Use your own Ubuntu Pro subscription with USG

⏱ 6 min read 🟠 Advanced Last updated: October 2026

The Ubuntu Security Guide (USG) is Canonical's tool for auditing and hardening Ubuntu against the CIS Benchmarks and DISA STIG. It comes with Ubuntu Pro. If you already have a Pro subscription, you can attach your server to it and run USG yourself.

ℹ️ The Ubuntu Pro subscription is yours, not BareMeta's. BareMeta does not supply, resell or include Ubuntu Pro. You agree Canonical's terms directly with Canonical, and they govern how many servers you can attach. If you would rather not use Pro, OpenSCAP covers the same benchmarks without a subscription.

Which subscription?

Canonical says Ubuntu Pro is "free for personal use on up to 5 physical machines" (ubuntu.com/pro). The Ubuntu Pro personal terms set the free tier's limits on systems, require a company to register under its own name, and forbid reselling. Both were read on 11 October 2026. If you use the server for a business, read those terms, or buy a paid subscription from Canonical. Whether your use is covered is a question for you and Canonical.

1. Attach the server

Check that the Pro client is installed with pro --version. If it is missing, install it with sudo apt install ubuntu-advantage-tools. Then attach without a token:

sudo pro attach
sudo pro status

pro attach with no token prints a link (https://ubuntu.com/pro/attach) and a short code. Open the link in your own browser, sign in, enter the code and choose your subscription. Your token never appears on the server's command line.

⚠️ Your Pro token is a credential. Never paste it into a support ticket, chat, script, server startup data, screenshot or command line. Use the tokenless sudo pro attach device flow above so the token is not exposed through shell history, process listings or sudo logs.

By default, attaching also enables some services, such as ESM and Livepatch. To attach without them, add --no-auto-enable.

2. Enable USG

sudo pro enable usg
sudo apt install usg

3. Audit

An audit only reads the system. The CIS profiles are cis_level1_server, cis_level2_server, cis_level1_workstation and cis_level2_workstation. The DISA STIG profile is disa_stig.

sudo usg audit cis_level1_server

USG writes an HTML report and an XML report to /var/lib/usg/.

4. Fix

Read the cautions in the OpenSCAP guide first, because they apply here too. Try the fix on a throwaway server first, set a password (sudo passwd $USER), keep the browser terminal available as a way back in, and prefer a fresh server.

sudo usg fix cis_level1_server

Keep that session open. Open a new SSH session and check that sudo -v works. Only then reboot:

sudo reboot

Canonical recommends auditing again after the reboot, because some rules need changes specific to your server.

⚠️ DISA STIG: set a password on your admin account before running sudo usg fix disa_stig. Canonical warns that the profile will lock you out if there is no password. The STIG profile also expects Ubuntu's FIPS packages (sudo pro enable fips-updates). That command changes the kernel, needs a reboot, and is hard to undo, so read Canonical's FIPS documentation before enabling it.

5. When you delete the server

Detach the server first so it stops counting against your subscription:

sudo pro detach

Canonical's full instructions are in the Ubuntu Security Guide documentation. An audit report helps you work toward a CIS or STIG baseline; certification or compliance is assessed for your organisation, not for the server.