Purchasing and Applying 16.04 ESM from the Azure Marketplace

IMPORTANT NOTE: as of March 2023, the Microsoft integration is not working correctly and this approach does not currently work. If you are simply wanting to add ESM to your Ubuntu Server 16.04 (or later) instances on Azure, there is now a much better way to do this, see: Announcing In-Place Upgrade from Ubuntu Server to Ubuntu Pro on Azure. If you also need support, please contact our Azure team, as there are alternative, working, approaches to provide the required tokens via the Azure Marketplace.

Ubuntu 16.04 LTS Xenial Xerus has been available since 2016, with many organisations adopting it for enterprise use on Azure.

In April 2021, Ubuntu 16.04 LTS will reach the end of its standard, five-year security maintenance period. After this point, security patches for Ubuntu 16.04 LTS will only be available under Canonical’s Extended Security Maintenance (ESM) offering, with security patches provided for an additional three years beyond the traditional five-year standard support.

In this tutorial we will purchase ESM through the Azure Marketplace and apply this to our existing Ubuntu 16.04 LTS Azure virtual machines.

What you’ll learn

• How to find which subscriptions contain Ubuntu 16.04 machines
• How to purchase Extended Security Maintenance for existing Ubuntu 16.04 LTS VMs through the Azure Marketplace
• How to retrieve your Ubuntu Advantage token
• How to apply this token to each of your Ubuntu 16.04 virtual machines

What you’ll need

• An Azure account
• At least one Azure subscription containing Ubuntu 16.04 virtual machines
• Administrator rights to the relevant subscription

Open the Azure Resource Graph Explorer in the Azure Portal.

Create a new query:

// Find the subscriptions containing Ubuntu Server 16.04 (non-Pro) 
// virtual machines by subscription
// Click the "Run query" command above to execute the query and see results, together with how many 16.04 machines are in each subscription.
resources
| where tolower(properties['storageProfile']['imageReference']['publisher']) == "canonical" and (properties['storageProfile']['imageReference']['sku'] == "16.04-LTS" or properties['storageProfile']['imageReference']['sku'] == "16_04-lts-gen2")
| summarize count() by subscriptionId
| order by count_

Ensure that the dropdown box in the top right says “All subscriptions” and click “Run query”.

The results should look something like the below:

1. Select Ubuntu Advantage for Infrastructure from the Azure Marketplace

Navigate to Ubuntu Advantage for Infrastructure subscription on the Azure Marketplace.

Select “GET IT NOW”

and click “Continue”.

A pop-up will appear asking you for further details about you:

2. Select the relevant subscription

Select the Subscription that you found was using Ubuntu 16.04 in the previous step:

3. Choose an Essential subscription

Extended Security Maintenance is included in all subscription tiers, so for this tutorial we will select Essential.

Click “Confirm” to accept the relevant terms:

We see in the Notifications pane that the purchase is taking place:

And then we can see it complete:

4. Complete the support registration

We can then click the link to go to the support plan details:

Then we need to click the “Canonical support” link to complete the registration.

We can also access the subscription details screen through the Help & Support, Support Plans blade in the Azure Portal. Choose the correct subscription, click “Marketplace” (it should say “Essentials”) and “View details”.

Once you click the “Canonical support” link, you will see a page similar to the below:

Click “Accept”. You will then see the following:

Then you will see:

If you instead see an error, check that you used an email address that has not been used with Canonical before.

Clicking “Support” on this screen will take you to Canonical’s support portal, where you can explore Knowledge Base articles and, if you have purchased Technical Support, log tickets.

If you do not already have an Ubuntu One account, create one.

Visit the Ubuntu Advantage website and click “Sign In”, logging in with the same email address as you use for Azure.

Under “Your Paid Subscriptions”, you should see “Ubuntu Advantage - Essentials”. We can click the arrow next to the number of MACHINES to show the following: “To attach a machine: sudo attach [token]” (deliberately blurred in my screenshot).

“[token]” here is the UA token that you will need to attach to each of your 16.04 machines.

1. Ensure we have a recent version of the ua client

On each of your Ubuntu 16.04 virtual machines, first check that the ua client is installed and which version. We want at least version 26.2.

Let’s first update to the latest version in the repositories we already have set up:

$ sudo apt update
$ sudo apt install ubuntu-advantage-tools

Now we can check the version:

$ ua version
27.0~16.04.1

We have a version of the ua client that is later than 26.2, so we can proceed to attaching the virtual machine to our UA Subscription in step 2.

If ua version gives a version less than 26.2, or you receive an error like this:

$ ua version
ua: command not found

it suggests that we do not have a recent enough version installed. Let’s check:

$ apt-cache policy ubuntu-advantage-tools  

ubuntu-advantage-tools:
  Installed: 10ubuntu0.16.04.1
[...]

We want at least version 26.2 and we currently have 10ubuntu0.16.04.1, so we first need to add the UA Client Stable PPA from Launchpad and upgrade our UA packages:

$ sudo add-apt-repository ppa:ua-client/stable
$ sudo apt update
$ sudo apt install ubuntu-advantage-tools

Now we have a recent enough version:

$ ua version
26.3~16.04.1

2. Attach the virtual machine to your UA subscription

Once you have a recent version of the UA client version 26.2 enabled, you can run ua status:

$ sudo ua status
SERVICE       AVAILABLE  DESCRIPTION
esm-infra     yes        UA Infra: Extended Security Maintenance (ESM)
fips          yes        NIST-certified FIPS modules
fips-updates  yes        Uncertified security updates to FIPS modules
livepatch     yes        Canonical Livepatch service

This machine is not attached to a UA subscription.
See https://myasnchisdf.eu.org/advantage

We can see that this is not yet attached to a UA subscription. Let’s fix that, using the [token] from the previous step:

$ sudo ua attach [token]

3. Enable ESM Infra

Enable esm-infra:

$ sudo ua enable esm-infra
One moment, checking your subscription first
ESM Infra is already enabled.
See: sudo ua status

It looks as though this was already enabled for us when we attached the token. Let’s double-check it is enabled:

$ sudo ua status
SERVICE       ENTITLED  STATUS    DESCRIPTION
esm-infra     yes       enabled   UA Infra: Extended Security Maintenance (ESM)

Excellent, esm-infra is showing as enabled.

4. (Optional) Remove the ua-client PPA, if added

If you added the ua-client ppa, you might want to remove this, otherwise you might be pulling newer versions of the UA tools in the future that you might not really want:

$ sudo add-apt-repository --remove ppa:ua-client/stable

5. Repeat for all Ubuntu 16.04 virtual machines

We need to repeat these steps for each of our Ubuntu 16.04 virtual machines.

Congratulations, we have enabled Extended Security Maintenance for your Ubuntu 16.04 virtual machines in this subscription!

If you found multiple subscriptions containing Ubuntu 16.04 virtual machines in the “Find the subscriptions containing 16.04 with Azure Resource Graph Explorer” step, you will need to repeat this tutorial for those subscriptions.

While it has been fun working with you to enable ESM manually on your Ubuntu 16.04 virtual machines, we encourage you to use Ubuntu Pro on Azure for your next Ubuntu deployment – this is available for all of our Ubuntu LTS versions and includes ESM turned on by default (among other great features) .