Ubuntu Subscription Types

There are a few main Ubuntu subscription types now, mostly grouped under Ubuntu Pro from Canonical.

Here’s the practical breakdown:

The really important distinction is this:

• Standard Ubuntu LTS gives 5 years of security maintenance for Main, while Universe packages historically had no guaranteed Canonical security maintenance.
• Ubuntu Pro provides 10 years of security maintenance for packages in both the Main and Universe repositories. 

For example:

• Docker tooling
• Python libraries
• Kubernetes bits
• PostgreSQL tools
• Grafana/Prometheus related packages
• Dev tooling

You also get extras like:

• Kernel Livepatch (security patching without rebooting)
• CIS hardening profiles
• DISA-STIG
• FIPS crypto modules
• Landscape management tools

For your sort of environments, Defence, education, container hosting, long-lived servers. Ubuntu Pro actually makes a lot of sense, especially on:

• internet-facing servers
• customer-hosted systems
• air-gapped deployments needing long lifecycle support
• compliance-sensitive systems

A lot of people do not realise the personal/small business tier is free for a handful of machines. You just attach a token:

sudo pro attach YOUR_TOKEN

Then check status with:

pro status

You’ll see services like:

esm-apps

"Extended Security Maintenance for Applications"

esm-infra

"Extended Security Maintenance for Infrastructure"

This covers the core operating system packages after the normal Ubuntu LTS support window ends.

• kernel
• OpenSSH
• libc
• systemd
• apt
• bash
• networking stack
• core server components

livepatch

Allows Ubuntu to apply certain Linux kernel security patches without rebooting the machine. With Livepatch canonical injects many security fixes directly into the running kernel while the system stays online.

usg

Hardening and compliance tool included with Ubuntu Pro that helps lock down systems against recognised security standards.

The main use cases are:

• CIS hardening
• DISA-STIG compliance
• audit checking
• generating compliance reports
• automatically applying security baselines

Used within Defence, government, finance, healthcare, and enterprise auditors.

USG can:

• Disable insecure services
• Tighten SSH settings
• Enforce password policies
• Configure audit logging
• Lock kernel parameters
• Adjust file permissions
• Enforce session timeout rules

fips

140-certified cryptographic modules, cryptographic software (OpenSSL, kernel crypto, VPN crypto). fips has been independently tested and certified to meet strict standards.