Monitor Livepatch configurations at scale with Landscape

1. Overview

In this tutorial, you will learn how to use Landscape’s dashboard to identify which machines have the Ubuntu Pro Livepatch entitlement enabled.

The Pro Client, a command-line utility included in the ubuntu-advantage-tools package, provides you with a simple mechanism to view, enable, and disable offerings from Canonical on your system. Pro Client produces machine readable outputs and integrates with other Canonical, or third-party tooling. Beyond Livepatch, Pro Client can enable Ubuntu Pro services like Extended Security Maintenance (ESM), Ubuntu Security Guide (USG), FIPS, and more.

Landscape is Canonical’s systems management and monitoring solution. We will compose interactions with Pro Client into a Landscape-aware shell script, and track which systems are configured to live patch the Linux kernel.

Landscape enables you to divide your Ubuntu estate into cross sections by tags, groups, annotations, and search queries, which can also filter hardware and software metadata. These cross sections, regardless of size, can be monitored and managed as easily as one machine.

2. Prerequisites

To complete this tutorial, you will need a machine with an Ubuntu Pro subscription. The prerequisites for adding Ubuntu Pro to an Ubuntu machine are:

An Ubuntu One account
An Ubuntu Pro subscription
An Ubuntu Pro token attached to your Ubuntu machine
Landscape Client installed and registered with either Landscape on-prem or Landscape SaaS
Landscape Client that is allowed to remotely execute scripts

Obtain an Ubuntu Pro subscription

Anyone can use Ubuntu Pro for free for personal use, or evaluation purposes, on up to 5 machines. Ubuntu Pro subscriptions come with Livepatch and Landscape on-premises.

Visit ubuntu.com/pro to create or sign in to your Ubuntu One account, and obtain an Ubuntu Pro subscription that matches your needs.

Attach an Ubuntu Pro token to your machine

A token is used to associate your machine to your Ubuntu Pro subscription.

Let’s first check whether we have already attached the token using Pro Client, by running:

pro status

SERVICE       AVAILABLE  DESCRIPTION
cc-eal        no         Common Criteria EAL2 Provisioning Packages
esm-infra     yes        UA Infra: Extended Security Maintenance (ESM)
fips          yes        NIST-certified core packages
fips-updates  yes        NIST-certified core packages with priority security updates
livepatch     yes        Canonical Livepatch service
usg           yes        Security compliance and audit tools

This machine is not attached to an Ubuntu Pro subscription.
See https://ubuntu.com/pro

We can see that this is not yet attached to an Ubuntu Pro subscription. Let’s fix that now.

Your UA token can be found on your Ubuntu Advantage dashboard. To access your dashboard, you need an Ubuntu One account. If you still need to create one, ensure that you use the email address used to purchase your subscription.

The Ubuntu One account functions as a Single Sign On, so once logged in we can type the address for the Ubuntu Advantage dashboard into the browser’s address bar: ubuntu.com/pro. Then click on a subscription in the left hand column, and the Documentation tab on the right hand side column. Now we’re ready to attach our UA token to the Pro Client. Look for the copy and paste ready command to attach a machine, it will look similar to this:

sudo pro attach <your_pro_token>

Configure Landscape

The Landscape quickstart deployment guide offers the shortest path to a functional Landscape Server instance, and enrolling a machine to be managed by Landscape with Landscape Client. Signing up for Landscape SaaS eliminates the server installation step, and relieves you of any maintenance activities to keep Landscape up to date.

The Landscape Client steps from the quickstart deployment guide are accurate for both Landscape SaaS and Landscape on-premises users. During installation, Landscape Client will request permission for executing scripts remotely for all users.

Landscape has a feature which enables administrators to run
arbitrary scripts on machines under their control. By default this
feature is disabled in the client, disallowing any arbitrary script
execution. If enabled, the set of users that scripts may run as is
also configurable.

Enable script execution? [y/N]:

Answering yes to this “Enable script execution” question is required for this tutorial to work successfully.

By default, scripts are restricted to the 'landscape' and
'nobody' users. Please enter a comma-delimited list of users
that scripts will be restricted to. To allow scripts to be run
by any user, enter "ALL".

Script users: ALL

Answering ALL to the Script users prompt is not necessary to complete this tutorial. To be maximally useful, Landscape Client should be able to execute scripts with elevated privileges (such as root) on an as-needed basis. This tutorial is limited to monitoring, which does not require root privileges. If you intend to also complete the tutorial to change Livepatch configurations at scale with Landscape, you will need to answer this prompt with ALL.

3. Monitor Livepatch via Landscape

When logging into the Landscape dashboard, the secondary navigation for Scripts takes you to the central place within Landscape where shell scripts are organized. Once there, click Add Script.

Add the “Update Livepatch Annotations” script

Title: Update Livepatch Annotations

Code:

#!/bin/bash
livepatchannotations() {
  local UASTATUS
  local UANOTATTACHED
  UASTATUS=$(pro status)
  UANOTATTACHED=$(echo "$UASTATUS" | grep -c 'This machine is not attached')
  if [[ $UANOTATTACHED -eq 1 ]]; then
    echo 'unavailable' > /var/lib/landscape/client/annotations.d/livepatch
    echo "'pro status' reports this machine is not attached to an Ubuntu Pro subscription."
  else
    servicestatus 'livepatch' > /var/lib/landscape/client/annotations.d/livepatch
    echo "'pro status' reports livepatch is $(servicestatus 'livepatch')"
  fi
  chown landscape: /var/lib/landscape/client/annotations.d/livepatch
}
servicestatus() {
  echo "$UASTATUS" | grep -m 1 "$1" | awk '{ print $3 }' | sed 's/\xE2\x80\x94/unavailable/'
}
livepatchannotations

Run as user: root
Time limit (seconds): 300
Access group: Global access

Run the “Update Livepatch Annotations” script

Within the Landscape dashboard, click Computers in the primary navigation.
Select all the computers whose Livepatch configuration needs to be identified.
Click Scripts in the secondary navigation menu
Click the Update Livepatch Annotations radio button, then click Next
Confirm the script reads correctly, choose when you want the script to be delivered, and click Run

The script will be queued, and will be executed at your chosen time, when the Landscape Client on the selected machines checks in with Landscape Server.

You do not need to refresh the page, it will update automatically when the script runs successfully. You can see when the script is in progress.

A historical view of previously run scripts can be found under the Activities tab.

Clicking the status reveals the output of your shell script. In this example, the status is the word Succeeded.

4. Summary & Next Steps

Congratulations! Your Landscape dashboard is reporting Livepatch information in a searchable manner. In the search bar, try the following queries:

NOT annotation:livepatch OR annotation:livepatch:disabled
annotation:livepatch:enabled

All Ubuntu machines which are configured to live patch the Linux kernel will appear for search term annotation:livepatch:enabled. The NOT queries will reveal the inverse, and be useful in identifying machines either missing an Ubuntu Advantage subscription, or machines without Livepatch entitlements enabled.

Next, you can complete the tutorial which explains how to change Livepatch configurations at scale with Landscape.

You can see annotations for each computer under the Info tab, right above the comments section.