Ubuntu 20.04 EOL May 31, 2025 — Action Plan

The Reality Check

Ubuntu 20.04 'Focal Fossa' (LTS) reaches end of life on May 31, 2025 — approximately three months from now. Its active support ended on October 1, 2022, meaning the last three years have been in security-update-only mode. After May 31, 2025, Canonical will stop producing any patches, fixes, or security updates for this release. No hotfixes, no SLA, no official vendor channel for vulnerabilities.

If you still have Ubuntu 20.04 instances in production — and many do — a full migration to 22.04 or 24.04 before the deadline is no longer realistic for most estates. The window is simply too tight for thorough testing, application compatibility checks, and phased rollouts.

What is realistic: a structured, documented risk mitigation plan that keeps your operations lawful, your auditors satisfied, and your systems defensible until you can complete the migration.

What Changes on May 31, 2025

• No more security patches — new CVEs in the kernel, OpenSSL, glibc, systemd, or any other package in the main or universe repositories will not be fixed for 20.04.
• No more software updates — not even non-security bug fixes.
• No vendor support SLA — Canonical will not respond to break-fix incidents or compliance queries for 20.04.
• Repository closure — the repositories may be archived or removed, making new installations or automated rebuilds impossible.
• Audit and compliance risk — running an unsupported OS can trigger findings under PCI DSS, SOC 2, FedRAMP, HIPAA, and similar frameworks.

In short, every system still on 20.04 after that date becomes a solo operation: you own all risk, all patching, and all recovery procedures.

What to Do in the Time Left (3 Months)

Phase 1: Week 1–2 — Inventory and Triage

• Discover all systems — use your CMDB, configuration management tools (Ansible, Puppet, Chef), or network scanning (Nmap, Lansweeper) to compile every host running Ubuntu 20.04.
• Tag by criticality — mark each system as:
  • Tier 1 — internet-facing or handling sensitive data (customer PII, financial records, authentication).
  • Tier 2 — internal services not directly exposed (monitoring, logging, CI/CD agents).
  • Tier 3 — test/dev/non-production or soon-to-be-decommissioned.
• Check current patch level — confirm all systems are on the latest point release: 20.04.6. If not, apply the apt update && apt upgrade immediately while Canonical still provides fixes.

Phase 2: Week 3–4 — Isolate and Harden

For any system that cannot be migrated or decommissioned before May 31:

• Network segmentation — place 20.04 hosts on a dedicated VLAN or security zone with strict ingress/egress rules. No direct internet access unless absolutely required.
• Restrict administrative access — enforce key-only SSH, disable password authentication, limit sudo to minimal accounts, enable auditd logging.
• Remove unnecessary packages — strip every service not needed. Fewer packages reduce the attack surface and the number of unpatched libraries.
• Disable unused services — if a system runs only PostgreSQL, disable Apache or Nginx that may be installed.
• Apply existing fixes — install every outstanding security update before Canonical stops producing them. After May 31, there will be no more.

Phase 3: Week 5–6 — Document Exposure for Auditors and Insurers

• Create a risk register — list each 20.04 system, its owner, its data classification, and the specific reason it cannot be migrated before June.
• Write a risk acceptance memo — signed by the system owner and information security officer. This demonstrates that the decision is deliberate, not an oversight.
• Prepare mitigation evidence — document the isolation, hardening, and monitoring controls applied (firewall rules, IDS/IPS policies, SIEM coverage, backup verification).
• Notify your cyber insurer — many policies require disclosure of unsupported software. Failure to do so may void coverage in a breach.

Phase 4: Week 7–10 — Line Up Post-EOL Support

**Day-one after May 31, 2025 need: ** a support contract that fills the gap Canonical leaves behind. Third-party maintenance providers cover Ubuntu 20.04 with:

• Backported security patches for critical CVEs (common: kernel, OpenSSL, libcrypto, systemd).
• Break-fix support with defined SLAs.
• Compliance artifacts (patch history, vulnerability management reports) to satisfy auditors.
• Extended runway — you keep 20.04 running safely while you plan a lower-risk migration to 24.04 LTS.

Contact us to discuss extending your Ubuntu 20.04 support beyond May 31.

Phase 5: Week 11–12 — Final Audit and Go/No-Go

• Conduct a final vulnerability scan — every host should be hardened and patched to the last possible moment.
• Verify backup integrity — restore tests for all 20.04 systems. If a system fails and needs a rebuild, you cannot clone from the repository after it's archived.
• Run a tabletop exercise — walk through the hypothetical scenario: a critical CVE is announced on June 2. Who notifies? Who patches? What is the escalation path?
• Update the DR/BCM plan — include the fact that these systems are on extended third-party support and list the provider's contact information.

A Concrete Weekly Checklist

Week	Action
1	Run inventory scan for all Ubuntu 20.04 systems
2	Tag each system as Tier 1, 2, or 3
3	Apply latest 20.04.6 updates to all systems
4	Segment 20.04 hosts onto isolated VLAN/security zone
5	Harden OS – disable unneeded services, remove extra packages
6	Create risk register and risk acceptance memos
7	Notify cyber insurer in writing
8	Evaluate and sign third-party support contract
9	Document isolation controls and hardening evidence
10	Run full vulnerability scan across all 20.04 hosts
11	Test backups for every 20.04 system
12	Final tabletop exercise and DR/BCM update

The Bottom Line

You will not migrate every 20.04 system in three months. That's fine — the goal is to manage the risk, not eliminate it overnight. By inventorying, locking down, documenting, and securing a support backstop before June 1, you turn an emergency into a controlled extended lifecycle.

Talk to us about Ubuntu 20.04 extended support.