Migration Planning Guide
Migrating to Red Hat Enterprise Linux 7
Abstract
Chapter 1. How to Upgrade
1.1. How to upgrade from Red Hat Enterprise Linux 6
- Check that Red Hat supports the upgrade of your system. See Section 1.1.1, “Check your support status” for details.
- Prepare your system for upgrade. See Section 1.1.2, “Prepare your system for upgrade” for details.
- Check your system for problems that might affect your upgrade. See Section 1.1.3, “Check system upgrade suitability” for details.
- Upgrade by running the Red Hat Upgrade Tool. See Section 1.1.4, “Upgrade your system” for details.
1.1.1. Check your support status
- Your system is on the latest version of the Server variant of Red Hat Enterprise Linux 6 for Intel 64 and AMD64 architecture, with all packages up to date. To check, enter the following commands:
# cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.9 (Santiago) # arch x86_64 # yum upgrade -y
- Your system is registered to receive updates from Subscription Management and not RHN Classic.
- Your system includes only the following package groups:
- Minimal
- Base
- Web Server
- DHCP Server
- NFS File Server (
@nfs-server) - Print Server
- CIFS file server
Remove other package groups before upgrading and reinstall them when your upgrade is complete.
1.1.2. Prepare your system for upgrade
- Back up all data
- Firstly, back up the entire system to avoid potential data loss, and test that your backup works.
- Test first
- Before you upgrade a production system, you should clone the system and test the upgrade procedure on the clone. This will allow you to prepare for upgrade without risking the production system.
- Convert to Red Hat Subscription Management
- Red Hat Enterprise Linux 7 must be registered with the Subscription Management tool (
subscription-manager) rather than RHN Classic tools likerhn_register. See https://access.redhat.com/articles/433903 for details on getting started with Subscription Management.Before it begins upgrading packages, theyum upgradecommand outputs a statement about how this system receives updates. Ensure thatsubscription-managerand not RHN is mentioned here.# yum upgrade Loaded plug-ins: product-id, security, subscription-manager ...
If your Red Hat Enterprise Linux 6 system is currently registered to RHN Classic, you must first unregister from RHN Classic by following these instructions: https://access.redhat.com/solutions/11272. - Ensure only supported package groups are installed
- This upgrade process supports only the following package groups:
- Minimal
- Base
- Web Server
- DHCP Server
- NFS File Server (
@nfs-server) - Print Server
- CIFS file server
Check which package groups are installed using theyum grouplistcommand. Remove other package groups before upgrading and reinstall them when your upgrade is complete. - Update all packages
- Once your system is registered with Subscription Management, ensure that all packages on your system are up to date by running the following commands.
# yum update -y # reboot
1.1.3. Check system upgrade suitability
- Install and run the Preupgrade Assistant,
preupg. See Section 1.1.3.1, “Installing the Preupgrade Assistant” and Section 1.1.3.2, “Running the Preupgrade Assistant” for details. - Correct any problems identified by the Preupgrade Assistant. See Section 1.1.3.3, “Viewing results and correcting errors” for details.
- Consult the Release Notes, Technical Notes, and Migration Planning Guide to ensure that you are aware of any changes that the Preupgrade Assistant does not assess. The latest versions of these documents are available from https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/.
1.1.3.1. Installing the Preupgrade Assistant
Enable the Extras repository
As root, enter the following command to subscribe your system to the repository containing the Preupgrade Assistant.If your system receives updates from Red Hat Subscription Management:# subscription-manager repos --enable rhel-6-server-extras-rpms
Install the tool
As root, enter the following command to install all the Preupgrade Assistant packages.# yum -y install preupgrade-assistant preupgrade-assistant-el6toel7
1.1.3.2. Running the Preupgrade Assistant
# preupg -v
# preupg -v -u http://hostname:port/submit
1.1.3.2.1. Configuring the Preupgrade Assistant Web UI
Warning
httpd) and a number of changes to the /etc/httpd/conf.d directory. If you are concerned about exposing data about your system to the network, or you want to avoid adding packages to the system you intend to upgrade, do not follow this procedure. Instead, copy the /root/preupgrade/result.html file to a machine with a graphical user interface and view it in a web browser.
Install required packages
# yum -y install httpd preupgrade-assistant-ui
Change upload configuration
Change from using the default private pre-upgrade configuration to the public configuration.# cd /etc/httpd/conf.d # cp 99-preup-httpd.conf.public 99-preup-httpd.conf
This makes the Preupgrade Assistant Web UI available to all network interfaces on the local system, through TCP port 8099 by default.You can also edit theNameVirtualHostvariable in the new/etc/httpd/conf.d/99-preup-httpd.confto set a host name, if you want to access Preupgrade Assistant Web UI through a host name likepreupg-ui.example.com:8099instead of an IP address like192.168.99.1:8099.Change firewall and SELinux configuration
Temporarily put SELinux in permissive mode, and allow traffic through TCP port 8099.# setenforce 0 # iptables -I INPUT -m state --state NEW -p tcp --dport 8099 -j ACCEPT
Restart the web server
# service httpd restart
Configure or disable authentication
In a web browser, navigate tohttp://192.168.99.1:8099/(or the host name, if you specified one in Step 2). You are prompted to either enter details to create a new administrative user, or disable authentication.
preupg command with the -u http://hostname:port/submit option on that system.
1.1.3.3. Viewing results and correcting errors
preupg, a summary of results is printed to standard output. Detailed results are saved to the /root/preupgrade directory as result.html by default. You can also upload results to the Preupgrade Assistant Web UI to compare multiple preupg runs as you correct potential migration issues.
Table 1.1. Exit Codes
|
Exit Code
|
Definition
|
|
PASS
|
Everything looks fine, and this item is ready to upgrade.
|
|
FAIL
|
Extreme upgrade risk. upgrade is not possible.
|
|
NEEDS_ACTION
|
High upgrade risk. Some administrator action is required before you upgrade.
|
|
NEEDS_INSPECTION
|
Moderate and lower risk. Upgrading should succeed, but may result in a system that is not fully functional.
|
|
FIXED
|
A change required for upgrade was made automatically.
|
|
INFORMATIONAL
|
Useful but noncritical information about this item is available in the report.
|
|
NOT_APPLICABLE
|
Preupgrade Assistant checked for an item that was not installed on your system.
|
|
ERROR
|
Something has probably gone wrong with the pre-upgrade tools. Report this type of problem to Red Hat Support.
|
1.1.4. Upgrade your system
Important
preupgrade-assistant has not been run
Warning
Install the tool
# yum -y install redhat-upgrade-tool
Disable active repositories
# yum -y install yum-utils # yum-config-manager --disable \*
Perform the upgrade
The upgrade process requires access to Red Hat Enterprise Linux 7 packages. You can specify the location of a repository on the network or on a mounted device, or an ISO image, as shown below.# redhat-upgrade-tool --network <latest_RHEL_7> --instrepo repo_location
# redhat-upgrade-tool --device device_path
# redhat-upgrade-tool --iso iso_path
Some packages that were in the Base package group in Red Hat Enterprise Linux 6 are no longer part of that group in Red Hat Enterprise Linux 7. You may need to configure additional repositories in order to upgrade these packages correctly.Refer to https://access.redhat.com/site/solutions/912213 to enable the Extras repository on the yum repository system. Then see https://access.redhat.com/site/solutions/9892 to set up a repository that you can use during your upgrade. The upgrade command for this use case would look similar to the following.# redhat-upgrade-tool --addrepo optional=http://host name/path/to/repo
Some packages are not reinstalled during the upgrade process because they have no functionally equivalent replacements in Red Hat Enterprise Linux 7. Red Hat does not provide any support for these packages. To remove these packages at the end of the upgrade process, enter the following command:# redhat-upgrade-tool --cleanup-post
Reboot
When prompted, reboot the system.Wait for upgrade to complete
After your system reboots, upgrade can take several minutes or several hours, depending on the number of packages to install.Perform post upgrade tasks
Manually perform any post upgrade tasks described in the Preupgrade Assistant assessment result. See Section 1.1.3.3, “Viewing results and correcting errors” for details.Important
If Samba is installed on the upgraded host, manually run thetestparmutility to verify the/etc/samba/smb.conffile. Iftestparmreports any configuration errors, you must fix them before you can start Samba.Check system status
Check that your system's subscription details have been updated as part of the upgrade process.# cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.4 # yum repolist Loaded plug-ins: product-id, subscription-manager repo id repo name status rhel-7-rpms Red Hat Enterprise Linux 7 Server (RPMs) 4,323
If the list of your repositories did not update correctly, perform the following commands:# subscription-manager remove --all # subscription-manager unregister # subscription-manager register # subscription-manager attach --pool=poolID # subscription-manager repos --enable=repoID
Update all packages
Ensure that all packages are up to date by running the following:# yum upgrade -y # reboot
Chapter 2. Major Changes and Migration Considerations
2.1. System Limitations
- at most 3 TB memory (theoretical limit: 64 TB)
- at most 160 logical CPUs (theoretical limit: 5120 logical CPUs)
- at most 2 TB memory (theoretical limit: 64 TB)
- at most 128 logical CPUs (theoretical limit: 2048 logical CPUs)
- at most 3 TB memory
- at most 101 logical CPUs
2.2. Installation and Boot
2.2.1. New Boot Loader
Table 2.1. Recommended minimum partition sizes
| Partition | BIOS & MBR | BIOS & GPT | UEFI & GPT |
|---|---|---|---|
/boot | 500 MB | ||
/ | 10 GB | ||
| swap | At least twice the RAM. See Section 6.10.4.5. Recommended Partitioning Scheme in the Red Hat Enterprise Linux 7 Installation Guide for details. | ||
| boot loader | N/A (Installed between the partition table and the first partition) | 1 MB (BIOS Boot Partition) | 200 MB (EFI System Partition |
force option at the risk of causing file system damage, or use an alternative boot loader. For a list of alternative boot loaders, see the Red Hat Enterprise Linux 7 Installation Guide, available from http://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/.
# grub2-mkconfig -o /boot/grub2/grub.cfg
Important
# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
2.2.1.1. Default Boot Entry for Debugging
/etc/grub.cfg file. It is no longer necessary to enable debugging manually. The default boot entry allows you to debug systems without affecting options at the boot time.
2.2.2. New Init System
2.2.2.1. Backwards Compatibility
- Standard
/etc/init.d/servicenamecommands (start,stop,status) still work. However, Red Hat recommends/usr/sbin/service servicenamecommands, as they forward directly tosystemdrather than using legacy init scripts. - Run level support is limited. All SysV run levels map to systemd targets; however, not all systemd targets map to SysV run levels. Some checks for the current run level will therefore return
N(unknown run level). Red Hat recommends avoiding run level checks and moving to the more useful systemd targets. - Legacy run levels 2, 3, and 4 all map to the
multi-user.targetsystemd target by default. Users can modify this behavior by configuring different systemd targets. - Services execute cleanly and do not inherit any context of the invoking user. Init scripts depending on inherited context will not work.
- systemd does not support additional verbs in init scripts. If you require verbs other than
start,stop, orstatus, move them to an auxiliary script. - Linux Standard Base header information is now fully interpreted and utilized by systemd at run time.
- All init script operations are now subject to a timeout of 5 minutes to prevent the system from freezing because of a hanging init script.
- systemd stops only running services; services that were not started are also not stopped during shutdown.
- The chkconfig tool shows only SysV services and run level information, and may output misleading information. Red Hat recommends using the
systemctlcommand instead. - SysV services, even those with root privileges, cannot acquire real-time scheduling when the
CPUAccountingoption is enabled. WithCPUAccountingenabled for any service, systemd makes use of the CGroup CPU bandwidth controller globally, and subsequentsched_setscheduler()system calls terminate unexpectedly due to real-time scheduling priority. To avoid this error to recur, the CGroupcpu.rt_runtime_usoption can be set for the real-time using service. - Services can no longer read from standart input (stdin). If you require interactive scripts, consider the minimal password querying framework supported by systemd. Further information about this functionality is available from the man page:
$ man systemd-ask-password
- Previous versions of Red Hat Enterprise Linux included a System z specific preinstallation script (
linuxrc.s390), which started System z systems at boot time. The new init system obsoletes this preinstallation script, and System z systems now boot in the same way as AMD64, Intel® 64 and Power systems.
2.2.2.2. Systemd-debug-generator
systemd.mask=- If this option is specified and followed by a unit name, this unit is masked for the runtime. At boot, it is useful to hae certain units removed from the initial boot transaction for debugging system startup. This option may be specified more than once.
systemd.wants=- If this option is specified and followed by a unit name, a start job for this unit is added to the initial transaction. This is useful if you want to start one or more additional units at boot. This option may be specified more than once.
systemd.debug_shell- If this option is specified, the
debug-shell.serviceis pulled into the boot transaction. It will spawn a debug shell on tty9 during early system startup. Note that the shell may also be turned on persistently by using asystemctl enablecommand.
2.2.2.3. New Installer
- A redesigned graphical user interface that is faster, more flexible, and requires less input from the user.
- Support for LVM thin provisioning.
- Installation support for btrfs. (Note, however, that btrfs is a Technology Preview in Red Hat Enterprise Linux 7.)
- Improved localization support.
- Support for directly formatted and not partitioned devices.
- Support for teaming and bonding network technologies.
- Support for automatically selecting an appropriate keyboard layout, language, and time zone. (This requires internet connectivity.) Values set based on detection are overridden by any manually set values.
- NTP servers advertised by DHCP are now used automatically.
- Kickstart integration for the
realmdD-Bus service, Active Directory, and FreeIPA. - A new text mode that works on IBM System z and PowerPC systems, and serial consoles. Text mode provides a subset of the features provided by the graphical installer.
- Previously, storage configuration required that the user have detailed technical knowledge of their storage system. In Red Hat Enterprise Linux 7, storage configuration has been redesigned so that users need to enter minimal detail to configure storage.
- Anaconda now uses the
inst.repoparameter to set network and other install locations instead of using theinst.rootparameter. - Detailed package selection in the graphical installer interface has been replaced by the Software Selection screen. Software is divided up in to Environments and Addons. Users pick one environment and any number of add-ons. Kickstart installations continue to have full control over packages selected at install time.
2.2.2.4. Boot parameter changes
2.2.2.4.1. Specifying boot parameters
inst. in this guide. Currently, this prefix is optional in Red Hat Enterprise Linux 7: resolution=1024x768 works exactly the same as inst.resolution=1024x768. However, this prefix is expected to become mandatory in future releases, and parameters without prefix are considered deprecated.
2.2.2.4.2. Changes to boot parameters
2.2.2.4.2.1. New parameters
- inst.stage2
- Specifies the location of the installation program runtime image to be loaded. The syntax is the same as the syntax of the
inst.repoparameter. This option ignores everything but the image; it cannot be used to specify the location of packages. - inst.dd
- Updates a driver package with a package at the location specified. This option can be used multiple times. The location syntax is the same as the location syntax of the
inst.repoparameter. - inst.geoloc
- Configures geolocation usage in the installer to preset the language and time zone. The default value is
provider_fedora_geoip. Valid values for this parameter include the following.Table 2.2. Geolocation values
ValueEffect0Disables geolocation.provider_fedora_geoipUses the Fedora GeoIP API.provider_hostipUses the Hostip.info GeoIP API. - inst.usefbx
- Specifies that the frame buffer X driver should be used instead of a hardware specific driver. This option is equivalent to
inst.xdriver=fbdev. - bootdev
- Specifies the boot interface. This option is mandatory if
ipis specified more than once. - inst.multilib
- Configures the system for multilib packages, for example, to allow 32-bit packages to be installed on a 64-bit system.
- gpt
- Installs partition information into a GUID Partition Table (GPT) instead of the Master Boot Record (MBR).
- inst.virtiolog
- Specifies a virtio port to be used to forward logs. The default value is
org.fedoraproject.anaconda.log.0. If this port exists, it will be used. - rd.dasd
- Takes a Direct Access Storage Device (DASD) adaptor device bus identifier and, optionally, comma separated
sysfsparameter and value pairs. Activates the DASD with the specified device bus ID and sets the mentionedsysfsparameters to the values specified. For example,rd.dasd=adaptor_id,readonly=0. This parameter can be specified multiple times to activate multiple DASDs. - rd.zfcp
- Takes a SCSI over FCP (zFCP) adaptor device bus identifier, a world wide port name (WWPN), and a FCP LUN. Activates the zFCP device with the specified device bus identifier, port name, and LUN. This parameter can be specified multiple times to activate multiple zFCP devices.
rd.zfcp=0.0.4000,0x5005076300C213e9,0x5022000000000000
- rd.znet
- Takes a network protocol type, a comma delimited list of subchannels, and, optionally, comma delimited
sysfsparameter and value pairs. Activates the System z network device driver for the specified protocol, sets up the specified subchannels, and sets the parameters specified. This parameter can be specified multiple times to activate multiple network devices.rd.znet=qeth,0.0.0600,0.0.0601,0.0.0602,layer2=1,portname=foo rd.znet=ctc,0.0.0600,0.0.0601,protocol=bar
2.2.2.4.2.2. Changed parameters
- inst.ks.sendmac
- Previously
kssendmac. Adds headers to outgoing HTTP requests including the MAC addresses of all network interfaces. This is useful when usinginst.ks=httpto provision systems. - name server
- Previously
dns. Specifies the address of the name server. This option can be used multiple times.
2.2.2.4.2.3. Deprecated parameters
- updates
- Specified the location of updates for the installation program. Use the
inst.updatesoption instead. - method
- Configured the installation method. Use the
inst.repo=option instead. - repo
- In NFS installations, specified that the target was an ISO image located on an NFS server instead of an installable tree. The difference is now detected automatically, making this option the same as
inst.repo=nfs:server:/path. - dns
- Configured the Domain Name Server (DNS). Use the
nameserver=option instead. - netmask, gateway, hostname, ip, ipv6
- These options have been consolidated under the
ipoption. - ip=bootif
- Specified the
BOOTIFoption used when installing from a PXE server. This is now detected automatically. - ksdevice
- Configured the network device to be used during a Kickstart installation. Different values for this parameter have been replaced with different parameters as per the following table.
Table 2.3. kickstart parameter values
ValueCurrent behaviorNot presentAttempt to activate all devices with DHCP, unless a device and configuration are specified with theiporBOOTIFoptions.ksdevice=linkIgnored (this is the same as the default behavior).ksdevice=bootifIgnored (BOOTIFis used as the default if specified).ksdevice=ibftReplaced with dracut optionip=ibft.ksdevice=MACReplaced withBOOTIF=MAC.ksdevice=deviceReplaced with device specification in the dracutipoption. - blacklist
- Used to disable specified drivers. This is now handled by the
rd.driver.blacklistdracut option with the following syntax:rd.driver.blacklist=mod1,mod2,...
- nofirewire
- Disabled support for the FireWire interface. You can disable the FireWire driver (
firewire_ohci) by using therd.driver.blacklistoption instead:rd.driver.blacklist=firewire_ohci
2.2.2.4.2.4. Removed parameters
- serial
- This option forced Anaconda to use the
/dev/ttyS0console as the output. Use theconsoleparameter to specify the/dev/ttyS0console (or similar) instead. - essid, wepkey, wpakey
- Configured wireless network access. Network configuration is now handled by dracut, which does not support wireless networking, rendering these options useless.
- ethtool
- Used in the past to configure additional low-level network settings. All network settings are now handled by the
ipoption. - gdb
- Allowed you to debug the loader. Use
rd.debuginstead. - inst.mediacheck
- Verified the installation media before starting the installation. Replaced with the
rd.live.checkoption. - ks=floppy
- Specified a diskette as the Kickstart file source. Floppy drives are no longer a supported boot medium.
- display
- Configured a remote display. Replaced with the
inst.vncoption. - utf8
- Added UTF8 support when installing in text mode. UTF8 support now works automatically.
- noipv6
- Disabled IPv6 support in the installation program. IPv6 is now built into the kernel so the driver cannot be blacklisted; however, it is possible to disable IPv6 using the
ipv6.disabledracut option. - upgradeany
- Upgrades have changed inRed Hat Enterprise Linux 7. For more information, see Chapter 1, How to Upgrade, Section 3.1.1, “Preupgrade Assistant”, and Section 3.1.2, “Red Hat Upgrade Tool”.
- vlanid
- Configured a VLAN device. Replaced with the dracut
vlanoption.
2.2.3. Changes to firstboot Implementation
2.2.4. Changed mount behavior at boot
/etc/fstab could be mounted. This could result in a system appearing "up" and healthy, while booting without required partitions.
/etc/fstab cannot be mounted at boot, boot fails. If a partition should not cause boot to fail in the event that it cannot be mounted, use the new nofail parameter in /etc/fstab.
/dev/critical /critical xfs defaults 1 2 /dev/optional /optional xfs defaults,nofail 1 2
/optional would not cause boot to fail if it could not be mounted successfully.
2.2.5. Changes to /etc/issue file
/etc/issue file contained the product name and the release number of the machine. As of Red Hat Enterprise Linux 7, the product name and the release number have been moved into the /etc/os-release file and the first line of /etc/issue now contains an agetty escape code \S. The \S escape code expands in the console displaying a product name and the release number of the machine. The code is represented by the PRETTY_NAME variable, which is defined in the /etc/os-release file.
Important
\S escape code works only from the console. Using the expansion in an environment that does not support it will result in printing only "\S".
\S, see the agetty man pages.
2.3. File System Layout
- The
/bin,/sbin,/liband/lib64directories are now under the/usrdirectory. - The
/tmpdirectory can now be used as a temporary file storage system (tmpfs). - The
/rundirectory is now used as a temporary file storage system (tmpfs). Applications can now use/runthe same way they use the/var/rundirectory.
2.3.1. New layout for root file system
/bin and /lib directories to avoid slowing down the boot process. Some of the utilities needed to be at the root (/) level in order to mount the /usr partition. This created a situation where other utilities spread their content over multiple levels of directories, for example, in both /bin and /usr/bin.
/bin, /sbin, /lib and /lib64 directories into /usr. Because the /usr file system can now be mounted by initramfs rather than by utilities in root level directories, there is no longer a need to split package contents between the two different directory levels. This allows for a much smaller root file system, enabling systems that can more efficiently share disk space, and systems that are easier to maintain, more flexible, and more secure.
/bin directory is now a symbolic link to /usr/bin, /sbin to /usr/sbin, and so on.
2.3.1.1. Preparing your file system for upgrade
Warning
/usr is on a separate partition, the in-place upgrade is not possible. If you decide to move the /usr from the separate partition, be aware that this is at your own risk.
/var is on a separate partition, you must manually convert /var/run and /var/lock to symbolic links:
# mv -f /var/run /var/run.runmove~ # ln -sfn /run /var/run # mv -f /var/lock /var/lock.lockmove~ # ln -sfn /run/lock /var/lock
Important
2.3.1.2. Verifying a successful upgrade
- Check that the following symbolic links exist:
/binis a symbolic link to/usr/bin/sbinis a symbolic link to/usr/sbin/libis a symbolic link to/usr/lib/lib64is a symbolic link to/usr/lib64/var/runis a symbolic link to/run/var/lockis a symbolic link to/run/lock
If the directories listed are symbolic links, as expected, two more checks are required. - Check the output of the following find command:
# find /usr/{lib,lib64,bin,sbin} -name '.usrmove'Files or directories displayed in response to this command could not be copied to/usrbecause a file or directory with the same name was already present in/usr. You will need to manually resolve these naming conflicts. - Check the following directories for files that you want to keep:
/var/run.runmove~/var/lock.lockmove~
2.3.1.3. Recovering from a failed upgrade
# dmesg # journalctl -ab --full
/is writable/usris writable/usrmounted correctly/has sufficient space/usrhas sufficient space/varis mounted in the rhelup tool
2.3.2. Changes to the /tmp directory
/tmp as a mount point for a temporary file storage system (tmpfs).
/tmp are stored on the hard drive except when memory is low, in which case swap space is used. This means that the contents of /tmp are not persisted across a reboot.
# systemctl enable tmp.mount
# systemctl disable tmp.mount
- Privileged processes, such as daemons, should use
/run/processnameto store temporary data. - Processes that store a large amount of data, or require temporary data to persist across reboots, should use
/var/tmp. - All other processes should use
/tmpto store temporary data.
2.3.3. Changes to the /run directory
Important
/dev directory during early boot, prior to the /var directory being mounted. Consensus between major Linux distributions is that /run should be used instead, as the /dev directory should be used only for device nodes.
/run directory is a temporary file storage system (tmpfs) that bind mounts the /var/run directory. Likewise, the /run/lock directory now bind mounts the /var/lock directory. Files stored in /run and /run/lock are no longer persistent and do not survive a reboot. This means that applications must recreate their own files and directories on startup, rather than doing this once at installation time. An /etc/app_name directory would be ideal for this.
tmpfiles.d man page: man tmpfiles.d. For example configuration, see the configuration files in /etc/tmpfiles.d.
2.4. System Management
2.4.1. Default process maximums (ulimit)
/etc/security/limits.d/*-nproc.conf file (usually /etc/security/limits.d/20-nproc.conf on Red Hat Enterprise Linux 7). If this file is not present, the maximum number of processes that a non-root user can own is determined programmatically, as described in https://access.redhat.com/solutions/218383.
ulimit -u command.
2.4.2. Configuration File Syntax
export command was used in configuration files to export the values defined in those files. Variables that did not use the export command were not exported and were used only as configuration values for the corresponding init script. This is an example /etc/sysconfig/sshd file:
AUTOCREATE_SERVER_KEYS=YES export SSH_USE_STRONG_RNG=1 export OPENSSL_DISABLE_AES_NI=1
SSH_USE_STRONG_RNG and OPENSSL_DISABLE_AES_NI were exported to the environment of the ssh daemon. The variable AUTOCREATE_SERVER_KEYS was used to tell the init script to automatically create RSA and DSA server private and public keys.
export command is no longer required for these values to be exported to the environment of the service being configured. Therefore the following example /etc/sysconfig/sshd file exports all three values to the environment of the ssh daemon:
AUTOCREATE_SERVER_KEYS=YES SSH_USE_STRONG_RNG=1 OPENSSL_DISABLE_AES_NI=1
2.4.3. New Logging Framework
journald, as part of the move to systemd. journald captures the following types of message for all services:
syslogmessages- kernel messages
- initial RAM disk and early boot messages
- messages sent to standard output and standard error output
/run/log/journal directory, the oldest journal files will be removed in order to continue logging.
rsyslog and journald coexist. The data collected by journald is forwarded to rsyslog, which can perform further processing and store text-based log files. By default, rsyslog only stores the journal fields that are typical for syslog messages, but can be configured to store all the fields available to journald. Red Hat Enterprise Linux 7 therefore remains compatible with applications and system configurations that rely on rsyslog.
2.4.4. Localization Settings
systemd, localization settings have moved from /etc/sysconfig/i18n to /etc/locale.conf and /etc/vconsole.conf.
2.4.5. Hostname Definition
hostname variable was defined in the /etc/sysconfig/network configuration file. In Red Hat Enterprise Linux 7, as part of the move to the new init system (systemd), the hostname variable is defined in /etc/hostname.
2.4.6. Updates to Yum
yum groupandyum groupsare now top level commands, to improve the consistency of command line yum use. For example, where previously you would useyum groupinfo, you can now useyum group info.yum group listnow includes additional optional parameters to alter its output. The new options arelanguageandids.- The default value for the
group_commandparameter in/etc/yum.confhas been changed fromcompattoobjects. Previously, the default behavior ofyum group installwas to install all members of a package group and upgrade both previously installed packages and packages that had been added to the group since the previous upgrade. The new default behavior is that yum keeps track of the previously installed groups and distinguishes between packages installed as a part of the group and packages installed separately. - The
yum-securityandyum-prestoplug-ins have been integrated into yum. - yum can now download multiple packages simultaneously.
- yum now includes support for environment groups. This allows you to install and remove multiple package groups listed under an environment group as a single entity.
- yum can now treat a repository as a set of packages, allowing users to treat all packages in a repository as a single entity, for example, to install or remove all packages in that repository. This capability is provided by the
repository-packagessubcommand. - yum now includes a
--disableincludesoption, which allows you to disableincludestatements defined in your configuration files. You can either disable allincludestatements with theallvalue, or disable theincludestatements defined for a specific repository by providing that repository identifier. - yum now includes an
--assumenooption, which assumes that the answer to any question asked by yum is 'no'. This option overrides the--assumeyesoption, but is still subject to the behavior prescribed byalwaysprompt.
$ man yum
2.4.7. Updates to RPM Package Manager (RPM)
- Conflict detection is now stricter and more correct. Some packages that would have installed on Red Hat Enterprise Linux 6 may not install on Red Hat Enterprise Linux 7 because of this heightened conflict sensitivity.
- A package that conflicts with other versions of itself can now be set up as a singleton using alternatives, so that multiple versions of a single package can be installed alongside each other.
- If an installed package lists another package as obsolete, the second package is not installed.
- Obsolete rules now include all matching packages regardless of other attributes such as architecture.
- Dependency calculations no longer consider files that were not installed or files that were replaced, for example, with the
--nodocs,--noconfig, or--forceoptions, as being provided. - There is no longer a need to manually execute
rm -f /var/lib/rpm/__db.when rebuilding a panicked (DB_RUNRECOVER) RPM Package Manager database. - Public keys created with OpenPGP 3 are no longer supported.
- The
--infooption now outputs individual tag–value pairs per line to improve human readability. Any scripts that rely on the previous--infoformat need to be rewritten. - The spec parser is now stricter and more correct, so some previously-accepted spec files may fail to parse, or give warnings.
%licensecan now be used to mark files in the%filessection of a spec file as licenses that must be installed even when--nodocsis specified.- Version comparison now supports the dpkg-style tilde (
~) operator to handle pre-release software better. For example,foo-2.0~beta1is considered older thanfoo-2.0, removing the need for tricks with the Release field to handle these common upstream version practices. - The automatic dependency generator has been rewritten into an extensible, customizable rule-based system with built in filtering.
- It is now possible to query the files installed from a package (
INSTFILENAMES), the number of hard links to a file (FILENLINKS), package version control system details (VCS), and formatted dependency string shortcuts (PROVIDENEVRS,REQUIRENEVRS,CONFLICTNEVRS,OBSOLETENEVRS). - A number of new commands are provided, including:
rpmkeysrpmdbrpmspecrpmsign
- RPM Package Manager now includes new switches to scriptlets to enable runtime macro expansion or runtime query format expansion.
- Pre- and post-transaction scriptlet dependencies can now be correctly expressed with
Requires(pretrans)andRequires(posttrans). - RPM Package Manager now includes the
OrderWithRequirestag to allow users to supply additional ordering information. This new tag uses the same syntax as the Requires tag, but does not generate dependencies. If mentioned packages are present in the same transaction, the ordering hints are treated likeRequireswhen calculating transaction order. - Line continuations and macro expansions in spec files are no longer limited to a specified length.
- RPM Package Manager now allows users to specify upstream version control repository information.
- RPM Package Manager now includes an
%autosetupmacro to assist in automating the process of applying patches.
2.4.8. New Format of ifconfig
ip addr, ip link) instead of the deprecated ifconfig tool.
2.4.9. Changes to Control Groups
- Control groups are now mounted under
/sys/fs/cgroupinstead of/cgroup. - Some file systems are now mounted by default.
systemddoes not yet fully support migration fromlibcgrouptosystemd. As such, thecgredservice should be used only to move processes to groups not managed bysystemd. Thecgconfig.conffile should be used to configure a control group hierarchy for file systems or file controllers not managed bysystemd.
2.4.10. Changes to Kernel Crash Collection (Kdump)
initrd) for the kdump capture kernel with a custom mkdumprd script. In Red Hat Enterprise Linux 7 the initial RAMDisk is generated with dracut, making the process of generating the initial RAMDisk easier to maintain.
- The
netdirective is no longer supported. Users must now explicitly define eithersshornfs. - The
blacklistoption is no longer supported. Instead, users can specifyrd.driver.blacklistas a parameter in the/etc/sysconfig/kdumpfile of their capture kernel. - The default
mount_root_run_initaction, which was performed if dumping to an intended target failed, has been replaced by thedump_to_rootfsaction. Instead of mounting the real root file system, running init scripts, and attempting to save the vmcore when thekdumpservice has started, this new action mounts the root file system and saves the vmcore to it immediately. - A new directive,
dracut_args, allows you to specify additional dracut arguments when configuring kdump. - The
debug_mem_leveloption is no longer included in kdump. This functionality has been moved to dracut. Users can achieve the same functionality by specifyingrd.memdebugas a parameter in the/etc/sysconfig/kumpfile of their capture kernel. - The
optionsdirective was previously used to include parameters specific to the kernel module in the initial ram file system (initramfs). This method is not supported in Red Hat Enterprise Linux 7. Instead, users can specify relevant parameters in the/etc/sysconfig/kdumpfile of their capture kernel. - The
link_delayanddisk_timeoutparameters are no longer necessary or supported, as dracut containsudev, which addresses the use case for which these parameters were previously required. - Any file system back-end dump targets must be mounted in the crashed kernel before the kdump service is started and the initial RAMDdisk image is created. You can achieve this by adding these targets to
/etc/fstabto be automatically mounted at boot time. - If you specify a path, but do not specify a target, and any directory in the path that you specify is a mount point for a separate device, the vmcore is saved to the path, not the device mounted somewhere along that path. Therefore when your system reboots, and the device mounts, the vmcore is inaccessible, because the device has mounted over the top of its location. Red Hat Enterprise Linux 7 now warns about this issue when you specify a path without specifying a target.
2.4.11. Changes to usermod behavior
-g option of the usermod command did not manipulate group ownership. From Red Hat Enterprise Linux 7.0 to Red Hat Enterprise Linux 7.2 release, the -g option modified the group ownership of the files in the /home directory tree. Starting from Red Hat Enterprise Linux 7.3, usermod changes the group ownership of the files inside of the user’s home directory only if the home directory user ID matches the user ID being modified.
2.4.12. Changes to System accounts
Table 2.4. ID layout
| Range | Red Hat Enterprise Linux 6 | Red Hat Enterprise Linux 7 |
|---|---|---|
| System accounts | 0-499 | 0-999 |
| User accounts | 500-60,000 | 1,000-60,000 |
/etc/login.defs file.
2.5. File System Formats
2.5.1. New Default File System: XFS
2.5.1.1. Changes to mount options
user_xattr and acl mount options by default. This means that you will encounter errors like the following if you include these options at either the command line or in /etc/fstab.
$ mount -o acl /dev/loop0 test
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so.mount command or mount them with /etc/fstab.
2.5.2. Btrfs Technology Preview
2.5.2.1. Kickstarting btrfs
part command with the --fstype to create a partition that used a particular file system, like so:
part /mnt/example --fstype=xfs
btrfs is not a valid value for the --fstype parameter. Instead, use the btrfs command to define a btrfs volume, like so:
btrfs mount_point --data=level --metadata=level --label=label partitions
2.5.3. Extended file system support
2.6. Physical Storage
2.6.1. Changed mount behavior at boot
nofail option, as shown.
/dev/essential-disk /essential xfs auto,defaults 0 0 /dev/non-essential-disk /non-essential xfs auto,defaults,nofail 0 0
2.6.2. Using LVM snapshots as a rollback mechanism
Warning
/boot partition.
- Add another disk. Instructions can be found in the Red Hat Enterprise Linux 7 Storage Administration Guide, available from http://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/.
- Use parted to check for free space that is not allocated to an existing partition.
- Use lsblk to check for empty partitions, or partitions that can be deleted to free space.
- Use vgdisplay to check for free space in a volume group that is not allocated to a logical volume.
- Use df to check for file systems that have free space and can be reduced, so that their logical volume or partition can be shrunk to free space.
- Snapshot size is not adjusted automatically. If your snapshot gets too large for its partition, it may become invalid, and rollback will fail. It is therefore imperative to allocate a sufficiently large space for a snapshot of your entire system, before creating that snapshot. If you need to resize a root snapshot, you will need an additional device such as a Live CD that can be used as a root device while your original root device is unmounted and resized.
- The copy-on-write device of a snapshot is not mirrored, and will be on a single device regardless of whether your system is mirrored. If the device fails and you lose the snapshot, rollback is impossible. Red Hat recommends using a physical volume with mdraid, or using multiple snapshots to separate disks. Using multiple snapshots is slower.
- In the event of a crash during installation, the system can become impossible to boot. In this circumstance, Red Hat recommends booting with a Live CD or PXE boot and merging your snapshot when the system has booted successfully. Merging instructions are available in the Red Hat Enterprise Linux 7 LVM documentation, available from http://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/.
- Rollback returns
/var/logto the state it was in prior to upgrade. For auditing purposes, Red Hat recommends copying log files from installation to a separate location prior to initiating rollback.
2.6.3. Target Management with targetcli
2.6.4. Persistent Device Names
udev in /dev/disk/by-*/) in kernel messages. This lets the system administrator identify the messages associated with a device, even if the device name changes from boot-to-boot.
/dev/kmsg log, which can be displayed with the dmesg command, now shows the messages for the symbolic links, which udev has created for kernel devices. These messages are displayed in the following format: udev-alias: device_name (symbolic_link symbolic link ...). For example:
udev-alias: sdb (disk/by-id/ata-QEMU_HARDDISK_QM00001)
/var/log/messages through syslog.
udev.alias=1 to the kernel command line in /etc/default/grub.
2.6.5. LVM cache volumes
lvmcache manual page for information on creating cache logical volumes.
2.7. Networking
2.7.1. Recommended naming practices
host.example.com. The hostnamectl tool allows static and transient host names of up to 64 characters including a-z, A-Z, 0-9, -, and . only. Underscores are technically permissible in the current specification. However, since older specifications forbid them, Red Hat does not recommend using underscores in host names.
.yourcompany) to the public register. Therefore, Red Hat strongly recommends that you do not use a domain name that is not delegated to you, even on a private network, as this can result in a domain name that resolves differently depending on network configuration. As a result, network resources can become unavailable. Using domain names that are not delegated to you also makes DNSSEC more difficult to deploy and maintain, as domain name collisions add manual configuration penalties to DNSSEC validation.
2.7.2. Updates to NetworkManager
- The nmcli tool now supports editing connections with the
nmcli con editandnmcli con modifycommands. - A new text-based user interface (nmtui) provides a streamlined console-based tool for editing network configuration and controlling network connections. This replaces the system-config-network-tui tool.
- Previously, NetworkManager ignored network interfaces it did not recognize (interfaces other than Ethernet, Infiniband, WiFi, Bridge, Bond, and VLAN). NetworkManager now recognizes any network interface picked up by
ip link, and exposes these interfaces through the D-Bus interface and clients such as nmcli. This brings NetworkManager to closer parity with tools like ip. - NetworkManager now non-destructively takes ownership of interfaces that it can natively configure, such as Ethernet, InfiniBand, Bridge, Bond, VLAN, and Team interfaces. If these interfaces are configured before NetworkManager starts or restarts, the previously configured connections are not interrupted. This means that the
NM_CONTROLLEDoption is no longer required. - Support for checking network connectivity, hotspots and portals. This behavior is disabled by default.
- Support for team interfaces.
- Basic, non-native support for GRE, macvlan, macvtap, tun, tap, veth, and vxlan devices.
- A new NetworkManager-config-server package provides defaults that are suitable for servers, such as ignoring carrier changes and not creating default DHCP connections.
- A new
dns=noneconfiguration option forNetworkManager.confprevents NetworkManager from making changes to theresolv.conffile. - Support for fast user switching.
- Support for locking a connection to the name of an interface in addition to, or instead of, the MAC address of an interface.
nmcli con reload command.
2.7.3. New Network Naming Schema
eth[0123...], but these names do not necessarily correspond to actual labels on the chassis. Modern server platforms with multiple network adapters can encounter non-deterministic and counter-intuitive naming of these interfaces. This affects both network adapters embedded on the motherboard (Lan-on-Motherboard, or LOM) and add-in (single and multi-port) adapters.
enp5s0 in place of eth0.
- Scheme 1
- Names incorporating Firmware or BIOS provided index numbers for on-board devices, for example,
eno1. systemd names interfaces according to this scheme by default if that information from the firmware is applicable and available, with scheme 2 used as a fallback. - Scheme 2
- Names incorporating Firmware or BIOS provided PCI Express hotplug slot index numbers, for example,
ens1. systemd names interfaces according to this scheme by default if that information from the firmware is applicable and available, with scheme 3 used as a fallback. - Scheme 3
- Names incorporating physical location of the connector of the hardware, for example,
enp2s0. systemd names interfaces according to this scheme by default if that information from the firmware is applicable and available, with scheme 5 used as a fallback. - Scheme 4
- Names incorporating the interface's MAC address, for example,
enx78e7d1ea46da. By default, systemd does not name interfaces according to this scheme, but it can be enabled if required. - Scheme 5
- The traditional unpredictable kernel-native ethX naming, for example,
eth0. systemd names interfaces according to this scheme if all other methods fail.
BIOSDEVNAME enabled, or if the user has added udevd rules that change the names of kernel devices, these rules will take precedence over the default systemd policy.
2.7.4. New networking utility (ncat)
- The
netcat -Poption took a specified user name to present to a proxy server that required authentication. The ncat option for this behavior is--proxy-auth user[:pass]. - The
netcat -Xoption took a specified protocol for the networking utility to use when communicating with a proxy server. The ncat option for this behavior is--proxy-type. - The
netcat -xoption took an address and an optional port for the networking utility to connect to with the proxy server. The ncat option for this behavior is--proxy, which takes an IP address and an optional port, like so:--proxy host[:port]. - The
netcat -doption disabled reading from stdin. Thencat -doption allows the user to specify a wait time between read or write operations. However, ncat provides the--recv-onlyoption, which provides similar behavior tonetcat -d. - The
netcat -ioption specified an interval between lines of text sent and received, or between connections to multiple ports. Thencat -ioption specifies the amount of time a connection can idle before the connection times out and is terminated. There is no equivalent in ncat to thenetcat -ioption. - The
netcat -woption specifies the amount of time a connection that cannot be established can idle before the connection times out and is terminated. Thencat -woption specifies the amount of time to attempt connection before timing out.
- Enable debugging on the socket (previously provided by
netcat -D). - Specify the size of the TCP send and receive buffers (previously provided by
netcat -Iandnetcat -O). - Specify that source or destination ports are chosen randomly (previously provided by
netcat -r). - Enable Protection of BGP Sessions avia the TCP MD5 Signature Option, RFC 2385 (previously provided by
netcat -S). - Specify the IPv4 type of service (previously provided by
netcat -T). - Specify the use of UNIX domain sockets (previously provided by
netcat -U). - Specify the routing table to be used (previously provided by
netcat -V). - Scan for listening daemons without transmitting data.
- Specify an interval between lines of text sent and received, or between connections to multiple ports.
$ man ncat
2.7.5. Changes to Postfix
- Ensure that you execute
postfix stopandpostfix startcommands before using thepostscreendaemon, to avoid problems with thepassmaster service. - Default system-supplied CA certificates are no longer added to the
*_tls_CAfileor*_tls_CApathlists. This means third-party certificates no longer receive mail relay permission whenpermit_tls_all_clientcertsis used. If your configuration requires certificate verification, enable backwards compatible behavior by settingtls_append_default_CA = yes. - The
verifyservice now uses a persistent cache with periodic cleanup enabled by default. Support for the delete and sequence operations is required. To disable the cache, specify a blankaddress_verify_mapparameter inmain.cf. To disable periodic cleanup, setaddress_verify_cache_cleanup_intervalto0. - Previously the default next-hop destination, used when a filter next-hop destination was not specified, was the value of
$myhostname. The default is now the recipient domain. To change the default next-hop destination, specifydefault_filter_nexthop = $myhostname. In pipe-based filters, this also enables FIFO delivery order, instead of round-robin domain selection. - The
postmulti -e destroycommand no longer attempts to remove files that are created after thepostmulti -e createcommand is executed. - Postfix now requests default delivery status notifications when adding a recipient with the Milter
smfi_addrcptaction. - When the result of virtual alias expansion exceeds virtual alias recursion or expansion limits, Postfix now reports a temporary delivery error instead of silently dropping excess recipients and delivering the message.
- The local delivery agent now keeps the owner-alias attribute of a parent alias when delivering mail to a child alias that does not have an owner-alias. This makes repeated delivery to mailing lists less likely. To enable older behavior, specify
reset_owner_alias = yes. - The Postfix SMTP client no longer appends the local domain when looking up a DNS name without "
.". To enable older behavior, specifysmtp_dns_resolver_options = res_defnames. Note that this may produce unexpected results. - The format of the
postfix/smtpd[pid]: queueid: client=host[addr]log file record has changed. When available, the before-filter client information and before-filter queue ID are now appended to the end of the record. - By default, postfix no longer adds an undisclosed recipient header to messages with no specified recipient. To enable older behavior, specify the following in
mail.cf:undisclosed_recipients_header = To: undisclosed-recipients:;
- The SASL mechanism list is now re-computed after each successful completion of
STARTTLS. - The
smtpd_starttls_timeoutdefault value is now stress-dependent. - DNSBL queries with a secret in the domain name must now hide that secret from
postscreenSMTP replies. For example, inmain.cf, specify:postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply
Indnsbl_reply, specify a separate DNSBL name:# Secret DNSBL name Name in postscreen(8) replies secret.zen.spamhaus.org zen.spamhaus.org
- All programs that use postfix VSTREAMs must be recompiled, because VSTREAM errors now use separate flags for read and write errors.
- The default value of
smtp_line_length_limitis now999, to remain consistent with the SMTP standard. - Sendmail now transforms all input lines ending in
<CR><LF>into UNIX format (<LF>). - By default, the SMTP client no longer appends
AUTH=<>to theMAIL FROMcommand. - Some log messages that were previously classified as
fatalare now classified aserror. Log file based alert systems may need to be updated accordingly. To re-enable older behavior, setdaemon_table_open_error_is_fataltoyes. - Newly supported long queue file names are not supported prior to Postfix 2.9. To migrate back to Postfix 2.8 or earlier, any long queue file names must be converted. To do so, stop postfix, set
enable_long_queue_idstono, and then run thepostsupercommand until it no longer exports queue file name changes. - Postfix now logs the result of successful TLS negotiation with TLS logging levels of 0. See log level descriptions in the
postconfman page for details. - The postfix SMTP server now always checks the smtpd_sender_login_maps table.
- The default
inet_protocolsvalue is nowall(use both IPv4 and IPv6). To avoid unexpected performance loss for sites without global IPv6 connectivity, themake upgradeandpostfix upgrade-configurationcommands currently appendinet_protocols = ipv4tomain.cfwhen no explicit setting is present. - The default
smtp_address_preferencevalue is nowany(choose IPv4 or IPv6 at random). - The SMTP server no longer reports transcripts of sessions where a client command is rejected because a lookup table is not available. To continue receiving such reports, add the
dataclass to the value of thenotify_classesparameter. - A new
smtpd_relay_restrictionsparameter has been added. By default this enablespermit_mynetworks,permit_sasl_authenticated, anddefer_unauth_destination. This prevents open relay problems due to mistakes with spam filter rules insmtpd_recipient_restrictions. However, if your site has a complex mail relay policy configured undersmtpd_recipient_restrictions, some mail may be incorrectly deferred. To correct this, either removesmtpd_relay_restrictionsconfiguration and use the existing policy insmtpd_recipient_restrictions, or copy the existing policy fromsmtpd_recipient_restrictionstosmtpd_relay_restrictions.
2.7.6. Network Protocols
2.7.6.1. Network File System (NFS)
/etc/sysconfig/nfs file, by changing the value of the RPCNFSDARGS parameter. For example, RPCNFSDARGS="-N4.1 -V3" enables support for NFS 3 and disables support for NFS 4.1. For further details, see the man page:
$ man rpc.nfsd
/etc/nfsmount.conf file and by using command line options. See the man pages for further details.
$ man nfs
$ man nfsmount.conf
2.7.6.1.1. Parallel NFS (pNFS)
2.7.6.2. Apache Web Server (httpd)
- Changed proxy configuration
- Apache Web Server (
httpd) configurations that use an SSL back end must now use theSSLProxyCheckPeerNamedirective if the SSL certificate does not match the host name configured. Previously, host names in the SSL certificate of a proxy back end were not verified. - New control mechanisms
- Because Red Hat Enterprise Linux moves the system away from SysV init scripts, the commands for controlling the
httpdservice have changed. Red Hat now recommends theapachectlandsystemctlcommands instead of theservicecommand. For example, where you would previously have runservice httpd graceful, Red Hat now recommendsapachectl graceful. - Changed default subcommand behavior
- The
systemdunit file for httpd defines different behavior for thereloadandstopsubcommands. Specifically, thereloadsubcommand now gracefully reloads the service, and thestopcommand now gracefully stops the service by default. - Hard coded default configuration
- Previous versions of httpd provided an exhaustive configuration file that listed all configuration settings and their defaults. Many common configuration settings are no longer explicitly configured in the default configuration files; instead, default settings are now hard coded. The default configuration file now has minimal content and is easier to manage as a result. The hard coded default values for all settings are specified in the manual, which by default is installed into
/usr/share/httpd. - New Multi-Processing Model modules
- Previous releases of Red Hat Enterprise Linux provided several Multi-Processing Models (
preforkandworker) as different httpd binaries. Red Hat Enterprise Linux 7 uses a single binary and provides these Multi-Processing Models as loadable modules:worker,prefork(default), andevent. Edit the/etc/httpd/conf.modules.d/00-mpm.conffile to select which module is loaded. - Directory changes
- A number of directories have moved or are no longer provided in this updated version of httpd.
- Content previously installed in
/var/cache/mod_proxyhas moved to/var/cache/httpdunder either theproxyor thesslsubdirectory. - Content previously installed in
/var/wwwhas moved to/usr/share/httpd. - Content previously installed in
/var/www/iconshas moved to/usr/share/httpd/icons. This directory contains a set of icons used with directory indices. - The HTML version of the httpd manual previously installed in
/var/www/manualhas moved to/usr/share/httpd/manual. - Custom multi-language HTTP error pages previously installed in
/var/www/errorhave moved to/usr/share/httpd/error.
- Changes to suexec
- The
suexecbinary no longer has its user identifier set to root at install time. Instead, a more restrictive set of permissions is applied using file system capability bits. This improves the security of the httpd service. Additionally,suexecnow sends log messages to syslog instead of using the/var/log/httpd/suexec.logfile. The messages sent to syslog appear in/var/log/secureby default. - Changes to module interface compatibility
- Changes to the httpd module interface mean that this updated version of httpd is not compatible with third-party binary modules built against the previous version of httpd (2.2). Such modules will need to be adjusted as necessary for the httpd 2.4 module interface, and then rebuilt. See the Apache documentation for details of the API changes in version 2.4.
- Change to apxs binary location
- The
apxsbinary used to build modules from source has moved from/usr/sbin/apxsto/usr/bin/apxs. - New and moved configuration files
- Configuration files that load modules are now placed in the
/etc/httpd/conf.modules.ddirectory. Packages that provide additional loadable modules for httpd (like the php package) add files to this directory. Any configuration files in theconf.modules.ddirectory are processed before the main body ofhttpd.conf. Configuration files in the/etc/httpd/conf.ddirectory are now processed after the main body ofhttpd.conf.Some additional configuration files are provided by the httpd package:/etc/httpd/conf.d/autoindex.confconfiguresmod_autoindexdirectory indexing./etc/httpd/conf.d/userdir.confconfigures access to user directories (http://example.com/~username/). By default this access is disabled for security reasons./etc/httpd/conf.d/welcome.confconfigures the "welcome page" displayed onhttp://localhost/when no content is present.
- Changes to configuration compatibility
- This version of httpd is not compatible with the configuration syntax of the previous version (2.2). Configuration files require updates to syntax before they can be used with this updated version of httpd. See the Apache documentation for details of the syntax changes made between version 2.2 and version 2.4.
2.7.6.3. Samba
2.7.6.4. BIND
ROOTDIR environment variable in /etc/sysconfig/named to point to the chroot environment location. To run the named service normally (not in the chroot environment) required either removing the bind-chroot package or manually editing the ROOTDIR environment variable in /etc/sysconfig/named file.
named service runs. Instead, it installs a new service, named-chroot, that is started and stopped separately with the systemctl command, like so.
# systemctl start named-chroot.service
# systemctl stop named-chroot.service
named-chroot service cannot run at the same time as the named service.
2.7.7. Default product certificate
/etc/pki/product-default/ directory.
/etc/pki/product/ directory and then in the /etc/pki/product-default/ directory. Content in the /etc/pki/product-default/ directory is provided by redhat-release packages. Any certificate in the /etc/pki/product-default/ directory that is not located in /etc/pki/product/ is considered to be installed. The default product certificates are used until Subscription Manager fetches product certificates from the subscribed channels.
2.8. Clustering and High Availability
2.8.1. Luci replacement limitations (pcs)
luci controlled both Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6 high availability clusters.
luci and replaces it with pcs. pcs can control only Red Hat Enterprise Linux 7 pacemaker-based clusters. It cannot control Red Hat Enterprise Linux 6 rgmanager-based high availability clusters.
2.8.2. Keepalived replaces Piranha
keepalived service, which provides both the functionality available in piranha and additional functionality. piranha is therefore superseded by the keepalived service in Red Hat Enterprise Linux 7.
keepalived is configured in the /etc/keepalived/keepalived.conf file by default. Details on the configuration format and syntax expected by this file are covered in the keepalive.conf man page:
$ man keepalived.conf
2.8.3. Online migration limitations
2.8.4. New resource manager (Pacemaker)
- Detection and recovery from machine and application-level failures.
- Support for many redundancy configurations.
- Support for quorate and resource-driven clusters.
- Configurable strategies for dealing with quorum loss (when multiple machines fail).
- Support for specifying application startup and shutdown ordering, regardless of which machine the applications are on.
- Support for specifying that applications must or must not run on the same machine.
- Support for specifying that an application should be active on multiple machines.
- Support for multiple modes for applications, such as master and slave.
- Provably correct responses to any failure or cluster state.
- Responses to any situation can be tested offline, before the situation exists.
2.8.5. New feature: resource agents
2.8.6. Changed quorum implementation
votequorum, which is included in the corosync package, and which has been extended to replace qdiskd for most use cases. The extensions (wait_for_all, auto_tie_breaker and last_man_standing) are fully documented in the votequorum.5 man page.
$ man 5 votequorum
2.9. Desktop
2.9.1. New Default Desktop Environment (GNOME Classic)
- The top bar
- This bar across the top of the screen displays the and menus.The menu gives the user access to applications on the system, which are organized into a number of categories on the menu. This menu also provides access to the new Activities Overview, which lets you easily view your open windows, workspaces, and any messages or system notifications.The menu is displayed next to the menu on the top bar. It gives the user quick access to important folders, for example
DownloadsorPictures. - The taskbar
- The taskbar is displayed at the bottom of the screen, and features a window list, a notification icon, and a short identifier for the current workspace and the total number of available workspaces.
2.9.2. New Desktop Environment (GNOME 3)
- The top bar
- This horizontal bar at the top of the screen provides access to some basic GNOME Shell functions, such as the Activities Overview, clock, calendar, system status icons, and the system menu.
- The Activities Overview
- The Activities Overview lets you easily view your open windows, workspaces, and any messages or system notifications. The search bar is the easiest way to find your files, launch applications, or open configuration tools. The dash on the left-hand side shows your favourite applications, so you can access your most frequently used tools faster.
- The message tray
- The message tray appears as a bar across the bottom of your screen. It shows pending notifications, so you always know exactly what is happening on your system.
2.9.3. KDE Plasma Workspaces (KDE)
- A polished, consistent look and feel with the default Oxygen style.
- An updated notification system (movable and closable notifications, with speed graphs) with progress visualized in the panel.
- Workspace configuration now available in System Settings.
- The Activity Manager provides the ability to add, remove, save, restore, and switch between Activities.
- Optimizations to core and user interface elements for better performance.
- Adaptive power management, with a simplified user interface and easy profile switching.
- A new Print Manager, which simplifies printer configuration and provides fast, accurate reporting on printer status.
- An updated Dolphin File Manager with navigation buttons, tabbed browsing, and improvements to metadata handling.
- An updated terminal emulator (Konsole) with improved tab and window control and improved interoperability.
- A new display manager, KScreen, which automatically can remember and restore display configuration, including resolution and relative position.
- A new applet, Plasma Network Manager, which makes it easy to control your network and configure network connections.
2.10. Developer Tools
2.10.1. Red Hat Developer Toolset
2.10.2. Compatibility Libraries
Table 2.5. Compatibility libraries
|
Library
|
Last release where this interface was the default
|
|---|---|
|
compat-db47
|
Red Hat Enterprise Linux 6
|
|
compat-libcap1
|
Red Hat Enterprise Linux 5
|
|
compat-libf2c-34
|
Red Hat Enterprise Linux 4
|
|
compat-libgfortran-41
|
Red Hat Enterprise Linux 5
|
|
compat-openldap
|
Red Hat Enterprise Linux 5
|
|
libpng12
|
Red Hat Enterprise Linux 5
|
|
openssl098e
|
Red Hat Enterprise Linux 5
|
|
compat-dapl
|
Red Hat Enterprise Linux 5
|
|
compat-libtiff3
|
Red Hat Enterprise Linux 6
|
|
compat-libstdc++-33
|
Red Hat Enterprise Linux 3 (in optional repository only)
|
2.11. Security and Access Control
2.11.1. New firewall (firewalld)
firewalld, and its configuration tools: firewall-config, firewall-cmd, and firewall-applet, which is not included in the default installation of Red Hat Enterprise Linux 7.
firewalld is dynamic, changes to its configuration can be made at any time, and are implemented immediately. No part of the firewall needs to be reloaded, so there is no unintentional disruption of existing network connections.
- Firewalld configuration details are not stored in
/etc/sysconfig/iptables. Instead, configuration details are stored in various files in the/usr/lib/firewalldand/etc/firewallddirectories. - Where the firewall system in Red Hat Enterprise Linux 6 removed and re-applied all rules every time a configuration change was made,
firewalldonly applies the configuration differences. As a result,firewalldcan change settings during runtime without losing existing connections.
2.11.1.1. Migrating rules to firewalld
Important
iptables or ip6tables instead of moving to firewalld.
firewalld and continue using iptables or ip6tables are available here: https://access.redhat.com/articles/1229233.
- Use the graphical system-config-firewall tool to configure rules. This tool stored its configuration details in the
/etc/sysconfig/system-config-firewallfile, and created configuration for theiptablesandip6tablesservices in the/etc/sysconfig/iptablesand/etc/sysconfig/ip6tablesfiles. - Manually edit the
/etc/sysconfig/iptablesand/etc/sysconfig/ip6tablesfiles (either from scratch, or editing an initial configuration created by system-config-firewall).
/etc/sysconfig/system-config-firewall into the default zone of firewalld.
$ firewall-offline-cmd
/etc/sysconfig/iptables or /etc/sysconfig/ip6tables, after you install firewalld, you must either create a new configuration with firewall-cmd or firewall-config, or disable firewalld and continue to use the old iptables and ip6tables services. For details about creating new configurations or disabling firewalld, see the Red Hat Enterprise Linux 7 Security Guide, available from http://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/.
2.11.2. Changes to PolicyKit
.pkla files to define additional local authorizations. Red Hat Enterprise Linux 7 introduces the ability to define local authorizations with JavaScript, allowing you to script authorizations if necessary.
polkitd reads .rules files in lexicographic order from the /etc/polkit-1/rules.d and /usr/share/polkit-1/rules.d directories. If two files share the same name, files in /etc are processed before files in /usr. When the old .pkla files were processed, the last rule processed took precedence. With the new .rules files, the first matching rule takes precedence.
/etc/polkit-1/rules.d/49-polkit-pkla-compat.rules file. They can therefore be overridden by .rules files in either /usr or /etc with a name that comes before 49-polkit-pkla-compat in lexicographic order. The simplest way to ensure that your old rules are not overridden is to begin the name of all other .rules files with a number greater than 49.
2.11.3. Changes to user identifiers
500. In Red Hat Enterprise Linux 7, the base user identifier is now 1000. This change involves replacing the /etc/login.defs file during the upgrade process.
/etc/login.defs file, the file is replaced during upgrade. The base user identifier number is changed to 1000, and new users will be allocated user identifiers at and above 1000. User accounts created before this change retain their current user identifiers and continue to work as expected.
/etc/login.defs file, the file is not replaced during upgrade, and the base user identifier number remains at 500.
2.11.4. Changes to libuser
libuser library no longer supports configurations that contain both the ldap and files modules, or both the ldap and shadow modules. Combining these modules results in ambiguity in password handling, and such configurations are now rejected during the initialization process.
libuser to manage users or groups in LDAP, you must remove the files and shadow modules from the modules and create_modules directives in your configuration file (/etc/libuser.conf by default).
2.11.5. Changes to opencryptoki key store
Update software
Ensure your version of opencryptoki is up to date.# yum update -y opencryptoki
Verify the slot number of your token
Usepkcsconfto determine the slot number of the token. Run the following commands as root:# pkcsconf -s # pkcsconf -t
Note the slot number of your token. The slot description will end with(CCA). The information field will identify the token as theIBM CCA Token.Stop interface access
Stop thepkcsslotdservice and anyopencryptokiprocesses.# systemctl stop pkcsslotd.service
Use the following command to identify processes to stop with thekillutility, and then terminate the appropriate processes.# ps ax | grep pkcsslotd
Back up the data store
Before you migrate, back up the CCA data store (the directory in which your tokens are stored, normally/var/lib/opencryptoki/ccatok). For example, make a copy of the directory.# cp -r /var/lib/opencryptoki/ccatok /var/lib/opencryptoki/ccatok.backup
Run the migration utility
Change to the/var/lib/opencryptoki/ccatokdirectory and run the migration utility.# cd /var/lib/opencryptoki/ccatok # pkcscca -m v2objectsv3 -v
When prompted, provide your Security Officer (SO) PIN and User PIN.Remove outdated shared memory file
Remove the/dev/shm/var.lib.opencryptoki.ccatokfile manually, or reboot the system.# rm /dev/shm/var.lib.opencryptoki.ccatok
Go back to an operational interface access
Start thepkcsslotdservice again.# systemctl start pkcsslotd.service
- Ensure you are running the commands as root, and that root is a member of the
pkcs11group. - Ensure that the
pkcsconfutility is in either the/usr/lib/pkcs11/methods/directory or the/usr/sbin/directory. - Ensure that the token data store is in the
/var/lib/opencryptoki/ccatok/directory. - Ensure that you have supplied a slot number and that the slot number is correct.
- Ensure that your Security Officer (SO) PIN and User PIN are correct.
- Ensure that you have write access to the current directory.
Chapter 3. Changes to packages, functionality, and support
3.1. New Packages
3.1.1. Preupgrade Assistant
preupg) checks for potential problems you might encounter with an upgrade from Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7 before making any changes to your system. This helps you assess your chances of successfully upgrading to Red Hat Enterprise Linux 7 before the actual upgrade process begins.
- System analysis report with proposed solutions for any detected migration issues.
- Data that could be used for "cloning" the system, if the in-place upgrade is not suitable.
- Post-upgrade scripts to finish more complex issues after the in-place upgrade.
3.1.2. Red Hat Upgrade Tool
- Red Hat Upgrade Tool fetches packages and an upgrade image from a disk or server, prepares the system for the upgrade, and reboots the system.
- The rebooted system detects that upgrade packages are available and uses systemd and yum to upgrade packages on the system.
- Red Hat Upgrade Tool cleans up after the upgrade and reboots the system into the upgraded operating system.
3.1.3. Chrony
Chrony is a new NTP client provided in the chrony package. It replaces the reference implementation (ntp) as the default NTP implementation in Red Hat Enterprise Linux 7. However, it does not support all features available in ntp, so ntp is still provided for compatibility reasons. If you require ntp, you must explicitly remove chrony and install ntp instead.
Chrony's timekeeping algorithms have several advantages over the ntp implementation.
- Faster, more accurate synchronization.
- Larger range for frequency correction.
- Better response to rapid changes in clock frequency.
- No clock stepping after initial synchronization.
- Works well with an intermittent network connection.
3.1.4. HAProxy
HAProxy is a TCP/HTTP reverse proxy that is well-suited to high availability environments. It requires few resources, and its event-driven architecture allows it to easily handle thousands of simultaneous connections on hundreds of instances without risking the stability of the system.
HAProxy, see the man page, or consult the documentation installed along with the haproxy package in the /usr/share/doc/haproxy directory.
3.1.5. Kernel-tools
3.1.6. NFQUEUE (libnetfilter_queue)
NFQUEUE iptables target, which specifies that a listening user-space application will retrieve a packet from a specified queue and determine how that packet will be handled.
3.1.7. SCAP Security Guide
3.1.8. Red Hat Access GUI
3.2. Package Replacements
Table 3.1. Replaced packages
|
Removed package
|
Replacement/Alternative
|
Notes
|
|---|---|---|
|
vconfig
|
iproute (ip tool)
|
Not fully compatible.
|
|
module-init-tools
|
kmod
| |
|
openoffice.org
|
libreoffice
| |
|
man
|
man-db
| |
|
ext2 and ext3 filesystem driver
|
ext4 filesystem driver
| |
|
openais
|
corosync
|
Functionality wrapped by the Red Hat Enterprise Linux HA stack.
|
|
jwhois
|
whois
|
Output format differs.
|
|
libjpeg
|
libjpeg-turbo
| |
|
gpxe
|
ipxe
|
Fork of gpxe.
|
|
cpuspeed
|
kernel, kernel-tools (cpupower, cpupower.service)
|
Now configured in
/etc/sysconfig/cpupower. No longer includes user-space scaling daemon; use kernel governors if necessary.
|
|
nc
|
nmap-ncat
| |
|
procps
|
procps-ng
| |
|
openswan
|
libreswan
| |
|
arptables_jf
|
arptables
| |
|
gcj
|
OpenJDK
|
Do not compile Java apps to native code with gcj.
|
|
32-bit x86 as installation architecture
|
AMD64 and Intel 64
|
Applications will still run with compatibility libraries. Test your applications on 64-bit Red Hat Enterprise Linux 6. If 32-bit x86 boot support is required, continue to use Red Hat Enterprise Linux 6.
|
|
Power 6 PPC support
| |
Continue to use Red Hat Enterprise Linux 5 or Red Hat Enterprise Linux 6
|
|
Matahari
|
CIM-based management
| |
|
ecryptfs
|
Use existing LUKS/dm-crypt block-based encryption
|
Migration is not available for encrypted file systems; encrypted data must be recreated.
|
|
evolution-exchange
|
evolution-mapi/evolution-ews
| |
|
TurboGears2 web application stack
| | |
|
openmotif22
|
motif
|
Rebuild applications against the current Motif version.
|
|
webalizer web anayltics tool
| |
Other web analytics tools are superior.
|
|
compiz window manager
|
gnome-shell
| |
|
Eclipse developer toolset
| |
Eclipse is now offered in the Developer Toolset offering.
|
|
Qpid and QMF
| |
Qpid and QMF are available in the MRG offering.
|
|
amtu
| |
Common Criteria certifications no longer require this tool.
|
|
pidgin frontends
|
empathy
| |
|
perl-suidperl
|
perl
|
This functionality has been removed in upstream perl.
|
|
pam_passwdqc, pam_cracklib
|
libpwquality, pam_pwquality
|
Not fully compatible.
|
|
HAL library and daemon
|
udev
| |
|
ConsoleKit library and daemon
|
systemd
|
Not fully compatible.
|
|
system-config-network
|
nm-connection-editor, nmcli
| |
|
thunderbird
|
evolution
| |
|
system-config-firewall
|
firewalld
| |
|
busybox
|
normal utilities
| |
|
KVM/virt packages (in ComputeNode)
|
KVM/virt equipped variant such as a Server variant
| |
|
abyssinica-fonts
| sil-abyssinica-fonts | |
| axis | java-1.7.0-openjdk | |
| ccs | pcs | Not fully compatible. |
| cjkuni-fonts-common | cjkuni-uming-fonts | |
| classpath-jaf | java-1.7.0-openjdk | |
| classpath-mail | javamail | Not fully compatible. |
| cman | corosync | |
| control-center-extra | control-center | |
| db4-cxx | libdb4-cxx | |
| db4-devel | libdb4-devel | |
| db4-utils | libdb4-utils | |
| desktop-effects | control-center | |
| DeviceKit-power | upower | Not fully compatible. |
| dracut-kernel | dracut | |
| eggdbus | glib2 | Not fully compatible. |
| fcoe-target-utils | targetcli | See Section 2.6.3, “Target Management with targetcli” for details. |
| febootstrap | supermin | |
| gcc-java | java-1.7.0-openjdk-devel | |
| GConf2-gtk | GConf2 | |
| gdm-plugin-fingerprint | gdm | |
| gdm-plugin-smartcard | gdm | |
| gdm-user-switch-applet | gnome-shell | Not fully compatible. |
| geronimo-specs | geronimo-parent-poms | |
| geronimo-specs-compat | geronimo-jms, geronimo-jta | Not fully compatible. |
| gimp-help-browser | gimp | Not fully compatible. |
| gnome-applets | gnome-classic-session | Not fully compatible. |
| gnome-keyring-devel | gnome-keyring | |
| gnome-mag | gnome-shell | Not fully compatible. |
| gnome-python2-applet | pygtk2 | Not fully compatible. |
| gnome-speech | speech-dispatcher | Not fully compatible. |
| gpxe-roms-qemu | ipxe-roms-qemu | |
| hal | systemd | Not fully compatible. |
| hal-devel | systemd-devel | Not fully compatible. |
| ibus-gtk | ibus-gtk2 | |
| ibus-table-cangjie | ibus-table-chinese-cangjie | |
| ibus-table-erbi | ibus-table-chinese-erbi | |
| ibus-table-wubi | ibus-table-chinese-wubi-haifeng | |
| jakarta-commons-net | apache-commons-net | |
| java-1.5.0-gcj | java-1.7.0-openjdk, java-1.7.0-openjdk-headless | Not fully compatible. |
| java-1.5.0-gcj-devel | java-1.7.0-openjdk-devel | Not fully compatible. |
| java-1.5.0-gcj-javadoc | java-1.7.0-openjdk-javadoc | Not fully compatible. |
| junit4 | junit | |
| jwhois | whois | |
| kabi-whitelists | kernel-abi-whitelists | |
| kdeaccessibility-libs | kdeaccessibility | |
| kdebase-devel | kde-baseapps-devel | |
| kdebase-workspace-wallpapers | kde-wallpapers | |
| kdelibs-experimental | kdelibs | |
| kdesdk-libs | kate-libs, kdesdk-kmtrace-libs, kdesdk-kompare | Not fully compatible. |
| kdesdk-utils | kdesdk-poxml | |
| krb5-auth-dialog | gnome-online-accounts | Not fully compatible. |
| lldpad-libs | lldpad | |
| lslk | util-linux | Not fully compatible. |
| luci | pcs | See Section 2.8, “Clustering and High Availability” for details. |
| man-pages-uk | man-pages | |
| mingetty | util-linux | Not fully compatible. |
| modcluster | pcs | Not fully compatible. |
| mod_perl | mod_fcgid | Not compatible with httpd 2.4. |
| m17n-contrib-* | m17n-contrib | |
| m17n-db-* | m17n-db, m17n-db-extras | |
| NetworkManager-gnome | nm-connection-editor, network-manager, applet | |
| nss_db | glibc | Not fully compatible. |
| openais | corosync | |
| openaislib | corosynclib | |
| openaislib-devel | corosynclib-devel | |
| PackageKit-gtk-module | PackageKit-gtk3-module | Not fully compatible. |
| polkit-desktop-policy | polkit | |
| pulseaudio-libs-zeroconf | pulseaudio-libs | Not fully compatible. |
| qt-sqlite | qt | |
| rdesktop | xfreerdp | |
| Red_Hat_Enterprise_Linux-Release_Notes-6-* | Red_Hat_Enterprise_Linux-Release_Notes-7-* | |
| redhat-lsb-compat | redhat-lsb-core | |
| rgmanager | pacemaker | See Section 2.8, “Clustering and High Availability” for details. |
| rhythmbox-upnp | rhythmbox | |
| ricci | pcs | See Section 2.8, “Clustering and High Availability” for details. |
| samba4* | samba* | See Section 2.7.6.3, “Samba” for details. |
| sbm-cim-client | sbm-cim-client2 | Not fully compatible. |
| scsi-target-utils | targetcli | See Section 2.6.3, “Target Management with targetcli” for details. |
| seekwatcher | iowatcher | |
| spice-client | virt-viewer | Not fully compatible. |
| system-config-lvm | gnome-disk-utility | Not fully compatible. |
| texlive-* | texlive | |
| tex-cm-lgc | texlive-cm-lgc | |
| tex-kerkis | texlive-kerkis | |
| texlive-texmf-dvips | texlive-dvips | |
| texlive-texmf-latex | texlive-latex | |
| tomcat6 | tomcat | |
| tomcat6-el-2.1-api | tomcat-el-2.2-api | |
| tomcat6-jsp-2.1-api | tomcat-jsp-2.2-api | |
| tomcat6-lib | tomcat-lib | |
| totem-upnp | totem | |
| udisks | udisks2 | Not fully compatible. |
| un-core-batang-fonts | nhn-nanum-myeongjo-fonts | |
| un-core-dinaru-fonts, un-core-graphic-fonts | nhn-nanum-gothic-fonts | Not fully compatible. |
| un-core-dotum-fonts | nhn-nanum-gothic-fonts | |
| un-core-fonts-common | nhn-nanum-fonts-common | Not fully compatible. |
| un-core-gungseo-fonts | nhn-nanum-brush-fonts | Not fully compatible. |
| un-core-pilgi-fonts | nhn-nanum-pen-fonts | Not fully compatible. |
| unique | unique3, glib2 | Not fully compatible. |
| unique-devel | unique3-devel | Not fully compatible. |
| unix2dos | dos2unix | |
| vgabios | seavgabios-bin | |
| w3m | text-www-browser | Not fully compatible. |
| xmlrpc3-* | xmlrpc-* | |
| xorg-x11-drv-apm | xorg-x11-drv-fbdev, xorg-x11-drv-vesa | |
| xorg-x11-drv-ast, xorg-x11-drv-cirrus, xorg-x11-drv-mga | xorg-x11-drv-modesetting | |
| xorg-x11-drv-ati-firmware | linux-firmware | |
| xorg-x11-drv-elographics, xorg-x11-drv-glint, xorg-x11-drv-i128, xorg-x11-drv-i740, xorg-x11-drv-mach64, xorg-x11-drv-rendition, xorg-x11-drv-r128, xorg-x11-drv-savage, xorg-x11-drv-siliconmotion, xorg-x11-drv-sis, xorg-x11-drv-sisusb, xorg-x11-drv-s3virge, xorg-x11-drv-tdfx, xorg-x11-drv-trident, xorg-x11-drv-voodoo, xorg-x11-drv-xgi | xorg-x11-drv-fbdev, xorg-x11-drv-vesa | |
| xorg-x11-drv-nv | xorg-x11-drv-nouveau | |
| xorg-x11-twm | metacity | Not fully compatible. |
| xorg-x11-xdm | gdm | Not fully compatible. |
| yum-plugin-downloadonly | yum |
3.3. Deprecated Packages
Table 3.2. Package deprecations
|
Functionality/Package
|
Alternative
|
Migration Notes
|
|---|---|---|
|
ext2 file system support
|
ext3, ext4
|
ext4 can be used for ext2 and ext3 file systems.
|
|
sblim-sfcb
|
tog-pegasus
| |
|
Legacy RHN Hosted registration
|
subscription-manager and Subscription Asset Manager
| |
|
acpid
|
systemd
| |
|
evolution-mapi
|
evolution-ews
|
Please migrate from Microsoft Exchange Server 2003 machines
|
|
gtkhtml3
|
webkitgtk3
| |
|
sendmail
|
postfix
| |
|
edac-utils and mcelog
|
rasdaemon
| |
|
libcgroup
|
systemd
|
cgutils will continue to exist in Red Hat Enterprise Linux 7.0 but systemd is evolving capabilities to enable customers to migrate in later releases
|
|
lvm1
|
lvm2
| |
|
lvm2mirror and cmirror
|
lvm2 raid1
| |
3.4. Removed Packages
- amtu
- ant-antlr
- ant-apache-bcel
- ant-apache-bsf
- ant-apache-log4j
- ant-apache-oro
- ant-apache-regexp
- ant-apache-resolver
- ant-commons-logging
- ant-commons-net
- ant-javamail
- ant-jdepend
- ant-jsch
- ant-junit
- ant-nodeps
- ant-swing
- ant-trax
- apache-jasper
- apache-tomcat-apis
- apr-util-ldap
- arts
- arts-devel
- aspell
- atmel-firmware
- at-spi
- at-spi-python
- audiofile
- audit-viewer
- avahi-tools
- avahi-ui
- avalon-framework
- avalon-logkit
- batik
- brasero
- brasero-libs
- brasero-nautilus
- bsf
- busybox
- b43-fwcutter
- b43-openfwwf
- cas
- cdparanoia
- cdrdao
- cjet
- cloog-ppl
- cluster-cim
- cluster-glue
- cluster-glue-libs
- cluster-glue-libs-devel
- clusterlib
- clusterlib-devel
- cluster-snmp
- cman
- compat-db42
- compat-db43
- compat-libstdc++-296
- compat-libtermcap
- compat-openmpi
- compat-openmpi-psm
- compat-opensm-libs
- compiz
- compiz-gnome
- coreutils-libs
- cracklib-python
- cronie-noanacron
- ctan-cm-lgc-fonts-common
- ctan-cm-lgc-roman-fonts
- ctan-cm-lgc-sans-fonts
- ctan-cm-lgc-typewriter-fonts
- ctan-kerkis-fonts-common
- ctan-kerkis-sans-fonts
- ctan-kerkis-serif-fonts
- ctapi-common
- cvs-inetd
- c2050
- c2070
- dash
- dbus-c++
- dbus-qt
- devhelp
- dmz-cursor-themes
- dtach
- dvd+rw-tools
- eclipse-birt
- eclipse-callgraph
- eclipse-cdt
- eclipse-dtp
- eclipse-emf
- eclipse-gef
- eclipse-changelog
- eclipse-jdt
- eclipse-linuxprofilingframework
- eclipse-mylyn
- eclipse-mylyn-cdt
- eclipse-mylyn-java
- eclipse-mylyn-pde
- eclipse-mylyn-trac
- eclipse-mylyn-webtasks
- eclipse-mylyn-wikitext
- eclipse-nls
- eclipse-nls-ar
- eclipse-nls-bg
- eclipse-nls-ca
- eclipse-nls-cs
- eclipse-nls-da
- eclipse-nls-de
- eclipse-nls-el
- eclipse-nls-es
- eclipse-nls-et
- eclipse-nls-fa
- eclipse-nls-fi
- eclipse-nls-fr
- eclipse-nls-he
- eclipse-nls-hi
- eclipse-nls-hu
- eclipse-nls-id
- eclipse-nls-it
- eclipse-nls-ja
- eclipse-nls-ko
- eclipse-nls-ku
- eclipse-nls-mn
- eclipse-nls-nl
- eclipse-nls-no
- eclipse-nls-pl
- eclipse-nls-pt
- eclipse-nls-pt_BR
- eclipse-nls-ro
- eclipse-nls-ru
- eclipse-nls-sk
- eclipse-nls-sl
- eclipse-nls-sq
- eclipse-nls-sr
- eclipse-nls-sv
- eclipse-nls-tr
- eclipse-nls-uk
- eclipse-nls-zh
- eclipse-nls-zh_TW
- eclipse-oprofile
- eclipse-pde
- eclipse-platform
- eclipse-rcp
- eclipse-rpm-editor
- eclipse-rse
- eclipse-subclipse
- eclipse-subclipse-graph
- eclipse-svnkit
- eclipse-swt
- eclipse-valgrind
- ecryptfs-utils
- evolution-data-server-doc
- fakechroot
- fakechroot-libs
- fence-virt
- fence-virtd-checkpoint
- file-devel
- firstaidkit
- firstaidkit-engine
- firstaidkit-gui
- foghorn
- fop
- gamin-devel
- gamin-python
- gconfmm26
- ggz-base-libs
- glade3
- gnome-disk-utility-libs
- gnome-disk-utility-ui-libs
- gnome-doc-utils
- gnome-doc-utils-stylesheets
- gnome-games
- gnome-media
- gnome-media-libs
- gnome-pilot
- gnome-pilot-conduits
- gnome-power-manager
- gnome-python2-bugbuddy
- gnome-python2-extras
- gnome-python2-gtkhtml2
- gnome-python2-libegg
- gnome-python2-libwnck
- gnome-python2-rsvg
- gnome-themes
- gnome-user-share
- gnome-vfs2-devel
- gnome-vfs2-smb
- graphviz-perl
- groff
- gsl-static
- gstreamer-python
- gthumb
- gtk+extra
- gtkhtml2
- gtksourceview2
- gtk2-engines
- guile
- gvfs-afc
- gvfs-archive
- hal-info
- hal-libs
- hal-storage-addon
- htdig
- hypervkvpd
- ibus-table-additional
- icedax
- icu4j-eclipse
- ipa-pki-ca-theme
- ipa-pki-common-theme
- ipw2100-firmware
- ipw2200-firmware
- jakarta-commons-discovery
- jakarta-commons-el
- jasper
- java_cup
- jdepend
- jetty-eclipse
- jsch
- jzlib
- kabi-yum-plugins
- kcoloredit
- kcoloredit-doc
- kdeadmin
- kdeartwork-screensavers
- kdebase-workspace-akonadi
- kdebase-workspace-python-applet
- kdegames
- kdegraphics
- kde-i18n-Arabic
- kde-i18n-Bengali
- kde-i18n-Brazil
- kde-i18n-British
- kde-i18n-Bulgarian
- kde-i18n-Catalan
- kde-i18n-Czech
- kde-i18n-Danish
- kde-i18n-Dutch
- kde-i18n-Estonian
- kde-i18n-Finnish
- kde-i18n-French
- kde-i18n-German
- kde-i18n-Greek
- kde-i18n-Hebrew
- kde-i18n-Hindi
- kde-i18n-Hungarian
- kde-i18n-Chinese
- kde-i18n-Chinese-Big5
- kde-i18n-Icelandic
- kde-i18n-Italian
- kde-i18n-Japanese
- kde-i18n-Korean
- kde-i18n-Lithuanian
- kde-i18n-Norwegian
- kde-i18n-Norwegian-Nynorsk
- kde-i18n-Polish
- kde-i18n-Portuguese
- kde-i18n-Punjabi
- kde-i18n-Romanian
- kde-i18n-Russian
- kde-i18n-Serbian
- kde-i18n-Slovak
- kde-i18n-Slovenian
- kde-i18n-Spanish
- kde-i18n-Swedish
- kde-i18n-Tamil
- kde-i18n-Turkish
- kde-i18n-Ukrainian
- kdelibs-apidocs
- kdelibs3
- kdelibs3-devel
- kde-l10n-Bengali-India
- kde-l10n-Frisian
- kde-l10n-Gujarati
- kde-l10n-Chhattisgarhi
- kde-l10n-Kannada
- kde-l10n-Kashubian
- kde-l10n-Kurdish
- kde-l10n-Macedonian
- kde-l10n-Maithili
- kde-l10n-Malayalam
- kde-l10n-Marathi
- kdemultimedia
- kdemultimedia-devel
- kdemultimedia-libs
- kdenetwork
- kdesdk
- kdesdk-libs
- kdeutils
- kdewebdev
- kdewebdev-libs
- kernel-debug
- kernel-debug-devel
- kernel-doc
- kiconedit
- kipi-plugins
- kipi-plugins-libs
- kmid
- kmid-common
- konq-plugins-doc
- krb5-appl
- kross-python
- ksig
- ksig-doc
- k3b
- k3b-common
- k3b-libs
- libao-devel
- libart_lgpl-devel
- libbonobo-devel
- libbonoboui-devel
- libburn
- libcroco-devel
- libdc1394
- libdiscid
- libesmtp-devel
- libexif-devel
- libgail-gnome
- libgcj
- libgcj-devel
- libgcj-src
- libglademm24
- libglade2-devel
- libgnomecanvas-devel
- libgnome-devel
- libgnomeui-devel
- libgphoto2-devel
- libgpod
- libgsf-devel
- libgxim
- libIDL-devel
- libidn-devel
- libisofs
- libitm
- libldb-devel
- libmatchbox
- libmtp
- libmusicbrainz
- libmusicbrainz3
- libnih
- liboil
- libopenraw-gnome
- libpanelappletmm
- libproxy-bin
- libproxy-python
- libreport-compat
- libreport-plugin-mailx
- libreport-plugin-reportuploader
- librtas (32-bit only)
- libselinux-ruby
- libservicelog (32-bit only)
- libsexy
- libtalloc-devel
- libtdb-devel
- libtevent-devel
- libtidy
- libvpd (32-bit only)
- libwnck
- libXdmcp-devel
- log4cpp
- lpg-java-compat
- lucene
- lucene-contrib
- lx
- lynx
- MAKEDEV
- matchbox-window-manager
- mcstrans
- mesa-dri1-drivers
- min12xxw
- mod_auth_mysql
- mod_auth_pgsql
- mod_authz_ldap
- mod_dnssd
- mrtg-libs
- mvapich-psm-static
- mx4j
- nspluginwrapper
- openct
- openhpi-subagent
- openssh-askpass
- ORBit2-devel
- osutil
- oxygen-cursor-themes
- PackageKit-yum-plugin
- paktype-fonts-common
- pam_passwdqc
- pbm2l2030
- pbm2l7k
- pcmciautils
- pcsc-lite-openct
- perl-BSD-Resource
- perl-Cache-Memcached
- perl-Config-General
- perl-Crypt-PasswdMD5
- perl-Frontier-RPC
- perl-Frontier-RPC-doc
- perl-Perlilog
- perl-String-CRC32
- perl-suidperl
- perl-Text-Iconv
- perl-Time-HiRes
- perl-YAML-Syck
- pessulus
- pilot-link
- pinentry-gtk
- piranha
- pki-symkey
- plpa-libs
- plymouth-gdm-hooks
- plymouth-theme-rings
- plymouth-utils
- policycoreutils-newrole
- policycoreutils-sandbox
- ppl
- prelink
- printer-filters
- psutils
- ptouch-driver
- pulseaudio-module-gconf
- pycairo-devel
- pygobject2-codegen
- pygobject2-devel
- pygobject2-doc
- pygtksourceview
- pygtk2-codegen
- pygtk2-devel
- pygtk2-doc
- pychart
- PyOpenGL [1]
- python-beaker
- python-Coherence
- python-crypto
- python-decoratortools
- python-enchant
- python-formencode
- python-fpconst
- python-genshi
- python-gtkextra
- python-cheetah
- python-ipaddr
- python-iwlib
- python-libguestfs [2]
- python-louie
- python-mako
- python-markdown
- python-markupsafe
- python-matplotlib
- python-myghty
- python-paramiko
- python-paste
- python-paste-deploy
- python-paste-script
- python-peak-rules
- python-peak-util-addons
- python-peak-util-assembler
- python-peak-util-extremes
- python-peak-util-symbols
- python-prioritized-methods
- python-pygments
- python-pylons
- python-qpid
- python-qpid-qmf
- python-repoze-tm2
- python-repoze-what
- python-repoze-what-plugins-sql
- python-repoze-what-pylons
- python-repoze-what-quickstart
- python-repoze-who
- python-repoze-who-friendlyform
- python-repoze-who-plugins-sa
- python-repoze-who-testutil
- python-routes
- python-saslwrapper
- python-sexy
- python-sqlalchemy
- python-tempita
- python-toscawidgets
- python-transaction
- python-turbojson
- python-tw-forms
- python-twisted
- python-twisted-conch
- python-twisted-core
- python-twisted-lore
- python-twisted-mail
- python-twisted-names
- python-twisted-news
- python-twisted-runner
- python-twisted-web
- python-twisted-words
- python-weberror
- python-webflash
- python-webhelpers
- python-webob
- python-webtest
- python-zope-filesystem
- python-zope-interface
- python-zope-sqlalchemy
- pywebkitgtk
- pyxf86config
- qpid-cpp-client
- qpid-cpp-client-ssl
- qpid-cpp-server
- qpid-cpp-server-ssl
- qpid-qmf
- qpid-tests
- qpid-tools
- qt-doc
- raptor
- rgmanager
- rome
- ruby-devel
- ruby-qpid
- ruby-qpid-qmf
- sabayon
- sabayon-apply
- sac
- samba-winbind-clients
- samba4
- samba4-client
- samba4-common
- samba4-dc
- samba4-dc-libs
- samba4-devel
- samba4-pidl
- samba4-swat
- samba4-test
- samba4-winbind
- samba4-winbind-clients
- samba4-winbind-krb5-locator
- saslwrapper
- sat4j
- saxon
- sblim-cmpi-dhcp
- sblim-cmpi-dns
- sblim-cmpi-samba
- sblim-tools-libra
- scenery-backgrounds
- seabios
- selinux-policy-minimum
- selinux-policy-mls
- setools-console
- sgabios-bin
- sigar
- sinjdoc
- smp_utils
- SOAPpy
- sound-juicer
- strigi-devel
- subscription-manager-migration-data
- subversion-javahl
- svnkit
- system-config-firewall
- system-config-firewall-tui
- system-config-network-tui
- system-config-services
- system-config-services-docs
- system-gnome-theme
- system-icon-theme
- taskjuggler
- tbird
- terminus-fonts
- tidy
- tigervnc-server
- tix
- tkinter
- trilead-ssh2
- tsclient
- tunctl
- TurboGears2
- unicap
- vorbis-tools
- wacomexpresskeys
- wdaemon
- webalizer
- webkitgtk
- ws-commons-util
- wsdl4j
- xfig-plain
- xfsprogs-devel
- xfsprogs-qa-devel
- xguest
- xmldb-api
- xmldb-api-sdk
- xmlgraphics-commons
- xorg-x11-apps
- xorg-x11-drv-acecad
- xorg-x11-drv-aiptek
- xorg-x11-drv-fpit
- xorg-x11-drv-hyperpen
- xorg-x11-drv-keyboard
- xorg-x11-drv-mouse
- xorg-x11-drv-mutouch
- xorg-x11-drv-openchrome
- xorg-x11-drv-penmount
- xorg-x11-server-Xephyr
- xsane
- xz-lzma-compat
- zd1211-firmware
3.5. Removed Drivers
- 3c574_cs.ko
- 3c589_cs.ko
- 3c59x.ko
- 8390.ko
- acenic.ko
- amd8111e.ko
- avma1_cs-ko [3]
- avm_cs.ko[3]
- axnet_cs.ko
- b1pcmpcia.ko[3]
- bluecard_cs-ko[3]
- bt3c_cs.ko[3]
- btuart_cs.ko[3]
- can-dev.ko
- cassini.ko
- cdc-phonet.ko
- cm4000_cs.ko[3]
- cm4040_cs.ko[3]
- cxgb.ko
- de2104x.ko
- de4x5.ko
- dl2k.ko
- dmfe.ko
- dtl1_cs.ko[3]
- e100.ko
- elsa_cs.ko[3]
- ems_pci.ko
- ems_usb.ko
- fealnx.ko
- fmvj18x_cs.ko
- forcedeth.ko
- ipwireless.ko[3]
- ixgb.ko
- kvaser_pci.ko
- myri10ge.ko
- natsemi.ko
- ne2k-pci.ko
- niu.ko
- nmclan_cs.ko
- ns83820.ko
- parport_cs.ko[3]
- pata_pcmcia.ko[3]
- pcnet_cs.ko
- pcnet32.ko
- pppol2tp.ko
- r6040.ko
- s2io.ko
- sc92031.ko
- sdricoh_cs.ko[3]
- sedlbauer_cs.ko[3]
- serial_cs.ko[3]
- sis190.ko
- sis900.ko
- sja1000_platform.ko
- sja1000.ko
- smc91c92_cs.ko[3]
- starfire.ko
- sundance.ko
- sungem_phy.ko
- sungem.ko
- sunhme.ko
- tehuti.ko
- teles_cs.ko[3]
- tlan.ko
- tulip.ko
- typhoon.ko
- uli526x.ko
- vcan.ko
- via-rhine.ko
- via-velocity.ko
- vxge.ko
- winbond-840.ko
- xirc2ps_cs.ko[3]
- xircom_cb.ko
3.6. Deprecated Drivers
Appendix A. Customer Portal Labs Relevant For Migration
Red Hat Enterprise Linux Upgrade Helper
- the basic steps to upgrade Red Hat Enterprise Linux
- extra steps that prevent known issues specific to your upgrade scenario
- 6.5 to 7.4
- 6.6 to 7.4
- 6.7 to 7.4
- 6.8 to 7.4
- 6.9 to 7.4
Product Life Cycle Checker
Appendix B. Revision History
| Revision History | |||
|---|---|---|---|
| Revision 0.3-2 | Fri Apr 6 2018 | ||
| |||
| Revision 0.3-1 | Fri Jul 28 2017 | ||
| |||
| Revision 0.1-8 | Fri Sep 23 2016 | ||
| |||
| Revision 0.1-7 | Fri Sep 23 2016 | ||
| |||
| Revision 0.1-6 | Thu Nov 12 2015 | ||
| |||
| Revision 0.1-5 | Tue Feb 17 2015 | ||
| |||
| Revision 0.1-4 | Mon Jun 02 2014 | ||
| |||
| Revision 0.1-3 | Tue Mar 04 2014 | ||
| |||
| Revision 0.1-2 | Wed Jan 23 2013 | ||
| |||
| Revision 0.1-1 | Wed Jan 16 2013 | ||
| |||
