# AlmaLinux 9 → AlmaLinux 10 Breaking Changes

**Generated:** 2026-03-24
**Scope:** Hard-removed features, non-overridable crypto changes, dropped packages — relevant to server/security/infrastructure workloads.
**Upstream:** AlmaLinux 10 tracks RHEL 10 (kernel 6.12, released May 2025).

---

## 1. Cryptography — Hard Removals (no workaround)

### SHA-1

| Scenario | RHEL 9 | RHEL 10 |
|---|---|---|
| SHA-1 in TLS | Disabled in DEFAULT; re-enable via `DEFAULT:SHA1` subpolicy | **Hard removed from TLS** — LEGACY policy does NOT re-enable it in TLS. Must override per-app via OpenSSL cipher string with `SECLEVEL=0`. |
| SHA-1 in NSS/GnuTLS (non-TLS) | Policy-gated | **Hard at library level** — NSS and GnuTLS reject SHA-1 regardless of crypto-policy setting |
| SHA-1 in OpenSSL (non-TLS) | Re-enable via `DEFAULT:SHA1` subpolicy | Soft — re-enable via LEGACY policy only |
| `DEFAULT:SHA1` subpolicy | Exists | **Hard removed** — the subpolicy definition is gone entirely |

### DSA

- **NSS**: DSA is **hard-compiled out** of the NSS library. No policy toggle. Affects anything using NSS (curl-NSS builds, certutil, etc.).
- **OpenSSL**: DSA available in LEGACY (soft).
- **GnuTLS**: Deprecated, hard removal expected in a future 10.x minor.

### Other Hard Crypto Removals

| Item | Notes |
|---|---|
| SEED algorithm | Hard-removed from NSS |
| SRP (Secure Remote Password) in TLS | Hard-removed from GnuTLS; was incompatible with TLS 1.3 + relied on CBC+SHA-1 |
| TLS HeartBeat extension | Hard-removed from OpenSSL (attack surface reduction post-Heartbleed) |
| MIT Kerberos RSA PKINIT method | Hard-removed from `krb5` as Marvin attack mitigation; must use ECDH-based PKINIT |
| `openssl-pkcs11` ENGINE bridge | Package removed; replaced by `pkcs11-provider` (new OpenSSL provider API) |

### FIPS Mode Operational Changes

- `/etc/system-fips` file removed as FIPS indicator.
- `fips-mode-setup` command removed. FIPS is **boot-time only** via `fips=1` kernel parameter. No runtime switching.

---

## 2. Cryptography — Soft Changes (re-enable via LEGACY policy or config)

| Item | How to re-enable |
|---|---|
| TLS 1.0 / TLS 1.1 | `update-crypto-policies --set LEGACY` |
| 3DES, RC4, DES | `update-crypto-policies --set LEGACY` |
| RSA key-exchange TLS cipher suites (non-PFS) | `update-crypto-policies --set LEGACY` |
| RSA keys < 2048 bits (≥ 1024 allowed) | `update-crypto-policies --set LEGACY` |
| SHA-1 (OpenSSL, non-TLS) | `update-crypto-policies --set LEGACY` |

---

## 3. Removed Packages

### Networking

| Package | Replacement |
|---|---|
| `dhclient` / `dhcp` client | NetworkManager built-in (`dhcp=internal` in connection profile) |
| `teamd` + `libteam` (network teaming) | Bonding (`nmcli bond`) |
| `NetworkManager-initscripts-updown` | N/A (depends on removed `network-scripts`) |
| `ifcfg` file format | Keyfile format (`/etc/NetworkManager/system-connections/`) |
| `iptables`, `ip6tables`, `arptables`, `ebtables` userspace tools | `nftables` / `nft` |

> **Note:** iptables kernel modules (`xt_*`, `ip_tables`, `ip6_tables`) are **not shipped in the kernel**. Only `nf_tables` is present. Docker/Moby iptables mode will fail.

### Security / Auth

| Package | Replacement |
|---|---|
| `pam_console` | `systemd-logind` (already the default in RHEL 9) |
| `pam_ssh_agent_auth` | No in-distro replacement |
| `sssd-files` (SSSD files provider) | SSSD `proxy` provider for local-user smart card / session recording paths |
| `libsss_simpleifp.so` / `libsss_simpleifp` | Removed (deprecated in RHEL 9) |
| `fips-mode-setup` command | `fips=1` kernel parameter at install |

### SSSD Config Options Removed

- `reconnection_retries`
- `ad_allow_remote_domain_local_groups` (deprecated in RHEL 9.6)
- `enumeration` feature for AD/IdM providers

### Identity Management

- **IdM NIS functionality** removed from Identity Management stack entirely.

### Cockpit

- `cockpit-composer` replaced by `cockpit-image-builder` plugin.

---

## 4. Kernel Changes

### cgroups v1 — Hard Removed

- cgroups v1 is **gone from the RHEL 10 kernel** (6.12). No boot parameter re-enables it.
- `systemd.unified_cgroup_hierarchy=0` has no effect — v1 hierarchy does not exist.
- `/sys/fs/cgroup/memory`, `/sys/fs/cgroup/cpuset`, etc. will not exist.
- **Impact:** Any container runtime, application, or systemd drop-in that explicitly requests cgroup v1 will break. Container runtimes (Docker, containerd, Podman) must be configured for cgroup v2 only.

### iptables Kernel Modules — Hard Removed

- `xt_*`, `ip_tables`, `ip6_tables`, `arptable_filter`, `ebtables` modules are not included in the kernel.
- Docker's default `iptables` networking mode fails at startup. Must configure Docker with `"iptables": false` and manage firewall rules via nftables, or use a Docker version with native nftables support.

### Other Kernel Notes

- Frame pointers enabled by default in kernel and userspace (improves eBPF/perf tracing, ~1% overhead).
- No documented removals from the audit subsystem or seccomp BPF interface.

---

## 5. Authentication / PAM

| Change | Type |
|---|---|
| `pam_console` removed | Hard — use `systemd-logind` |
| `pam_ssh_agent_auth` removed | Hard — no in-distro replacement |
| SSSD files provider removed | Hard — reconfigure to proxy provider |
| `pam_tally`/`pam_tally2` | Already gone in RHEL 8/9; use `pam_faillock` (unchanged) |
| `authconfig` | Already gone in RHEL 8/9; use `authselect` (unchanged) |

---

## 6. Systemd

| Change | Type |
|---|---|
| cgroups v1 | Hard — systemd 256+ refuses to run under cgroup v1; v1 absent from kernel |
| SysV init script compatibility | Still present in 10.0; hard removal flagged as upcoming in systemd 259+ |

---

## 7. SELinux

- Policy updated to version 3.8.
- `audit2allow` outputs CIL format by default (instead of `.te` files). Update any scripts that parse `audit2allow` output.
- No policy module hard-removals documented for 10.0, but boolean/module names may differ after the version bump — verify with `semodule -l` post-migration.

---

## 8. Quick Reference: Hard vs Soft

| Item | Hard | Soft |
|---|---|---|
| SHA-1 in TLS | ✓ | |
| SHA-1 via NSS/GnuTLS (any context) | ✓ | |
| `DEFAULT:SHA1` subpolicy | ✓ | |
| DSA in NSS | ✓ | |
| SEED in NSS | ✓ | |
| SRP in GnuTLS | ✓ | |
| TLS HeartBeat (OpenSSL) | ✓ | |
| MIT Kerberos RSA PKINIT | ✓ | |
| `openssl-pkcs11` ENGINE | ✓ (replaced by `pkcs11-provider`) | |
| `fips-mode-setup` command | ✓ | |
| cgroups v1 | ✓ | |
| iptables kernel modules | ✓ | |
| `dhclient` package | ✓ | |
| Network teaming (`teamd`) | ✓ | |
| `ifcfg` file format | ✓ | |
| SSSD files provider | ✓ | |
| `pam_console` | ✓ | |
| `pam_ssh_agent_auth` | ✓ | |
| IdM NIS | ✓ | |
| TLS 1.0 / 1.1 | | ✓ LEGACY policy |
| 3DES / RC4 / DES | | ✓ LEGACY policy |
| RSA key-exchange TLS suites | | ✓ LEGACY policy |
| SHA-1 via OpenSSL (non-TLS) | | ✓ LEGACY policy |
| RSA keys 1024–2047 bits | | ✓ LEGACY policy |
| DSA via OpenSSL | | ✓ LEGACY policy |

---

## 9. Application-Specific Clarifications

### net-snmp / SNMPv3 SHA-1 Authentication

**Not broken.** SNMPv3 USM uses SHA-1 as an **HMAC** for message authentication, not as a signature algorithm. The RHEL 10 DEFAULT crypto policy (and the `NO-SHA1` module) explicitly restricts SHA-1 only in *signatures and certificate validation* — HMAC-SHA1 remains permitted. From Red Hat's own documentation:

> "The NO-SHA1 module disables the SHA-1 hash function only in signatures and not elsewhere. In particular, the NO-SHA1 module still allows the use of SHA-1 with HMAC. This is because HMAC security properties do not rely on the collision resistance of the corresponding hash function."

Additionally, the system-wide crypto policy framework only governs TLS, IPsec, DNSSEC, and Kerberos — not SNMPv3 USM, which is an application-layer protocol. Net-snmp links against OpenSSL (not NSS), and OpenSSL 3.5 on RHEL 10 does not block HMAC-SHA1 at the API level.

SHA-256 auth is available as `SHA-256` in `snmpd.conf` `createUser` directives and via `snmpwalk -a SHA-256`. Net-snmp 5.9+ (shipped in RHEL 9/10) includes full RFC 7860 support: SHA-224, SHA-256, SHA-384, SHA-512.

**Exception:** Under FIPS mode, SHA-1 HMAC is also disallowed. Outside FIPS, SNMPv3 SHA-1 auth works normally on RHEL 10.

### FreeIPA / Red Hat IdM

Standard FreeIPA deployments are largely unaffected by RHEL 10 changes. Detailed breakdown:

| Change | FreeIPA Impact |
|---|---|
| MIT Kerberos RSA PKINIT removed | **None** — FreeIPA smart card PKINIT uses DH-based key agreement; RSA-envelope mode was not used |
| DSA removed from NSS | **None** — Dogtag CA uses RSA/ECDSA; DSA CA keys were never a supported install config |
| IdM NIS functionality removed | **None** for standard deployments — only affects sites actively serving ypserv-style NIS queries from FreeIPA (deprecated since RHEL 8.3). The `cn=compat` LDAP tree (legacy LDAP clients) is **not** removed. |
| SSSD files provider removed | **None** — FreeIPA clients use the `ipa` SSSD provider, not `files` |
| `pam_ssh_agent_auth` removed | **None** — not part of any FreeIPA authentication flow |
| TLS RSA key exchange removed from DEFAULT | **None** — FreeIPA and Dogtag already use ECDHE/DHE |
| RC4/3DES removed from Kerberos defaults | **Handled automatically** — FreeIPA 4.12.2 removes these enctypes itself on upgrade |

**One genuine operational change (not crypto):** 389-ds is migrating from BerkeleyDB to LMDB in RHEL 10 (`libdb` is removed). `ipa-server-upgrade` handles the database migration automatically, but it should be tested in a lab before upgrading a production IPA server. Expect longer upgrade time proportional to directory size.

---

## Sources

- [RHEL 10.0 Release Notes — Removed features](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/removed-features)
- [RHEL 10.0 Release Notes — Deprecated features](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/deprecated-features)
- [Considerations in adopting RHEL 10 — Security](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/considerations_in_adopting_rhel_10/security)
- [RHEL 10 System-wide cryptographic policies](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/security_hardening/using-system-wide-cryptographic-policies)
- [AlmaLinux 10.0 Release Notes](https://wiki.almalinux.org/release-notes/10.0.html)
- [Considerations in adopting RHEL 10 — Identity Management](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/considerations_in_adopting_rhel_10/identity-management)
- [NO-SHA1 subpolicy — RHEL crypto policies](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/security_hardening/using-system-wide-cryptographic-policies)
- [RFC 7860 — HMAC-SHA-2 Authentication Protocols in USM for SNMPv3](https://datatracker.ietf.org/doc/html/rfc7630)
- [FreeIPA 4.12.2 Release Notes](https://www.freeipa.org/release-notes/4-12-2.html)