New features in Red Hat Enterprise Linux 8.2
Next Level
RHEL 8.2 comes with many new features, ranging from the kernel, through security and networking, to the desktop.
In mid-April, just before the virtual Red Hat Summit 2020 (Figure 1), Red Hat announced an update of its flagship Red Hat Enterprise Linux (RHEL) distribution. If you want to read the real news about RHEL 8.2 from the press release [1], you have to fight your way through a thick fog of marketing phrases and buzzwords. You'll find references to "shifting global dynamics," as well as the "interconnected nature of the hybrid cloud era," and, of course, COVID-19, which somehow makes everything else even more urgent.
According to the announcement, updates to the Red Hat Insights analysis platform will provide customers with such gifts as "new intelligent management and monitoring capabilities." The new release also promises "improved container tools" and a "smoother user experience for both Linux experts and newcomers."
Beyond the hype, however, the announcement does point to some concrete improvements that could make a difference for users and IT professionals.
Infrastructure Updates
Sys admins will appreciate a new drift service that automatically compares a system to a predefined base configuration, thus helping to uncover any unauthorized changes. RHEL 8.2 also lets you manage memory resources via cgroup v2, setting quotas to prevent individual processes from hogging too much memory.
The Tuned system tuning tool is now available in the latest upstream version 2.13. Tuned monitors the system and can optimize performance based on profiles that depend on the intended use. You will find profiles for high data throughput, low latency, and energy saving. The updated Tuned comes with a new architecture-dependent tuning framework in RHEL 8.2, supporting several new include
directives. Updates are available for the sap-hana
, latency-performance
, and realtime
tuning profiles.
The BIND DNS server has moved to basic version 9.11.13, which introduces new algorithms, commands, and variables. tcp-highwater
shows the maximum number of competing TCP clients per run, and BIND also supports an algorithm for SipHash-2-4-based DNS cookies, as described in RFC 7873. The named-checkconf
command takes into account DNS64 network extensions that allow NAT from IPv6 clients on IPv4 servers.
In case of a distributed denial-of-service (DoS) attack, the servers no longer return SERVERFAIL
messages but fall back on old cached records thanks to the new stale-answer
function. The feature can be (de)activated via the configuration file or the remote control channel (rndc
).
Secure with OpenSCAP
The Defense Information Systems Agency (DISA) is an agency of the U.S. Department of Defense that was founded back in 1960 and has coined numerous abbreviations [2], which mostly relate to communication programs or technologies for the U.S. military services. One of the abbreviations is STIG, which stands for Security Technical Implementation Guides; it consists of recommendations for hardening the security of your own IT systems.
Red Hat customers who want to base their security on these recommendations can now look forward to a suitable profile and kickstart file for OpenSCAP. SCAP is the Security Content Automation Protocol that Red Hat users deploy for automated system monitoring and predefined security policy compliance checks as needed.
Armed with the new profile and the kickstart file for OpenSCAP, customers can check whether their systems are STIG-compliant. And not only that: The scap-security-guide packages also include a profile and the appropriate kickstart files for the Essential Eight policy of the Australian Cyber Security Center (ACSC).
In RHEL 8.2, users of the Podman container software, which – in contrast to Docker – does not require root privileges or a daemon, can use the oscap-podman
tool to scan containers with OpenSCAP to identify security holes and check compliance.
SELinux Extension
Numerous other changes affect SELinux and the associated tools and types. udica
, a tool introduced with RHEL 8.2, generates SELinux security policies specifically adapted to containers. If a container reports an access denial caused by udica
, udica
will change the associated policy if desired. In this case, the admin adds the new rule via the parameter -a
or --append-rules
.
There is also a new setroubleshoot
plugin for SELinux. setroubleshoot
detects blocked execmem
access and gives the admin advice on how to proceed. The setools-gui package was already available in RHEL 7 and is now also on board in RHEL 8.2.
SELinux also manages lvmdbusd
, a D-Bus API for the Logical Volume Manager (LVM). Users restricted by SELinux are allowed to manage user session services themselves starting in RHEL 8.2, for example, by running the systemctl --user
command. The semanage port
tool no longer exclusively focuses on TCP and UDP ports, but also on Stream Control Transmission Protocol (SCTP) and Datagram Congestion Control Protocol (DCCP) ports.
Further security updates affect the clevis
command, which provides admins with information about LUKS-encrypted disks and also decrypts them automatically.
Rsyslog can now communicate with REST interfaces thanks to the omhttp
plugin. The audit package has seen an update, as has the Audit subsystem in the kernel. Red Hat has also incorporated changes from the first release candidate of kernel 5.5, including improved search options on remote filesystems. Last but not least, the new release includes updates for sudo
and PAM.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Endless OS 6 has Arrived
After more than a year since the last update, the latest release of Endless OS is now available for general usage.
-
Fedora Asahi 40 Remix Available for Macs with Apple Silicon
If you've been anticipating KDE's Plasma 6 for your Apple Silicon-powered Mac, then you're in luck.
-
Red Hat Adds New Deployment Option for Enterprise Linux Platforms
Red Hat has re-imagined enterprise Linux for an AI future with Image Mode.
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.