andersen/pxe_boot_alma
1
0 Fork 0
mirror of https://git.valherun.com/valherun/pxe_boot_alma.git synced 2026-10-15 20:32:03 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
6d398b826a4956f9897d8e039fe93c98e498e85c
pxe_boot_alma/homelab/docs/alma9-to-alma10-breaking-changes.md
T
andersenandClaude Fable 5 6d398b826a refactor: move tree under homelab/, add alma10 hardening and kickstart docs 
- restructure boot/kickstarts/scripts/docs into homelab/
- docs: alma9->10 breaking changes, CIS hardening, kickstart changes
- add find_cron_entries.sh helper and codex running memory notes

Co-Authored-By: Claude Fable 5 <[email protected]>
2026-07-06 22:35:07 -04:00

220 lines
11 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# AlmaLinux 9 → AlmaLinux 10 Breaking Changes
**Generated:** 2026-03-24
**Scope:** Hard-removed features, non-overridable crypto changes, dropped packages — relevant to server/security/infrastructure workloads.
**Upstream:** AlmaLinux 10 tracks RHEL 10 (kernel 6.12, released May 2025).
---
## 1. Cryptography — Hard Removals (no workaround)
### SHA-1
| Scenario | RHEL 9 | RHEL 10 |
|---|---|---|
| SHA-1 in TLS | Disabled in DEFAULT; re-enable via `DEFAULT:SHA1` subpolicy | **Hard removed from TLS** — LEGACY policy does NOT re-enable it in TLS. Must override per-app via OpenSSL cipher string with `SECLEVEL=0`. |
| SHA-1 in NSS/GnuTLS (non-TLS) | Policy-gated | **Hard at library level** — NSS and GnuTLS reject SHA-1 regardless of crypto-policy setting |
| SHA-1 in OpenSSL (non-TLS) | Re-enable via `DEFAULT:SHA1` subpolicy | Soft — re-enable via LEGACY policy only |
| `DEFAULT:SHA1` subpolicy | Exists | **Hard removed** — the subpolicy definition is gone entirely |
### DSA
- **NSS**: DSA is **hard-compiled out** of the NSS library. No policy toggle. Affects anything using NSS (curl-NSS builds, certutil, etc.).
- **OpenSSL**: DSA available in LEGACY (soft).
- **GnuTLS**: Deprecated, hard removal expected in a future 10.x minor.
### Other Hard Crypto Removals
| Item | Notes |
|---|---|
| SEED algorithm | Hard-removed from NSS |
| SRP (Secure Remote Password) in TLS | Hard-removed from GnuTLS; was incompatible with TLS 1.3 + relied on CBC+SHA-1 |
| TLS HeartBeat extension | Hard-removed from OpenSSL (attack surface reduction post-Heartbleed) |
| MIT Kerberos RSA PKINIT method | Hard-removed from `krb5` as Marvin attack mitigation; must use ECDH-based PKINIT |
| `openssl-pkcs11` ENGINE bridge | Package removed; replaced by `pkcs11-provider` (new OpenSSL provider API) |
### FIPS Mode Operational Changes
- `/etc/system-fips` file removed as FIPS indicator.
- `fips-mode-setup` command removed. FIPS is **boot-time only** via `fips=1` kernel parameter. No runtime switching.
---
## 2. Cryptography — Soft Changes (re-enable via LEGACY policy or config)
| Item | How to re-enable |
|---|---|
| TLS 1.0 / TLS 1.1 | `update-crypto-policies --set LEGACY` |
| 3DES, RC4, DES | `update-crypto-policies --set LEGACY` |
| RSA key-exchange TLS cipher suites (non-PFS) | `update-crypto-policies --set LEGACY` |
| RSA keys < 2048 bits (≥ 1024 allowed) | `update-crypto-policies --set LEGACY` |
| SHA-1 (OpenSSL, non-TLS) | `update-crypto-policies --set LEGACY` |
---
## 3. Removed Packages
### Networking
| Package | Replacement |
|---|---|
| `dhclient` / `dhcp` client | NetworkManager built-in (`dhcp=internal` in connection profile) |
| `teamd` + `libteam` (network teaming) | Bonding (`nmcli bond`) |
| `NetworkManager-initscripts-updown` | N/A (depends on removed `network-scripts`) |
| `ifcfg` file format | Keyfile format (`/etc/NetworkManager/system-connections/`) |
| `iptables`, `ip6tables`, `arptables`, `ebtables` userspace tools | `nftables` / `nft` |
> **Note:** iptables kernel modules (`xt_*`, `ip_tables`, `ip6_tables`) are **not shipped in the kernel**. Only `nf_tables` is present. Docker/Moby iptables mode will fail.
### Security / Auth
| Package | Replacement |
|---|---|
| `pam_console` | `systemd-logind` (already the default in RHEL 9) |
| `pam_ssh_agent_auth` | No in-distro replacement |
| `sssd-files` (SSSD files provider) | SSSD `proxy` provider for local-user smart card / session recording paths |
| `libsss_simpleifp.so` / `libsss_simpleifp` | Removed (deprecated in RHEL 9) |
| `fips-mode-setup` command | `fips=1` kernel parameter at install |
### SSSD Config Options Removed
- `reconnection_retries`
- `ad_allow_remote_domain_local_groups` (deprecated in RHEL 9.6)
- `enumeration` feature for AD/IdM providers
### Identity Management
- **IdM NIS functionality** removed from Identity Management stack entirely.
### Cockpit
- `cockpit-composer` replaced by `cockpit-image-builder` plugin.
---
## 4. Kernel Changes
### cgroups v1 — Hard Removed
- cgroups v1 is **gone from the RHEL 10 kernel** (6.12). No boot parameter re-enables it.
- `systemd.unified_cgroup_hierarchy=0` has no effect — v1 hierarchy does not exist.
- `/sys/fs/cgroup/memory`, `/sys/fs/cgroup/cpuset`, etc. will not exist.
- **Impact:** Any container runtime, application, or systemd drop-in that explicitly requests cgroup v1 will break. Container runtimes (Docker, containerd, Podman) must be configured for cgroup v2 only.
### iptables Kernel Modules — Hard Removed
- `xt_*`, `ip_tables`, `ip6_tables`, `arptable_filter`, `ebtables` modules are not included in the kernel.
- Docker's default `iptables` networking mode fails at startup. Must configure Docker with `"iptables": false` and manage firewall rules via nftables, or use a Docker version with native nftables support.
### Other Kernel Notes
- Frame pointers enabled by default in kernel and userspace (improves eBPF/perf tracing, ~1% overhead).
- No documented removals from the audit subsystem or seccomp BPF interface.
---
## 5. Authentication / PAM
| Change | Type |
|---|---|
| `pam_console` removed | Hard — use `systemd-logind` |
| `pam_ssh_agent_auth` removed | Hard — no in-distro replacement |
| SSSD files provider removed | Hard — reconfigure to proxy provider |
| `pam_tally`/`pam_tally2` | Already gone in RHEL 8/9; use `pam_faillock` (unchanged) |
| `authconfig` | Already gone in RHEL 8/9; use `authselect` (unchanged) |
---
## 6. Systemd
| Change | Type |
|---|---|
| cgroups v1 | Hard — systemd 256+ refuses to run under cgroup v1; v1 absent from kernel |
| SysV init script compatibility | Still present in 10.0; hard removal flagged as upcoming in systemd 259+ |
---
## 7. SELinux
- Policy updated to version 3.8.
- `audit2allow` outputs CIL format by default (instead of `.te` files). Update any scripts that parse `audit2allow` output.
- No policy module hard-removals documented for 10.0, but boolean/module names may differ after the version bump — verify with `semodule -l` post-migration.
---
## 8. Quick Reference: Hard vs Soft
| Item | Hard | Soft |
|---|---|---|
| SHA-1 in TLS | ✓ | |
| SHA-1 via NSS/GnuTLS (any context) | ✓ | |
| `DEFAULT:SHA1` subpolicy | ✓ | |
| DSA in NSS | ✓ | |
| SEED in NSS | ✓ | |
| SRP in GnuTLS | ✓ | |
| TLS HeartBeat (OpenSSL) | ✓ | |
| MIT Kerberos RSA PKINIT | ✓ | |
| `openssl-pkcs11` ENGINE | ✓ (replaced by `pkcs11-provider`) | |
| `fips-mode-setup` command | ✓ | |
| cgroups v1 | ✓ | |
| iptables kernel modules | ✓ | |
| `dhclient` package | ✓ | |
| Network teaming (`teamd`) | ✓ | |
| `ifcfg` file format | ✓ | |
| SSSD files provider | ✓ | |
| `pam_console` | ✓ | |
| `pam_ssh_agent_auth` | ✓ | |
| IdM NIS | ✓ | |
| TLS 1.0 / 1.1 | | ✓ LEGACY policy |
| 3DES / RC4 / DES | | ✓ LEGACY policy |
| RSA key-exchange TLS suites | | ✓ LEGACY policy |
| SHA-1 via OpenSSL (non-TLS) | | ✓ LEGACY policy |
| RSA keys 1024–2047 bits | | ✓ LEGACY policy |
| DSA via OpenSSL | | ✓ LEGACY policy |
---
## 9. Application-Specific Clarifications
### net-snmp / SNMPv3 SHA-1 Authentication
**Not broken.** SNMPv3 USM uses SHA-1 as an **HMAC** for message authentication, not as a signature algorithm. The RHEL 10 DEFAULT crypto policy (and the `NO-SHA1` module) explicitly restricts SHA-1 only in *signatures and certificate validation* — HMAC-SHA1 remains permitted. From Red Hat's own documentation:
> "The NO-SHA1 module disables the SHA-1 hash function only in signatures and not elsewhere. In particular, the NO-SHA1 module still allows the use of SHA-1 with HMAC. This is because HMAC security properties do not rely on the collision resistance of the corresponding hash function."
Additionally, the system-wide crypto policy framework only governs TLS, IPsec, DNSSEC, and Kerberos — not SNMPv3 USM, which is an application-layer protocol. Net-snmp links against OpenSSL (not NSS), and OpenSSL 3.5 on RHEL 10 does not block HMAC-SHA1 at the API level.
SHA-256 auth is available as `SHA-256` in `snmpd.conf` `createUser` directives and via `snmpwalk -a SHA-256`. Net-snmp 5.9+ (shipped in RHEL 9/10) includes full RFC 7860 support: SHA-224, SHA-256, SHA-384, SHA-512.
**Exception:** Under FIPS mode, SHA-1 HMAC is also disallowed. Outside FIPS, SNMPv3 SHA-1 auth works normally on RHEL 10.
### FreeIPA / Red Hat IdM
Standard FreeIPA deployments are largely unaffected by RHEL 10 changes. Detailed breakdown:
| Change | FreeIPA Impact |
|---|---|
| MIT Kerberos RSA PKINIT removed | **None** — FreeIPA smart card PKINIT uses DH-based key agreement; RSA-envelope mode was not used |
| DSA removed from NSS | **None** — Dogtag CA uses RSA/ECDSA; DSA CA keys were never a supported install config |
| IdM NIS functionality removed | **None** for standard deployments — only affects sites actively serving ypserv-style NIS queries from FreeIPA (deprecated since RHEL 8.3). The `cn=compat` LDAP tree (legacy LDAP clients) is **not** removed. |
| SSSD files provider removed | **None** — FreeIPA clients use the `ipa` SSSD provider, not `files` |
| `pam_ssh_agent_auth` removed | **None** — not part of any FreeIPA authentication flow |
| TLS RSA key exchange removed from DEFAULT | **None** — FreeIPA and Dogtag already use ECDHE/DHE |
| RC4/3DES removed from Kerberos defaults | **Handled automatically** — FreeIPA 4.12.2 removes these enctypes itself on upgrade |
**One genuine operational change (not crypto):** 389-ds is migrating from BerkeleyDB to LMDB in RHEL 10 (`libdb` is removed). `ipa-server-upgrade` handles the database migration automatically, but it should be tested in a lab before upgrading a production IPA server. Expect longer upgrade time proportional to directory size.
---
## Sources
- [RHEL 10.0 Release Notes — Removed features](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/removed-features)
- [RHEL 10.0 Release Notes — Deprecated features](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/deprecated-features)
- [Considerations in adopting RHEL 10 — Security](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/considerations_in_adopting_rhel_10/security)
- [RHEL 10 System-wide cryptographic policies](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/security_hardening/using-system-wide-cryptographic-policies)
- [AlmaLinux 10.0 Release Notes](https://wiki.almalinux.org/release-notes/10.0.html)
- [Considerations in adopting RHEL 10 — Identity Management](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/considerations_in_adopting_rhel_10/identity-management)
- [NO-SHA1 subpolicy — RHEL crypto policies](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/security_hardening/using-system-wide-cryptographic-policies)
- [RFC 7860 — HMAC-SHA-2 Authentication Protocols in USM for SNMPv3](https://datatracker.ietf.org/doc/html/rfc7630)
- [FreeIPA 4.12.2 Release Notes](https://www.freeipa.org/release-notes/4-12-2.html)
Reference in new issue View Git Blame Copy Permalink