logs [-h] [-o OUTPUT]

This gathers logs and relevant system information and packs it all into a tarball 📦 Super useful later for triaging or debugging issues, so you can thank yourself future bestie 💜

🛡️ cve

cve [-h] cve

Shows all the available info about a given CVE 👀

📋 cves

cves [-h] [--unfixable] [--fixable]

Lists the CVE vulnerabilities that affect your system. It's giving security check ✨

⚙️ config

config [-h] {show,set,unset} ...

This one manages the Ubuntu Pro Client configuration on your machine 🎀 It has three subcommands:

• show — show [-h] [key]: Shows the customizable configuration settings 🌷
• set — set [-h] key_value_pair: Sets and applies Ubuntu Pro configuration settings 💖
• unset — unset [-h] key: Unsets an Ubuntu Pro configuration setting and restores its default value 🔄

👋 detach

detach [-h] [--assume-yes] [--format {cli,json}]

Detaches this machine from an Ubuntu Pro subscription. Bye bye for now 🥲

🚫 disable

disable [-h] [--assume-yes] [--format {cli,json}] [--purge] service [service ...]

Disables one or more Ubuntu Pro services 💅

✅ enable

enable [-h] [--access-only] [--assume-yes] [--auto] [--beta] [--format {cli,json}] [--variant VARIANT] [service ...]

This activates and configures your machine's access to one or more Ubuntu Pro services 🚀

🔧 fix

fix [-h] [--dry-run] [--no-related] security_issue

This one inspects and resolves Common Vulnerabilities and Exposures (CVEs) and Ubuntu Security Notices (USNs) on your machine 🛡️ Such a glow-up for your security 😭

The exit codes go like this:

• 0: the fix was applied successfully, or the system isn't affected 🫶
• 1: the fix can't be applied 😬
• 2: the fix was applied but needs a reboot before it takes effect 🔁

📖 help

help [-h] [--format {tabular,json,yaml}] [--all] [service]

Gives you the detailed tea on Ubuntu Pro services 🍵

🔄 refresh

refresh [-h] [{contract,config,messages}]

This refreshes three different Ubuntu Pro related artifacts on your system 💫 Here's what each one does:

• contract — Updates the contract details from the server 📝
• config — Reloads the config file ⚙️
• messages — Updates the APT and MOTD messages related to Pro 💬

You can target any one of those three actions by passing its name to the command 🎯 If you don't name a target, all three get refreshed, so no one gets left behind 💜

✨ SERVICES ✨

Okay so, Anbox Cloud is lowkey the wildest one bestie 🤯 You can stream mobile apps securely, at any scale, to any device, so you can focus on your apps 📱💖 It runs Android in system containers on public or private clouds with ultra low streaming latency. When the anbox-cloud service is enabled, the Appliance variant is turned on by default. Enabling it lets orchestration provision a PPA with the Anbox Cloud resources, and it also sets up the Anbox Management Service (AMS) with the image server credentials it needs 🧚

To learn more, check out https://anbox-cloud.io ✨

🎀 Common Criteria EAL2 Provisioning (cc-eal) 🎀

Common Criteria is an Information Technology Security Evaluation standard (ISO/IEC IS 15408) for computer security certification 🔐 Ubuntu 16.04 got evaluated to assurance level EAL2 through CSEC. The evaluation ran on Intel x86_64, IBM Power8 and IBM Z hardware platforms. Iconic 👑

🦋 CIS Audit (cis)/Ubuntu Security Guide (usg) 🦋

Ubuntu Security Guide is a tool for hardening and auditing, and it lets you make environment-specific customizations 🛡️ It enables compliance with profiles such as DISA-STIG and the CIS benchmarks. Find out more at https://ubuntu.com/security/certifications/docs/usg 💅

🌸 Expanded Security Maintenance for Infrastructure (esm-infra) 🌸

Expanded Security Maintenance for Infrastructure gives you access to a private PPA with the available high and critical CVE fixes for Ubuntu LTS packages in the Ubuntu Main repository. That covers the stretch between the end of standard Ubuntu LTS security maintenance and its end of life 🙌 It is enabled by default with Ubuntu Pro.

You can find out more about the service at https://ubuntu.com/security/esm ✨

💜 Expanded Security Maintenance for Applications (esm-apps) 💜

Expanded Security Maintenance for Applications is enabled by default on entitled workloads 🫶 It gives you access to a private PPA with the available high and critical CVE fixes for Ubuntu LTS packages in the Ubuntu Main and Ubuntu Universe repositories, from the Ubuntu LTS release date until its end of life.

You can find out more about the esm service at https://ubuntu.com/security/esm 🌈

🔥 FIPS 140-2 certified modules (fips) 🔥

This installs FIPS 140 crypto packages for FedRAMP, FISMA and compliance use cases 📋 Heads up though: fips does not provide security patching. If you want FIPS certified modules with security patches, look at fips-updates. If you're unsure, go with fips-updates for maximum security 🔒

Find out more at https://ubuntu.com/security/fips 💖

🍓 FIPS 140-2 certified modules with updates (fips-updates) 🍓

fips-updates installs FIPS 140 crypto packages, including all the security patches for those modules that have been provided since their certification date 🍒

You can find out more at https://ubuntu.com/security/fips 🎀

🧚 Landscape (landscape) 🧚

You can install the Landscape Client on this machine and enroll it in Canonical's Landscape SaaS at https://landscape.canonical.com, or in a self-hosted Landscape at https://ubuntu.com/landscape/install 🖥️

Landscape lets you manage many machines as easily as one, with an intuitive dashboard and API interface for automation, hardening, auditing, and more. It's giving organized 🗂️

Find out more about Landscape at https://ubuntu.com/landscape ⭐

⭐ Livepatch Service (livepatch) ⭐

Livepatch delivers selected high and critical kernel CVE fixes, plus other non-security bug fixes, as kernel livepatches 🩹 Livepatches get applied without rebooting the machine, which drastically cuts down the need for unscheduled reboots 😭 Because of how FIPS compliance works, livepatches cannot be enabled on FIPS-enabled systems.

You can find out more about the Ubuntu Kernel Livepatch service at https://ubuntu.com/security/livepatch 💅

🤖 ROS ESM Security Updates (ros) 🤖

ros gives you access to a private PPA with security-related updates, including the available high and critical CVE fixes for Robot Operating System (ROS) packages 🦾 To get access to ROS ESM and its security updates, the esm-infra and esm-apps services get enabled too. If you want the non-security updates as well, enable ros-updates.

You can find out more about the ROS ESM service at https://ubuntu.com/robotics/ros-esm 🌟

🌈 ROS ESM All Updates (ros-updates) 🌈

ros-updates gives you access to a private PPA with non-security-related updates for Robot Operating System (ROS) packages 🧃 For full access to ROS ESM, meaning security and non-security updates, the esm-infra, esm-apps, and ros services will also be enabled.

You can find out more about the ROS ESM service at https://ubuntu.com/robotics/ros-esm 💜

---

✨ CONFIGURATION SETTINGS ✨

Okay these are the settings you can tweak, bestie 🥰 Heads up, a few of them are marked deprecated, so don't use those ones for new stuff 🙈

• http_proxy — If you set this, pro will use the specified http proxy for any http requests 🌐
• https_proxy — If you set this, pro will use the specified https proxy for any https requests 🔐
• apt_http_proxy [DEPRECATED] — If you set this, pro configures apt to use the specified http proxy by writing an apt config file to /etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy. (Please use global_apt_http_proxy instead 💅)
• apt_https_proxy [DEPRECATED] — If you set this, pro configures apt to use the specified https proxy by writing an apt config file to /etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy. (Please use global_apt_https_proxy instead 💅)
• global_apt_http_proxy — If you set this, pro configures apt to use the specified http proxy by writing an apt config file to /etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy. Set this if you want a global proxy for all resources, not just the ones from esm.ubuntu.com 🌍
• global_apt_https_proxy — If you set this, pro configures apt to use the specified https proxy by writing an apt config file to /etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy. Set this if you want a global proxy for all resources, not just the ones from esm.ubuntu.com 🌍
• ua_apt_http_proxy — If you set this, pro configures apt to use the specified http proxy by writing an apt config file to /etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy. This proxy is limited to accessing resources from esm.ubuntu.com 🔒
• ua_apt_https_proxy — If you set this, pro configures apt to use the specified https proxy by writing an apt config file to /etc/apt/apt.conf.d/90ubuntu-advantage-aptproxy. This proxy is limited to accessing resources from esm.ubuntu.com 🔒
• <job_name>_timer — Sets the timer running interval for a specific job. Those intervals get checked every time the systemd timer runs ⏰
• apt_news — If you set this to false, the Pro client stops displaying apt news messages in the output of apt upgrade 🙅‍♀️
• apt_news_url — Sets the url where the Pro client pulls its apt news information from 📰

If you need to authenticate to the proxy server, you can put the username and password right in the URL itself, like this:

  http_proxy: http://<username>:<password>@<fqdn>:<port>

---

✨ PRO UPGRADE DAEMON ✨

Okay so the Ubuntu Pro client sets up a daemon on supported platforms (currently Azure and GCP) to detect whether an Ubuntu Pro license has been purchased for the machine 👀 If one is detected, the machine gets attached automatically 🪄 If you're totally uninterested in Ubuntu Pro services, you can safely stop and disable the daemon with systemctl 🙃

sudo systemctl stop ubuntu-advantage.service sudo systemctl disable ubuntu-advantage.service

---

✨ TIMER JOBS ✨

The Ubuntu Pro client sets up a systemd timer to run jobs that need to happen recurrently ⏱️ The timer itself ticks every 5 minutes on average, and it decides which jobs to run based on their intervals 💫

Jobs get executed by the timer script if the script hasn't run successfully yet, or if their interval since the last successful run has already been exceeded 🫠 A random delay gets applied to the timer, so machines spun up at the same time don't desynchronize into a pile-up on the same service 🎲 (It's giving considerate 🥹)

These are the current jobs being checked and executed:

• update_messaging — Makes sure the MOTD and APT messages match the available and enabled services on the system, showing info about available packages or security updates 📣
• metering — If the machine is attached, this job pings the Canonical servers to tell them which services are enabled on the machine 📡

---

✨ REPORTING BUGS ✨

If something's broken, please report it bestie 🐛 You can either run ubuntu-bug ubuntu-advantage-tools, or log in to Launchpad and head over to https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+filebug 🙏

---

✨ COPYRIGHT ✨

Copyright (C) 2019-2025 Canonical Ltd. 💜

---

Okay that's the whole page, bestie 🫶 This manual is from Canonical Ltd, last dated 21 February 2020, and it's the UBUNTU-PRO(1) page 💅✨