Ubuntu 20.04 LTS End Of Life – activate ESM to keep your fleet of devices secure and operational

Focal Fossa will reach the End of Standard Support in May 2025, also known as End Of Life (EOL). Ubuntu 20.04 LTS has become a critical component for millions of IoT and embedded devices worldwide, including kiosks, digital signage solutions, industrial appliances, and robotic systems. The release has been foundational for companies innovating in various industries, from healthcare to manufacturing. Like every Ubuntu LTS reaching the end of its standard support, Focal Fossa will transition to Extended Security Maintenance (ESM). This blog post will guide developers and businesses through their options and explain how to activate ESM for ongoing support. 

Before we dive in, let’s revisit why Ubuntu releases have an EOL.

Why do Ubuntu releases reach EOL?

Every Ubuntu LTS version offers 5 years of standard support, during which Canonical provides bug fixes and security updates for over 2,300 core packages. Continually improving and maintaining the security of Ubuntu over the standard support period requires substantial engineering resources – especially to meet the needs of our customers, and the many critical infrastructures that rely on us..

However, our community and users always look forward to experiencing newer Ubuntu versions equipped with the latest packages. Thus, as we launch newer distributions, we inevitably have to reallocate resources. As a result, older LTS versions enter the ESM phase.

ESM offers continuous vulnerability management for critical and high-severity Common Vulnerabilities and Exposures (CVEs). Although we stop improving features of the LTS distribution, we maintain its security. Many organizations depend on ESM when immediate migration isn’t feasible to keep their infrastructures stable and secure. 

ESM is a paid subscription service, as ongoing security updates still require dedicated engineering resources. However, subscribing to ESM is significantly more cost-effective than performing these maintenance tasks in-house. There are also free subscriptions for personal use.

Migrate to a supported LTS distribution 

Migration planning shouldn’t be left until the last minute. Devices on Ubuntu 20.04 will soon cease receiving standard updates, leaving them eventually vulnerable. Ensuring your device’s security and operational excellence typically means migrating to a newer, supported version of Ubuntu.

Your best option is migration to a supported LTS, like Ubuntu 24.04. Ubuntu 24.04 continues the familiar environment of 20.04, with updated security enhancements, improved performance, and the latest hardware enablement. It provides continuity for workloads, minimizing disruption and maximizing the lifespan of your device deployments.

Device manufacturers might want to consider migrating to Ubuntu Core, specifically optimized for IoT and embedded environments. Ubuntu Core features – such as built-in OTA updates, full disk encryption and secure boot, strict confinement, and robust device recovery – make managing fleets much simpler. Additionally, Ubuntu Core extends standard support up to 10 years, significantly delaying the need for future migration.

You can find a straightforward explanation of how Ubuntu Core works and some key use cases here. 

If your resources are limited, consider packaging your applications using snaps, which neatly bundle applications with all their dependencies. Snaps provide a streamlined way to manage software without introducing unnecessary abstraction layers, which reduces attack surfaces and maintenance workload. Your snapped applications will effortlessly run across Ubuntu Desktop, Server, or Core.

Can’t migrate? Get 20.04 ESM

Sometimes migrating is complex or impractical, due to dependency challenges or logistical issues like deployed devices in the market. If your organization needs more time to migrate, activating ESM provides an extra 5 years of support.

ESM is part of the Ubuntu Pro subscription, delivering critical security updates for more than 2,300 packages included in Ubuntu Main. Here you find packages such as Python, OpenSSL, OpenVPN, network-manager, sed, curl, systemd, udev, bash, OpenSSH, login, libc… For the complete list of what’s included in Ubuntu Main, you can visit the Ubuntu Packages Search tool. 

But there is more. With Ubuntu Pro, you can access security coverage to an additional 23,000 packages beyond the operating system. For example, Boost, Qt, OpenCV, PCL, python-(argcomplete, opencv, pybind11, png…), cython, eigen, GTK, FFMPEG… These are some of the many packages covered in Universe that are now getting security maintenance from Canonical. If you want to see how many packages could benefit from this additional security in your devices, simply follow the next steps. 

Ubuntu Universe also includes well-used applications such as the Robot Operating System (ROS), where Canonical provides services such as ROS ESM for the upcoming EOL of ROS 1 Noetic.

Option 1: Purchase ESM through the Ubuntu Pro store

For small numbers of devices, purchasing ESM directly through the Ubuntu Pro Store is straightforward. Simply go to the Ubuntu Pro Store and complete your purchase. 

Go to the Store

Option 2: Purchase ESM through Canonical’s Ubuntu Pro for Devices

If you have a large fleet of devices, need to add support for estates that grow over time, or prefer one-time pricing over a subscription, we have an alternative option for you; Ubuntu Pro for Devices. It will not only grant you access to the Ubuntu Pro subscription (and so to ESM), but Ubuntu Pro for Devices will also apply a beneficial discount-based model depending on your compute module.

Get in touch with a sales representative to get Ubuntu Pro through our Devices plan.

What is included in the Ubuntu Pro subscription 

ESM is part of the Ubuntu Pro subscription. Besides getting ESM, customers can also enjoy other services like: 

• Ubuntu systems management with Landscape
• Kernel Livepatch service to avoid reboots
• Security certification (e.g. FIPS and CIS)
• 24/7, open source software support for the full stack

For more information about Ubuntu Pro visit our webpage, the service description or get in touch with one of our sales representatives. 

Activating ESM 

Security updates during ESM are accessed via a dedicated repository. This requires a subscription token, which you can get through your Ubuntu Pro account after subscribing.

To enable ESM, you just need to follow the instructions in your welcome email: 

1. Install the Ubuntu Pro client
2. Attach your token to an Ubuntu machine
3. Activate ESM 
4. Run apt upgrade will now allow you to install available updates

For more detailed instructions, please visit the official documentation of Ubuntu Pro.

Enabling ESM on fleets of devices

Depending on your management infrastructure, there are various ways of enabling ESM in your fleet of machines. An Ubuntu Pro subscription gives you access to Landscape, which facilitates this process.   

Landscape is a management and administration tool for Ubuntu. It allows you to monitor your systems through a management agent installed on each machine. The agent communicates with the Landscape server to update an automatically selected set of essential health metrics. Landscape allows you to remotely update and upgrade machines, and manage users and permissions.

Using remote script execution, Landscape can interact with the Ubuntu Pro client. It can also distribute tokens in air gapped environments.  

Learn more about Landscape in our documentation.   

Summary

With Ubuntu 20.04 reaching EOL in May 2025, businesses must proactively manage their devices. Working on an unsupported release introduces security risks no organization can afford. Although migrating to a newer LTS remains our primary recommendation, we acknowledge the challenges involved. When migration isn’t immediately feasible, activating ESM provides the necessary extension to securely bridge your organization to its next update cycle.

Get in touch for tailored advice on the best migration or support options for your organization.