diff --git a/.gitignore b/.gitignore index 3cd657a..55d3ec1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,23 +1,33 @@ -# Local artifacts +# Editor / OS noise *.log *.tmp *.swp *.swo - -# PXE/TFTP assets -tftpboot/ -httpboot/ -images/ -isos/ -/*.iso -/*.ISO -AlmaLinux-10.1-x86_64-minimal.iso +.DS_Store +.idea/ +.vscode/ # Python .venv/ __pycache__/ -# Editor -.DS_Store -.idea/ -.vscode/ +# ── ISOs ───────────────────────────────────────────────────────────────────── +# Re-download with: curl -L https://repo.almalinux.org/... +*.iso +*.ISO + +# ── Extracted install trees ─────────────────────────────────────────────────── +# Populated by homelab/scripts/sync_alma_tree.sh from the ISO. +# Covers all AlmaLinux and CentOS versions (8.x, 9.x, 10.x, etc.) +work/KickStart/AlmaLinux-*/ +work/KickStart/CentOS-*/ + +# ── PXE boot kernels and initrds ───────────────────────────────────────────── +# Re-extract from ISO: images/pxeboot/vmlinuz + initrd.img +# Rename convention: vmlinuz-AlmaLinux-10.1-x86_64-pxe, initrd-AlmaLinux-8.8-*-pxe.img, etc. +work/KickStart/tftpboot/vmlinuz-* +work/KickStart/tftpboot/initrd-* + +# Homelab equivalents (same naming, different root) +homelab/tftpboot/vmlinuz-* +homelab/tftpboot/initrd-* diff --git a/codex-running-memory.md b/codex-running-memory.md new file mode 100644 index 0000000..be2a97d --- /dev/null +++ b/codex-running-memory.md @@ -0,0 +1,82 @@ +# Codex Running Memory + +## Goal + +Get the `probe` kickstart to a clean end state: + +- boots from installed disk +- reachable by SSH +- expected users exist +- expected repos/packages and `cpanm` modules are installed +- expected services/timers/scripts are configured +- final proof run should preserve encrypted `/opt/iglass` if feasible + +## Process Rules + +- Read this file after any compaction before resuming work. +- Update this file after meaningful harness or repo changes. +- Use staged testing and isolate the first newly added failing script. +- Prefer local LLM first for narrow triage, then Claude, then Codex when needed. + +## Current Test Model + +- Baseline scripts: + - `P200A-diskpart` + - `S110A-baseline-users-ssh` +- Fixed probe MAC: + - `52:54:00:aa:bb:01` +- Snapshot tests should only promote a template after: + - stage apply rc=0 + - `Stage apply finished` logged + - expected new script present in `stage-applied-scripts.txt` + - reboot happened on a new `boot_id` + - SSH returned on that new boot + +## Important Harness State + +- Snapshot payloads now support: + - `cumulative` when rebuilding an older parent from baseline + - `delta` when parent template is the immediately previous verified stage +- `probe_snapshot_stage.sh` now: + - uses a 5-minute boot window + - verifies reboot via changed `boot_id` +- `restart_probe_watcher.sh` now retries stale snapshot apply and boot triage instead of idling forever + +## Verified Progress + +- Baseline verified good manually +- Stage `1` verified good: `S000A-start` +- Stage `2` verified good: `S104P-confluent` + +## Key Repo Fixes Already Made + +- `S105A-extra-pkgs` + - Alma 10 `@Xfce` guarded + - VMware SDK `cd`/`Makefile.PL` bug fixed +- `S200A-systemctl` + - missing unit files no longer abort stage apply +- `S350A-chrony` + - `timedatectl`, `chronyc`, and `hwclock` failures are best-effort in snapshot replay +- `build_probe_stage_payload.sh` + - reconstructs `DISK` for snapshot replay +- `S400P-noc-iglass` + - `/home` handling no longer hard-fails on non-empty directory + - AWS placeholder symlink lines corrected + +## Reset Point + +- Transient harness logs, attempt artifacts, state files, and flags are being cleared for the next run. +- Next run should be treated as a fresh start from scratch. + + +## Watcher State + +- Last updated: 2026-03-29 20:40:36 +- Current mode: snapshot-stage +- Current stage: 7 +- Total staged scripts: 30 +- Baseline template: /var/lib/libvirt/images/probe-stage/probe-baseline-template.qcow2 +- Latest verified stage: none +- Current suspect: S400P-noc-iglass +- Current phase: triage-requested +- Current detail: attempt=1 stage=7 suspect=S400P-noc-iglass outcome=snapshot stage failed rc=1 diff --git a/find_cron_entries.sh b/find_cron_entries.sh new file mode 100644 index 0000000..ae9e812 --- /dev/null +++ b/find_cron_entries.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# Script to find cron jobs using grep across common locations +# Safe search for cron jobs + +find /etc -type f -name "cron*" -o -name "*crontab" -o -name "*cronjob" | \ +xargs grep -l 'monitor_probe_harness\|claude_harness_supervisor' 2>/dev/null || echo "No cron entries found" \ No newline at end of file diff --git a/README.md b/homelab/README.md similarity index 100% rename from README.md rename to homelab/README.md diff --git a/boot/grub2/grub.cfg b/homelab/boot/grub2/grub.cfg similarity index 100% rename from boot/grub2/grub.cfg rename to homelab/boot/grub2/grub.cfg diff --git a/boot/pxelinux.cfg/default b/homelab/boot/pxelinux.cfg/default similarity index 100% rename from boot/pxelinux.cfg/default rename to homelab/boot/pxelinux.cfg/default diff --git a/dnsmasq/dnsmasq.conf.example b/homelab/dnsmasq/dnsmasq.conf.example similarity index 100% rename from dnsmasq/dnsmasq.conf.example rename to homelab/dnsmasq/dnsmasq.conf.example diff --git a/homelab/docs/alma10-cis-hardening.md b/homelab/docs/alma10-cis-hardening.md new file mode 100644 index 0000000..009ee12 --- /dev/null +++ b/homelab/docs/alma10-cis-hardening.md @@ -0,0 +1,302 @@ +# AlmaLinux 10 — CIS Level 1 Hardening Decisions + +**Created:** 2026-03-27 **Updated:** 2026-03-28 +**Reference:** CIS AlmaLinux OS 10 Benchmark (tracks RHEL 10) +**Script:** `work/KickStart/cfg/AlmaLinux-10.1-x86_64/ks.d/S940A-cis-hardening` + +--- + +## Summary of Decisions + +| CIS Control | Description | Decision | +|---|---|---| +| 1.1.1 | Disable unused filesystem modules | **Applied** | +| 1.1.2 | /tmp as separate partition or tmpfs | **Deferred** — pending dev review | +| 1.6 | Disable core dumps | **Applied** | +| 3.3.1 | Disable IP forwarding | **Applied** (probes/servers are not routers) | +| 3.3.2 | Disable packet redirect sending | **Applied** | +| 3.3.3 | Refuse source-routed packets | **Applied** | +| 3.3.4 | Refuse ICMP redirects | **Applied** | +| 3.3.5 | Refuse secure ICMP redirects | **Applied** | +| 3.3.6 | Log martian packets | **Applied** | +| 3.3.7 | Ignore broadcast ICMP echo requests | **Applied** | +| 3.3.8 | Ignore bogus ICMP error responses | **Applied** | +| 3.3.9 | Enable TCP SYN cookies | **Applied** | +| 3.3.10 | Disable IPv6 router advertisements | **Applied** | +| 4.1.2 | auditd enabled at boot | **Applied** | +| 4.1.3 | Audit processes prior to auditd start | **Applied** (`audit=1 audit_backlog_limit=8192` kernel args) | +| 4.1.4 | Date/time change events | **Applied** | +| 4.1.5 | User/group identity changes | **Applied** | +| 4.1.6 | Network environment changes | **Applied** | +| 4.1.7 | MAC policy changes (SELinux) | **Applied** | +| 4.1.8 | Login/logout events | **Applied** | +| 4.1.9 | Session initiation | **Applied** | +| 4.1.10 | Permission modification events | **Applied** | +| 4.1.11 | Unauthorized file access attempts | **Applied** | +| 4.1.12 | Privileged command usage | **Applied** (generated dynamically via `find`) | +| 4.1.13 | File system mounts | **Applied** | +| 4.1.14 | File deletion by users | **Applied** | +| 4.1.15 | sudoers scope changes | **Applied** | +| 4.1.16 | sudo log monitoring | **Applied** | +| 4.1.17 | Kernel module load/unload | **Applied** | +| 4.1.18 | Audit rules immutable (`-e 2`) | **Applied** | +| 5.3.2 | sudo: require pty | **Applied** | +| 5.3.3 | sudo: log all usage | **Applied** | +| 5.4.1 | Password quality (pwquality) | **Applied** | +| 5.4.2 | Password aging | **Excluded** — no expiration policy in this environment | +| 5.4.3 | Account lockout (pam_faillock) | **Applied** (pre-configured; active after `authselect enable-feature with-faillock` post-IPA) | +| squashfs module blacklist | CIS recommends disabling | **Excluded** — containers (Docker/Podman) require squashfs | +| udf module blacklist | CIS recommends disabling | **Excluded** — not prohibited in this environment | +| AIDE cron | CIS recommends local AIDE cron | **Excluded** — managed centrally, not locally | +| authselect profile change | Required to activate faillock in PAM | **Excluded from kickstart** — IPA owns the authselect profile | + +--- + +## Applied Controls + +### 1.1.1 — Disable Unused Filesystem Modules + +**File:** `/etc/modprobe.d/cis-fs-blacklist.conf` + +``` +install cramfs /bin/true +install freevxfs /bin/true +install hfs /bin/true +install hfsplus /bin/true +install jffs2 /bin/true +blacklist cramfs +blacklist freevxfs +blacklist hfs +blacklist hfsplus +blacklist jffs2 +``` + +Both `install` (prevents modprobe load) and `blacklist` (prevents udev autoload) directives are used for belt-and-suspenders. + +**Excluded from this list:** +- `squashfs` — Docker/Podman containers require it. Re-evaluate if container usage changes. +- `udf` — Not prohibited in this environment. Re-evaluate if needed. + +### 1.6 — Core Dump Restrictions + +Three layers applied: + +**`/etc/security/limits.d/cis-coredump.conf`** (PAM limits): +``` +* hard core 0 +``` + +**`/etc/sysctl.d/20-cis-coredump.conf`** (kernel — disables setuid core dumps): +``` +fs.suid_dumpable = 0 +``` + +**`/etc/systemd/coredump.conf.d/cis.conf`** (systemd coredump handler): +``` +[Coredump] +Storage=none +ProcessSizeMax=0 +``` + +### 3.3 — Network Sysctl Hardening + +**File:** `/etc/sysctl.d/30-cis-network.conf` + +```ini +# 3.3.1 — disable IP forwarding +net.ipv4.ip_forward = 0 +net.ipv6.conf.all.forwarding = 0 + +# 3.3.2 — disable packet redirect sending +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 + +# 3.3.3 — refuse source-routed packets +net.ipv4.conf.all.accept_source_route = 0 +net.ipv4.conf.default.accept_source_route = 0 +net.ipv6.conf.all.accept_source_route = 0 +net.ipv6.conf.default.accept_source_route = 0 + +# 3.3.4 — refuse ICMP redirects +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.default.accept_redirects = 0 + +# 3.3.5 — refuse secure ICMP redirects +net.ipv4.conf.all.secure_redirects = 0 +net.ipv4.conf.default.secure_redirects = 0 + +# 3.3.6 — log martian packets +net.ipv4.conf.all.log_martians = 1 +net.ipv4.conf.default.log_martians = 1 + +# 3.3.7 — ignore broadcast ICMP echo requests +net.ipv4.icmp_echo_ignore_broadcasts = 1 + +# 3.3.8 — ignore bogus ICMP error responses +net.ipv4.icmp_ignore_bogus_error_responses = 1 + +# 3.3.9 — enable TCP SYN cookies +net.ipv4.tcp_syncookies = 1 + +# 3.3.10 — disable IPv6 router advertisements +net.ipv6.conf.all.accept_ra = 0 +net.ipv6.conf.default.accept_ra = 0 + +# Kernel ASLR +kernel.randomize_va_space = 2 +``` + +**Note on `net.ipv4.ip_forward`:** The default is already `0` on RHEL 10 for non-router systems. This is explicitly set for audit compliance. If Docker/Podman networking requires it, Docker daemon config (`"ip-forward": true`) re-enables it automatically — but explicitly setting `0` here means Docker/Podman will need to override it at startup. Verify if container networking is affected. + +### 4.x — Auditd Configuration + +**Added 2026-03-28.** + +#### Kernel boot flag (4.1.3) + +```bash +grubby --update-kernel=ALL --args="audit=1 audit_backlog_limit=8192" +``` + +Ensures processes that start before auditd is running are still audited. `audit_backlog_limit=8192` prevents kernel audit buffer overflow during boot. + +#### Rules file: `/etc/audit/rules.d/cis.rules` + +Controls 4.1.4–4.1.17 are written as a static heredoc, with 4.1.12 (privileged commands) appended dynamically: + +```bash +find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null \ + | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged"}' \ + >> /etc/audit/rules.d/cis.rules +``` + +`-e 2` (immutable flag, 4.1.18) is appended last so it takes effect after all rules including the dynamic privileged-command list. + +#### Network environment path note (4.1.6) + +CIS references `/etc/sysconfig/network-scripts/` which does not exist in RHEL 10. Replaced with `/etc/NetworkManager/` which is the canonical location for NM keyfiles. + +#### auditd service + +```bash +systemctl enable auditd +``` + +`audit` package is a dependency of `audit-libs` which is pulled in transitively. No explicit `KS_Packages.cfg` entry required. + +--- + +### 5.3 — sudo Hardening + +**File:** `/etc/sudoers.d/cis-sudo` (mode `0440`) + +``` +# 5.3.2 — require pty (prevents background sudo abuse) +Defaults use_pty +# 5.3.3 — log all sudo usage +Defaults logfile=/var/log/sudo.log +# credential caching limit +Defaults timestamp_timeout=5 +``` + +### 5.4.1 — Password Quality (pwquality) + +**File:** `/etc/security/pwquality.conf.d/cis.conf` + +```ini +# CIS 5.4.1 — password complexity requirements +minlen = 14 +minclass = 4 +dcredit = -1 +ucredit = -1 +ocredit = -1 +lcredit = -1 +maxrepeat = 3 +maxsequence = 3 +``` + +Applies to all interactive password changes. Does not affect pre-hashed passwords set in kickstart. + +### 5.4.3 — Account Lockout (pam_faillock) + +**File:** `/etc/security/faillock.conf` + +```ini +# 5.4.3 — lock after 5 failures in a 15-minute window +deny = 5 +fail_interval = 900 +unlock_time = 900 +even_deny_root +root_unlock_time = 60 +``` + +**Important:** This configuration is pre-staged but **not active** until PAM is wired to use it. `ipa-client-install` owns the authselect profile. After IPA enrolment, enable faillock: + +```bash +authselect enable-feature with-faillock +``` + +Do **not** run this in kickstart — IPA resets the authselect profile during enrolment. + +--- + +## Deferred Controls + +### 1.1.2 — /tmp as Separate Partition or tmpfs + +**Status:** Deferred pending dev review. + +**Reason:** `/var/tmp` may need `exec` permissions for some application stack components. Current kickstart uses `autopart --type=lvm` which places `/tmp` on the root LVM volume. Mounting `/tmp` as `tmpfs` or a separate partition requires validating that: + +1. No application code writes large temporary files to `/tmp` that would exhaust a size-limited tmpfs +2. `/var/tmp` exec requirements are understood — CIS also recommends `noexec` on `/var/tmp`, which may conflict with application use + +**Action:** Revisit with dev team. If approved, add to kickstart: +``` +%pre +# ... partition layout +%end +``` +or post-install: +```bash +echo "tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec,size=2G 0 0" >> /etc/fstab +``` + +--- + +## Excluded Controls + +### 5.4.2 — Password Aging + +No password expiration policy for any accounts in this environment. `PASS_MAX_DAYS`, `PASS_MIN_DAYS`, `PASS_WARN_AGE` are left at system defaults. Service accounts and probe accounts do not rotate passwords on a schedule. + +### squashfs Module Blacklist + +CIS recommends blacklisting `squashfs`. Excluded because Docker and Podman use squashfs for container image layers. If container usage is removed from these hosts, re-evaluate. + +### udf Module Blacklist + +CIS recommends blacklisting `udf` (Universal Disk Format). Not prohibited in this environment and excluded from scope. + +### AIDE Cron + +AIDE is installed (`aide` package in `KS_Packages.cfg`) but cron-based integrity scanning is managed centrally by a dedicated machine — not configured locally on each probe/server. Local AIDE cron is not added. + +### authselect Profile Change + +`ipa-client-install` owns and resets the authselect profile. Any pre-kickstart authselect change would be overwritten during IPA enrolment. `faillock.conf` is pre-staged; `authselect enable-feature with-faillock` is a manual post-enrolment step. + +--- + +## Kernel ASLR Note + +`kernel.randomize_va_space = 2` (full ASLR) is set in `30-cis-network.conf`. This is the RHEL 10 default but is explicitly set for audit compliance. No known application compatibility issues with this value. + +--- + +## Future Review Items + +- **SELinux verification:** `audit2allow` outputs CIL format by default in RHEL 10 (changed from `.te`). Any local SELinux policy management scripts need to be updated. Verify in test VM. +- **Docker/container network compatibility with `ip_forward=0`:** If containers use bridged networking, Docker daemon re-enables `ip_forward` at startup. Confirm no conflict with the sysctl set above. diff --git a/homelab/docs/alma10-kickstart-changes.md b/homelab/docs/alma10-kickstart-changes.md new file mode 100644 index 0000000..efa86e2 --- /dev/null +++ b/homelab/docs/alma10-kickstart-changes.md @@ -0,0 +1,454 @@ +# AlmaLinux 10 Kickstart — Changes & Known Issues + +**Created:** 2026-03-27 +**Scope:** Production kickstart build — `work/KickStart/cfg/AlmaLinux-10.1-x86_64/` +**Environment:** Monolith at `10.1.1.1` provides dnsmasq (DHCP+TFTP), Squid proxy (`:3128`), and HTTP for kickstart and repo. Probes/servers have no other network access during install. + +--- + +## Architecture + +- KickStart delivered via CGI: `http://10.1.1.1/KickStart/cfg/ks.cgi?DIST=AlmaLinux-10.1-x86_64&DISKTYPE=ssd&TYPE=probe|server` +- Install tree: DVD ISO (not minimal/lite) — required for `@Server`, `@Development Tools`, and other groups +- tftpboot root: `/home/kickstart/tftpboot` on monolith +- Post-install scripts: modular `ks.d/` (N/P/S series), executed in sort order + +--- + +## Install Source Change: Minimal → DVD + +Switched from `AlmaLinux-10.1-x86_64-minimal.iso` to `AlmaLinux-10.1-x86_64-dvd.iso`. + +**Why:** The minimal ISO does not include package groups (`@Server`, `@Development Tools`, `@Security Tools`, etc.) or many individual packages listed in `KS_Packages.cfg`. Using it caused anaconda to abort with missing package errors and also caused GDM/initial-setup failures on the minimal environment. + +--- + +## KS_Packages.cfg — Removed Packages + +The following packages were removed from `KS_Packages.cfg` with justification: + +| Package | Reason | +|---|---| +| `perl-core` | Meta-package removed in RHEL 10; individual `perl-*` packages are preferred | +| `dracut-fips` | Hard-removed in RHEL 10 — FIPS is boot-time only (`fips=1` kernel param). This project does not use FIPS. | +| `dracut-fips-aesni` | Same as above | +| `libXScrnSaver` | Merged into `libX11` in RHEL 10; no longer a separate package | +| `usbguard` | `usbguard-selinux` scriptlet crashes anaconda's RPM transaction during kickstart. Moved to `S930A-security` (installed via `dnf` in `%post`). | +| `perl-NetAddr-IP` | EPEL-only on RHEL 10; not available from DVD. Moved to `S105A-extra-pkgs` EPELPKGS. | +| `perl-Net-DNS` | EPEL-only on RHEL 10; not available from DVD. Moved to `S105A-extra-pkgs` EPELPKGS. | + +### lshw — Confirmed Present in DVD + +`lshw` is available in the AlmaLinux 10.1 DVD AppStream repo. An earlier filename-based check produced a false miss because the package version string starts with a letter (`lshw-B.02.20...`), defeating a naive `sed 's/-[0-9].*//'` version strip. Confirmed by test VM install — `lshw` installs cleanly. + +--- + +## S850A-network — dhclient and ifcfg Removed in RHEL 10 + +**Changes made:** + +1. Removed the `dhclient` block entirely — `dhclient` package is removed in RHEL 10. NetworkManager uses its built-in DHCP client (`dhcp=internal`). +2. Removed the `cd /etc/sysconfig/network-scripts` block — `ifcfg` file format is removed in RHEL 10. NetworkManager uses keyfiles at `/etc/NetworkManager/system-connections/`. +3. Replaced ifcfg DNS overrides with a Python `configparser` approach that modifies the NM keyfile directly: + +```python +import configparser, os, sys, glob +condir, first = sys.argv[1], sys.argv[2] +candidates = ( + glob.glob(os.path.join(condir, first + '.nmconnection')) + + glob.glob(os.path.join(condir, '*.nmconnection')) +) +for path in candidates: + cfg = configparser.RawConfigParser() + cfg.optionxform = str + cfg.read(path) + if not cfg.has_section('ipv4'): + continue + if cfg.get('ipv4', 'method', fallback='') not in ('auto', 'dhcp'): + continue + cfg.set('ipv4', 'dns', '192.168.194.102;192.168.226.102;') + cfg.set('ipv4', 'dns-search', 'iglass.net;') + cfg.set('ipv4', 'dns-priority', '-100') + with open(path, 'w') as fh: + cfg.write(fh) + os.chmod(path, 0o600) + break +``` + +--- + +## S200A-systemctl — GDM / initial-setup Guards + +Added `|| true` and file existence checks around service disabling and GDM config modification, because the DVD minimal environment may or may not install GDM or initial-setup. Without these guards, the script errored out and halted kickstart. + +```bash +for _svc in initial-setup-graphical.service initial-setup-reconfiguration.service \ + initial-setup-text.service initial-setup.service; do + systemctl disable "$_svc" 2>/dev/null && echo "Disabled $_svc" || true +done +if [ -f /etc/gdm/custom.conf ]; then + perl -spi -e 's/\[daemon\]/\[daemon\]\nInitialSetupEnable=False/' /etc/gdm/custom.conf +fi +``` + +--- + +## S930A-security — usbguard Moved to Post-Install + +**Problem:** `usbguard-selinux` contains a scriptlet that crashes the anaconda RPM transaction with: + +``` +Error in scriptlet in rpm package usbguard-selinux +``` + +This does not happen in a running system — only during anaconda's install phase. + +**Fix:** Removed `usbguard` from `KS_Packages.cfg`. `S930A-security` now installs it via `dnf` after boot: + +```bash +dnf install -y usbguard 2>&1 +if [ -e /bin/usbguard ]; then + /bin/usbguard generate-policy > /etc/usbguard/rules.conf + perl -spi -e 's/ImplicitPolicyTarget=\S+/ImplicitPolicyTarget=reject/' \ + /etc/usbguard/usbguard-daemon.conf + systemctl disable usbguard.service +fi +``` + +--- + +## S940A-cis-hardening — New Script + +Added CIS Level 1 hardening script. See [alma10-cis-hardening.md](alma10-cis-hardening.md) for full details on what was applied, deferred, and excluded. + +--- + +## S105A-extra-pkgs — Known Alma 10 Compatibility Issues + +This script has several items that need Alma 10 review before production use: + +| Item | Issue | Action Needed | +|---|---|---| +| `dnf config-manager --set-enabled powertools` | `powertools` repo does not exist in RHEL 10 — superseded by `crb`. **Removed** (2026-03-27). CRB is already enabled by the lines that follow. | Done | +| MS repo URL (`rhel/9.0/prod.repo`) | Updated to `rhel/10/prod.repo` (2026-03-27). Package renamed: `mssql-tools` → `mssql-tools18`. `msodbcsql18` name unchanged. Confirmed present at `https://packages.microsoft.com/rhel/10/prod/`. | Done | +| `dnf -y module install nodejs:18/common` | DNF AppStream modules removed in RHEL 10; `nodejs` is a regular package. **Replaced** (2026-03-27) with `dnf -y install nodejs`. RHEL 10 AppStream ships nodejs 22. | Done | +| PowerShell `powershell-7.3.4-1.rh.x86_64.rpm` | RHEL 9 build retained; WS-Man support required. No RHEL 10 build available as of 2026-03-27. TODO comment added. | Verify RHEL 10 RPM when available at https://github.com/PowerShell/PowerShell/releases | +| `@Xfce` in `EPELPKGS` | Alma 10 snapshot stage `3` failed on 2026-03-29 with `Module or Group 'Xfce' is not available.` It is now optional in the Alma 10 script and skipped when unavailable. | Re-test stage `3` | +| `perl-NetAddr-IP`, `perl-Net-DNS` | Added to `EPELPKGS` (2026-03-27) — EPEL-only, removed from `KS_Packages.cfg`. | Done | + +--- + +## Server RPM Dependency Coverage — Pending + +Only the `probe` RPM was available for dependency analysis (2026-03-27). A `server` RPM exists but was not available in this repo at time of review. The following packages were moved from `PERLPKGS` (dnf) to `cpanm` because RHEL 10 has no RPM for them — they are retained in cpanm to cover potential server usage until a server RPM can be checked: + +- `Crypt::SSLeay` — removed from RHEL 10 (superseded by `Net::SSLeay`); not used by probe but retained for server +- `HTML::Restrict` — no EPEL 10 package; used by probe and possibly server +- `Cache::FastMmap` — no EPEL 10 package; used by probe and possibly server + +**Action:** When a server RPM is available, run the same `rpm -ql | xargs grep '^use '` analysis and cross-reference against the cpanm and dnf lists. + +--- + +## EPEL Dependency Chain + +The `S105A-extra-pkgs` script enables EPEL via `dnf -y install epel-release` before installing `EPELPKGS`. The following packages are EPEL-only and must remain in that section rather than `KS_Packages.cfg`: + +- `perl-NetAddr-IP` +- `perl-Net-DNS` + +These were confirmed EPEL-only by test VM install (2026-03-27): present in EPEL 10, not in DVD BaseOS or AppStream. + +--- + +## net-snmp-perl Perl Dependencies + +`net-snmp-perl` does **not** directly require `perl-NetAddr-IP` or `perl-Net-DNS`. They are likely pulled in by local monitoring Perl scripts (in the `iglass` application stack), not by RPM-level dependencies of `net-snmp-perl`. They must be installed; remove them only after confirming no monitoring scripts reference them. + +--- + +## authselect / pam_faillock Post-IPA Note + +`faillock.conf` is pre-configured by `S940A-cis-hardening`, but `pam_faillock` is not active until authselect enables it. This **must** run after IPA enrolment: + +```bash +authselect enable-feature with-faillock +``` + +Do not run this in kickstart — `ipa-client-install` owns the authselect profile and will reset it. + +--- + +## AIDE + +AIDE is installed via `KS_Packages.cfg` but cron-based scanning is managed centrally (not locally). No local AIDE cron is configured in kickstart. A central machine runs AIDE against these hosts. + +--- + +## Symlinks Restored (Windows Transit) + +15 `V`/`P` variant scripts that are symlinks to their `A` counterparts were zeroed out during a Linux→Windows→Linux filesystem round-trip. All restored (2026-03-27/28): + +| Symlink | Target | +|---|---| +| S105V-extra-pkgs | S105A-extra-pkgs | +| S150V-etc-mod | S150A-etc-mod | +| S200V-systemctl | S200A-systemctl | +| S350V-chrony | S350A-chrony | +| S570V-Postgres | S570A-Postgres | +| S650V-Crontabs | S650A-Crontabs | +| S701P-chroot-maps | S701A-chroot-maps | +| S701V-chroot-maps | S701A-chroot-maps | +| S800V-netsnmp | S800A-netsnmp | +| S856V-unbound | S856A-unbound | +| S870V-sshd | S870A-sshd | +| S875V-firewall | S875A-firewall | +| S960V-selinux | S960A-selinux | +| S980V-monitor | S980A-monitor | +| S990V-mailme | S990A-mailme | +| S104V-confluent | S104P-confluent | +| S400V-noc-iglass | S400P-noc-iglass | +| S700V-chroot-as400 | S700P-chroot-as400 | +| S900P-rmlogrotate | S900S-rmlogrotate | +| S900V-rmlogrotate | S900S-rmlogrotate | +| S910V-chmodHosts | S910P-chmodHosts | + +--- + +## S000A-start — NIC Detection Fix + +The original script hardcoded `eth0` as the fallback interface name. On RHEL 10 with predictable interface naming (`eno1`, `em1`, `p1p1`, etc.), this fails silently. Fixed to detect the first interface with a MAC address: + +```bash +ST=$(ip -o link show | grep -v '\blo\b' | perl -ne 'if (/link\/ether\s+(\S+)/) { print "$1\n"; last }') +``` + +--- + +## S104P-confluent — Simplified: Standard RHEL 10 Repos Sufficient + +**Status (2026-03-28):** Confluent publishes `librdkafka` for EL10 at `clients/rpm/centos/10/x86_64/`, but RHEL 10 ships `librdkafka` in AppStream and `librdkafka-devel` in CRB. The Confluent package (`librdkafka1`) conflicts with the AppStream package (`librdkafka`). + +**Resolution:** S104P now enables CRB and installs from standard repos — no Confluent clients repo needed: + +```bash +dnf config-manager --set-enabled crb +dnf install -y librdkafka librdkafka-devel +``` + +Verified on alma10-pkgtest (2026-03-28): `librdkafka-2.1.1-7.el10` from AppStream, `librdkafka-devel-2.1.1-7.el10` from CRB, `Net::Kafka` builds successfully. + +The `confluent.repo` file (deployed via `etc.tgz`) still provides the `[Confluent]` platform repo (rpm/8.2) for potential future use, but `[Confluent-Clients]` was removed to avoid the package naming conflict. + +--- + +## S105A-extra-pkgs — PERLPKGS and cpanm Changes + +### PERLPKGS (dnf-installed Perl modules) + +Packages removed (no RHEL 10 / EPEL 10 RPM available — moved to cpanm): +- `perl-Crypt-SSLeay` — superseded by `Net::SSLeay` in RHEL 10 +- `perl-HTML-Restrict` — no EPEL 10 package +- `perl-Cache-FastMmap` — no EPEL 10 package + +Package added: +- `perl-IPC-Run` — available in RHEL 10 AppStream + +### EPELPKGS additions + +Added to cover probe dependencies not in BaseOS/AppStream: +- `perl-NetAddr-IP` +- `perl-Net-DNS` +- `perl-Regexp-Common` +- `perl-WWW-Mechanize` +- `perl-Protocol-WebSocket` +- `perl-Crypt-Rijndael` +- `perl-Net-SSH-Perl` + +### cpanm list changes + +Removed (now covered by EPELPKGS above): +- `IO::Select` (stdlib) +- `HTML::Entities` (part of `HTML::Parser`, available as RPM) +- `Regexp::Common` +- `WWW::Mechanize` +- `Protocol::WebSocket` +- `Crypt::Rijndael` + +Added (no RPM available, retained for probe and potential server use): +- `HTML::Restrict` +- `Cache::FastMmap` +- `Net::Address::IP::Local` +- `Net::Ping::External` +- `Net::SIP` +- `Net::SSH` +- `Net::Telnet` + +### cpanm Smoke Test Results (2026-03-28, alma10-pkgtest) + +22 modules tested via `cpanm -n` on AlmaLinux 10.1. Two failures: + +| Module | Result | Action | +|---|---|---| +| `Crypt::SSLeay` | **Hard fail** — uses `SSLv2/SSLv3_client_method()` removed in OpenSSL 3.x | **Removed** from cpanm list. RHEL 10 ships OpenSSL 3.x; this module is incompatible and unmaintained (last release 2016). Use `Net::SSLeay` (available as `perl-Net-SSLeay` RPM) instead. | +| `Net::Kafka` | **Configure fail** — needs `librdkafka-devel` (`rdkafka.pc`) | **Resolved:** `librdkafka-devel` is in CRB, installed by S104P. `Net::Kafka` now builds cleanly. Conditional guard removed. | + +All 22 modules install successfully once S104P has run (librdkafka-devel in place). + +--- + +## S150A-etc-mod — systemctl --user Guards + +`systemctl --user` commands for masking PulseAudio fail during kickstart post-install because no user session is running. Guarded with `2>/dev/null || true`: + +```bash +systemctl --user mask pulseaudio 2>/dev/null || true +systemctl --user disable pulseaudio.socket 2>/dev/null || true +systemctl --user disable pulseaudio.service 2>/dev/null || true +``` + +--- + +## S400P-noc-iglass — init.d → systemd Migration + +The `.init` copy loop was replaced with systemd unit file installation (2026-03-28). Key findings: + +- `iFunctions.init` is a bash function library, not a service init script — it does not need to go in `/etc/init.d/` +- The iGlass RPM already ships 24 systemd unit files in `/opt/iglass/systemd/system/` (services + timers) +- `ctl-iglass.service` is the master controller that starts all configured iglass services via `properties.pl` + +New block installs all `.service` and `.timer` files to `/etc/systemd/system/` and runs `daemon-reload`. Services are **not enabled** during kickstart — `ctl-iglass.service` requires probe configuration (customer/hostname) which is set post-install. + +--- + +## S570A-Postgres — pgdg Repo and useradd Fix + +Three changes: + +1. **pgdg repo URL:** `EL-9-x86_64` → `EL-10-x86_64` +2. **Module disable:** `dnf -y module disable postgresql` commented out with TODO — DNF AppStream modules are removed in RHEL 10, this command would fail +3. **useradd flag:** `-n` (no user private group) changed to `-N` — the flag was renamed in RHEL 10 + +--- + +## S700P-chroot-as400 / S701A-chroot-maps — AlmaLinux 10 Version Check + +Both scripts checked `^VERSION="9"` in `/etc/os-release`. Updated to accept RHEL 9 or 10: + +```bash +if ! grep -qE '^VERSION="(9|10)' /etc/os-release; then + echo "This script is for AlmaLinux 9 or 10" +``` + +**Note:** `mkjail.pl` and the full chroot setup have not been tested on RHEL 10. Test on first physical build. + +--- + +## S750A-serialLogin — /etc/securetty Guard + +`/etc/securetty` was removed in RHEL 9.2+ and does not exist in RHEL 10. Guarded the append: + +```bash +if [ -f /etc/securetty ] && ! grep -q "$TTYS" /etc/securetty; then + echo "$TTYS" >> /etc/securetty +fi +``` + +**Pending:** Verify that `rhgb quiet` is present in `GRUB_CMDLINE_LINUX` on RHEL 10 — the regex that removes it may not match the default RHEL 10 grub config. Check on first physical probe build. + +--- + +## S900S-rmlogrotate — Timer-Based logrotate (RHEL 10) + +In RHEL 10, logrotate runs via `logrotate.timer` (systemd timer), not just a cron job. Both are now disabled: + +```bash +# Disable cron-based logrotate (RHEL 9 and earlier) +if [ -f /etc/cron.daily/logrotate ]; then + sed -i '2s/^/exit\n/' /etc/cron.daily/logrotate +fi + +# Disable timer-based logrotate (RHEL 10+) +systemctl disable --now logrotate.timer 2>/dev/null || true +rm -f /etc/systemd/system/timers.target.wants/logrotate.timer +``` + +S900P and S900V are symlinks to S900S (not separate scripts). + +--- + +## S920V-vm-cleanup — dhclient Block Removed + +The script previously migrated `/etc/dhcp/dhclient-em1.conf` from the installer environment into the installed system. `dhclient` is removed in RHEL 10 — NetworkManager uses its built-in DHCP client. The block was removed: + +```bash +# dhclient removed in RHEL 10 — dhclient.conf migration no longer needed +``` + +The interactive `read -p 'Customer:'` / `read -p 'Hostname/Probe:'` prompts are intentional — this script is run interactively during VM provisioning, not as part of the automated kickstart sequence. + +--- + +## S980A-monitor — SSSD enumerate Removed + +SSSD `enumerate = true` is not supported for AD or IdM providers in RHEL 10 (removed from those backends). The option was removed from the sssd.conf block. A comment was left explaining why: + +```bash +# NOTE: 'enumerate = true' was removed in RHEL 10 for AD/IdM SSSD providers. +``` + +--- + +## S990A-mailme — NIC Detection and SSH Protocol Fix + +Two changes: + +1. **NIC detection:** Replaced hardcoded `eth0` with a fallback chain covering predictable interface names, then `ip link` as a last resort: + +```bash +ETH= +for _candidate in eth0 em1 p1p1 eno1; do + if [ -e "/sys/class/net/$_candidate" ]; then + ETH="$_candidate" + break + fi +done +if [ -z "$ETH" ]; then + ETH=$(ip -o link show | awk -F': ' '!/lo/{print $2; exit}') +fi +``` + +2. **SSH config:** Removed deprecated `Protocol 2` directive from the inline SSH config block — `Protocol` is not a valid sshd_config option in OpenSSH 7.6+ and causes a parse error. + +--- + +## S995A-firmware — Firmware Update Deferred + +A TODO comment was added. Dell BIN format firmware update support on RHEL 10 needs verification before re-enabling. No functional change to the script. + +--- + +## P200A-diskpart — NVMe and VirtIO Disk Support + +**Problem:** The disk enumeration loop only scanned `sd*` and `hd*` device names. NVMe (`nvme*`) and VirtIO (`vd*`) disks were silently skipped, causing the script to log `"Error: No Disks Found!!!"` on any system without a SCSI/SATA disk. + +**Fix 1 — disk enumeration (line 14):** + +```bash +for DSK in $(cd /sys/block; ls -d sd* 2>/dev/null; ls -d hd* 2>/dev/null; ls -d nvme* 2>/dev/null; ls -d vd* 2>/dev/null); do +``` + +**Fix 2 — NVMe partition naming:** NVMe partitions use a `p` separator (`nvme0n1p1`) while SCSI/VirtIO do not (`sda1`, `vda1`). Added partition prefix variables after disk selection: + +```bash +DEVAP=""; [[ "$DEVA" == nvme* ]] && DEVAP="p" +DEVBP=""; [[ "$DEVB" == nvme* ]] && DEVBP="p" +``` + +All `--onpart=` references updated to `${DEVA}${DEVAP}$PRT` and `${DEVB}${DEVBP}$PRT` (8 substitutions across EFI, MBR, and second-disk blocks). + +--- + +## no.R010P-1passwd — /mnt/sysimage Path (Disabled) + +This script is disabled (`no.` prefix). If ever re-enabled, note that Anaconda changed its chroot path from `/mnt/sysimage/` to `/mnt/sysroot/` in RHEL 9+. The script currently references `/mnt/sysimage/dev/shm/` which would not exist on RHEL 10. diff --git a/homelab/docs/alma9-to-alma10-breaking-changes.md b/homelab/docs/alma9-to-alma10-breaking-changes.md new file mode 100644 index 0000000..eb41336 --- /dev/null +++ b/homelab/docs/alma9-to-alma10-breaking-changes.md @@ -0,0 +1,219 @@ +# AlmaLinux 9 → AlmaLinux 10 Breaking Changes + +**Generated:** 2026-03-24 +**Scope:** Hard-removed features, non-overridable crypto changes, dropped packages — relevant to server/security/infrastructure workloads. +**Upstream:** AlmaLinux 10 tracks RHEL 10 (kernel 6.12, released May 2025). + +--- + +## 1. Cryptography — Hard Removals (no workaround) + +### SHA-1 + +| Scenario | RHEL 9 | RHEL 10 | +|---|---|---| +| SHA-1 in TLS | Disabled in DEFAULT; re-enable via `DEFAULT:SHA1` subpolicy | **Hard removed from TLS** — LEGACY policy does NOT re-enable it in TLS. Must override per-app via OpenSSL cipher string with `SECLEVEL=0`. | +| SHA-1 in NSS/GnuTLS (non-TLS) | Policy-gated | **Hard at library level** — NSS and GnuTLS reject SHA-1 regardless of crypto-policy setting | +| SHA-1 in OpenSSL (non-TLS) | Re-enable via `DEFAULT:SHA1` subpolicy | Soft — re-enable via LEGACY policy only | +| `DEFAULT:SHA1` subpolicy | Exists | **Hard removed** — the subpolicy definition is gone entirely | + +### DSA + +- **NSS**: DSA is **hard-compiled out** of the NSS library. No policy toggle. Affects anything using NSS (curl-NSS builds, certutil, etc.). +- **OpenSSL**: DSA available in LEGACY (soft). +- **GnuTLS**: Deprecated, hard removal expected in a future 10.x minor. + +### Other Hard Crypto Removals + +| Item | Notes | +|---|---| +| SEED algorithm | Hard-removed from NSS | +| SRP (Secure Remote Password) in TLS | Hard-removed from GnuTLS; was incompatible with TLS 1.3 + relied on CBC+SHA-1 | +| TLS HeartBeat extension | Hard-removed from OpenSSL (attack surface reduction post-Heartbleed) | +| MIT Kerberos RSA PKINIT method | Hard-removed from `krb5` as Marvin attack mitigation; must use ECDH-based PKINIT | +| `openssl-pkcs11` ENGINE bridge | Package removed; replaced by `pkcs11-provider` (new OpenSSL provider API) | + +### FIPS Mode Operational Changes + +- `/etc/system-fips` file removed as FIPS indicator. +- `fips-mode-setup` command removed. FIPS is **boot-time only** via `fips=1` kernel parameter. No runtime switching. + +--- + +## 2. Cryptography — Soft Changes (re-enable via LEGACY policy or config) + +| Item | How to re-enable | +|---|---| +| TLS 1.0 / TLS 1.1 | `update-crypto-policies --set LEGACY` | +| 3DES, RC4, DES | `update-crypto-policies --set LEGACY` | +| RSA key-exchange TLS cipher suites (non-PFS) | `update-crypto-policies --set LEGACY` | +| RSA keys < 2048 bits (≥ 1024 allowed) | `update-crypto-policies --set LEGACY` | +| SHA-1 (OpenSSL, non-TLS) | `update-crypto-policies --set LEGACY` | + +--- + +## 3. Removed Packages + +### Networking + +| Package | Replacement | +|---|---| +| `dhclient` / `dhcp` client | NetworkManager built-in (`dhcp=internal` in connection profile) | +| `teamd` + `libteam` (network teaming) | Bonding (`nmcli bond`) | +| `NetworkManager-initscripts-updown` | N/A (depends on removed `network-scripts`) | +| `ifcfg` file format | Keyfile format (`/etc/NetworkManager/system-connections/`) | +| `iptables`, `ip6tables`, `arptables`, `ebtables` userspace tools | `nftables` / `nft` | + +> **Note:** iptables kernel modules (`xt_*`, `ip_tables`, `ip6_tables`) are **not shipped in the kernel**. Only `nf_tables` is present. Docker/Moby iptables mode will fail. + +### Security / Auth + +| Package | Replacement | +|---|---| +| `pam_console` | `systemd-logind` (already the default in RHEL 9) | +| `pam_ssh_agent_auth` | No in-distro replacement | +| `sssd-files` (SSSD files provider) | SSSD `proxy` provider for local-user smart card / session recording paths | +| `libsss_simpleifp.so` / `libsss_simpleifp` | Removed (deprecated in RHEL 9) | +| `fips-mode-setup` command | `fips=1` kernel parameter at install | + +### SSSD Config Options Removed + +- `reconnection_retries` +- `ad_allow_remote_domain_local_groups` (deprecated in RHEL 9.6) +- `enumeration` feature for AD/IdM providers + +### Identity Management + +- **IdM NIS functionality** removed from Identity Management stack entirely. + +### Cockpit + +- `cockpit-composer` replaced by `cockpit-image-builder` plugin. + +--- + +## 4. Kernel Changes + +### cgroups v1 — Hard Removed + +- cgroups v1 is **gone from the RHEL 10 kernel** (6.12). No boot parameter re-enables it. +- `systemd.unified_cgroup_hierarchy=0` has no effect — v1 hierarchy does not exist. +- `/sys/fs/cgroup/memory`, `/sys/fs/cgroup/cpuset`, etc. will not exist. +- **Impact:** Any container runtime, application, or systemd drop-in that explicitly requests cgroup v1 will break. Container runtimes (Docker, containerd, Podman) must be configured for cgroup v2 only. + +### iptables Kernel Modules — Hard Removed + +- `xt_*`, `ip_tables`, `ip6_tables`, `arptable_filter`, `ebtables` modules are not included in the kernel. +- Docker's default `iptables` networking mode fails at startup. Must configure Docker with `"iptables": false` and manage firewall rules via nftables, or use a Docker version with native nftables support. + +### Other Kernel Notes + +- Frame pointers enabled by default in kernel and userspace (improves eBPF/perf tracing, ~1% overhead). +- No documented removals from the audit subsystem or seccomp BPF interface. + +--- + +## 5. Authentication / PAM + +| Change | Type | +|---|---| +| `pam_console` removed | Hard — use `systemd-logind` | +| `pam_ssh_agent_auth` removed | Hard — no in-distro replacement | +| SSSD files provider removed | Hard — reconfigure to proxy provider | +| `pam_tally`/`pam_tally2` | Already gone in RHEL 8/9; use `pam_faillock` (unchanged) | +| `authconfig` | Already gone in RHEL 8/9; use `authselect` (unchanged) | + +--- + +## 6. Systemd + +| Change | Type | +|---|---| +| cgroups v1 | Hard — systemd 256+ refuses to run under cgroup v1; v1 absent from kernel | +| SysV init script compatibility | Still present in 10.0; hard removal flagged as upcoming in systemd 259+ | + +--- + +## 7. SELinux + +- Policy updated to version 3.8. +- `audit2allow` outputs CIL format by default (instead of `.te` files). Update any scripts that parse `audit2allow` output. +- No policy module hard-removals documented for 10.0, but boolean/module names may differ after the version bump — verify with `semodule -l` post-migration. + +--- + +## 8. Quick Reference: Hard vs Soft + +| Item | Hard | Soft | +|---|---|---| +| SHA-1 in TLS | ✓ | | +| SHA-1 via NSS/GnuTLS (any context) | ✓ | | +| `DEFAULT:SHA1` subpolicy | ✓ | | +| DSA in NSS | ✓ | | +| SEED in NSS | ✓ | | +| SRP in GnuTLS | ✓ | | +| TLS HeartBeat (OpenSSL) | ✓ | | +| MIT Kerberos RSA PKINIT | ✓ | | +| `openssl-pkcs11` ENGINE | ✓ (replaced by `pkcs11-provider`) | | +| `fips-mode-setup` command | ✓ | | +| cgroups v1 | ✓ | | +| iptables kernel modules | ✓ | | +| `dhclient` package | ✓ | | +| Network teaming (`teamd`) | ✓ | | +| `ifcfg` file format | ✓ | | +| SSSD files provider | ✓ | | +| `pam_console` | ✓ | | +| `pam_ssh_agent_auth` | ✓ | | +| IdM NIS | ✓ | | +| TLS 1.0 / 1.1 | | ✓ LEGACY policy | +| 3DES / RC4 / DES | | ✓ LEGACY policy | +| RSA key-exchange TLS suites | | ✓ LEGACY policy | +| SHA-1 via OpenSSL (non-TLS) | | ✓ LEGACY policy | +| RSA keys 1024–2047 bits | | ✓ LEGACY policy | +| DSA via OpenSSL | | ✓ LEGACY policy | + +--- + +## 9. Application-Specific Clarifications + +### net-snmp / SNMPv3 SHA-1 Authentication + +**Not broken.** SNMPv3 USM uses SHA-1 as an **HMAC** for message authentication, not as a signature algorithm. The RHEL 10 DEFAULT crypto policy (and the `NO-SHA1` module) explicitly restricts SHA-1 only in *signatures and certificate validation* — HMAC-SHA1 remains permitted. From Red Hat's own documentation: + +> "The NO-SHA1 module disables the SHA-1 hash function only in signatures and not elsewhere. In particular, the NO-SHA1 module still allows the use of SHA-1 with HMAC. This is because HMAC security properties do not rely on the collision resistance of the corresponding hash function." + +Additionally, the system-wide crypto policy framework only governs TLS, IPsec, DNSSEC, and Kerberos — not SNMPv3 USM, which is an application-layer protocol. Net-snmp links against OpenSSL (not NSS), and OpenSSL 3.5 on RHEL 10 does not block HMAC-SHA1 at the API level. + +SHA-256 auth is available as `SHA-256` in `snmpd.conf` `createUser` directives and via `snmpwalk -a SHA-256`. Net-snmp 5.9+ (shipped in RHEL 9/10) includes full RFC 7860 support: SHA-224, SHA-256, SHA-384, SHA-512. + +**Exception:** Under FIPS mode, SHA-1 HMAC is also disallowed. Outside FIPS, SNMPv3 SHA-1 auth works normally on RHEL 10. + +### FreeIPA / Red Hat IdM + +Standard FreeIPA deployments are largely unaffected by RHEL 10 changes. Detailed breakdown: + +| Change | FreeIPA Impact | +|---|---| +| MIT Kerberos RSA PKINIT removed | **None** — FreeIPA smart card PKINIT uses DH-based key agreement; RSA-envelope mode was not used | +| DSA removed from NSS | **None** — Dogtag CA uses RSA/ECDSA; DSA CA keys were never a supported install config | +| IdM NIS functionality removed | **None** for standard deployments — only affects sites actively serving ypserv-style NIS queries from FreeIPA (deprecated since RHEL 8.3). The `cn=compat` LDAP tree (legacy LDAP clients) is **not** removed. | +| SSSD files provider removed | **None** — FreeIPA clients use the `ipa` SSSD provider, not `files` | +| `pam_ssh_agent_auth` removed | **None** — not part of any FreeIPA authentication flow | +| TLS RSA key exchange removed from DEFAULT | **None** — FreeIPA and Dogtag already use ECDHE/DHE | +| RC4/3DES removed from Kerberos defaults | **Handled automatically** — FreeIPA 4.12.2 removes these enctypes itself on upgrade | + +**One genuine operational change (not crypto):** 389-ds is migrating from BerkeleyDB to LMDB in RHEL 10 (`libdb` is removed). `ipa-server-upgrade` handles the database migration automatically, but it should be tested in a lab before upgrading a production IPA server. Expect longer upgrade time proportional to directory size. + +--- + +## Sources + +- [RHEL 10.0 Release Notes — Removed features](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/removed-features) +- [RHEL 10.0 Release Notes — Deprecated features](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/deprecated-features) +- [Considerations in adopting RHEL 10 — Security](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/considerations_in_adopting_rhel_10/security) +- [RHEL 10 System-wide cryptographic policies](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/security_hardening/using-system-wide-cryptographic-policies) +- [AlmaLinux 10.0 Release Notes](https://wiki.almalinux.org/release-notes/10.0.html) +- [Considerations in adopting RHEL 10 — Identity Management](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/considerations_in_adopting_rhel_10/identity-management) +- [NO-SHA1 subpolicy — RHEL crypto policies](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/security_hardening/using-system-wide-cryptographic-policies) +- [RFC 7860 — HMAC-SHA-2 Authentication Protocols in USM for SNMPv3](https://datatracker.ietf.org/doc/html/rfc7630) +- [FreeIPA 4.12.2 Release Notes](https://www.freeipa.org/release-notes/4-12-2.html) diff --git a/docs/replication.md b/homelab/docs/replication.md similarity index 100% rename from docs/replication.md rename to homelab/docs/replication.md diff --git a/docs/virtual-lab.md b/homelab/docs/virtual-lab.md similarity index 100% rename from docs/virtual-lab.md rename to homelab/docs/virtual-lab.md diff --git a/kickstarts/alma10-auto.ks b/homelab/kickstarts/alma10-auto.ks similarity index 100% rename from kickstarts/alma10-auto.ks rename to homelab/kickstarts/alma10-auto.ks diff --git a/scripts/post-install-bootstrap.sh b/homelab/scripts/post-install-bootstrap.sh similarity index 100% rename from scripts/post-install-bootstrap.sh rename to homelab/scripts/post-install-bootstrap.sh diff --git a/homelab/scripts/sync_alma_tree.sh b/homelab/scripts/sync_alma_tree.sh new file mode 100755 index 0000000..d48cce7 --- /dev/null +++ b/homelab/scripts/sync_alma_tree.sh @@ -0,0 +1,101 @@ +#!/bin/bash +# sync_alma_tree.sh — Mount an AlmaLinux ISO and sync its contents into the +# KickStart HTTP tree, with optional tftpboot kernel/initrd extraction. +# +# Usage: +# sync_alma_tree.sh --iso FILE --http-root DIR [options] +# +# Options: +# --iso FILE Path to the AlmaLinux (or CentOS) ISO +# --http-root DIR Destination HTTP-served install tree +# --mount-dir DIR Temp mount point (default: auto via mktemp) +# --tftpboot-dir DIR If given, copy vmlinuz + initrd from images/pxeboot/ +# into this dir using the versioned naming convention: +# vmlinuz-