Procedure

1. Ensure your system has been successfully registered to the Red Hat Content Delivery Network (CDN) or Red Hat Satellite by using the Red Hat Subscription Manager.

2. If your system is registered to Satellite Server, complete the steps in Preparing a Satellite-registered system for the upgrade to ensure that your system meets the requirements for the upgrade.

   Important

   If your system is registered to Satellite Server, you must complete the steps in Preparing a Satellite-registered system for the upgrade for the upgrade before proceeding with the steps in this procedure to prevent issues from occurring.

3. Verify that the system is subscribed using subscription-manager:

   1. If your system is registered by using an account with Simple Content Access (SCA) enabled, verify that the Content Access Mode is set to Simple Content Access message appears:

      # subscription-manager status
      +-------------------------------------------+
         System Status Details
      +-------------------------------------------+
      Overall Status: Disabled
      Content Access Mode is set to Simple Content Access. This host has access to content, regardless of subscription status.
      System Purpose Status: Disabled

   2. If your system is registered by using an account with SCA disabled, verify that the Red Hat Linux Server subscription is attached, the product name is Server, and the status is Subscribed:

      # subscription-manager list --installed
      +-------------------------------------------+
          	  Installed Product Status
      +-------------------------------------------+
      Product Name:  	Red Hat Enterprise Linux Server
      Product ID:     69
      Version:        7.9
      Arch:           x86_64
      Status:         Subscribed

4. Ensure you have appropriate repositories enabled. The following commands list repositories for the 64-bit Intel architecture; for other architectures, see RHEL 7 repositories.

   1. Enable the Base repository:

      # subscription-manager repos --enable rhel-7-server-rpms

   2. Enable the Extras repository where Leapp and its dependencies are available:

      # subscription-manager repos --enable rhel-7-server-extras-rpms

      Note

      Optionally, you can enable the Optional (also known as CodeReady Linux Builder) or Supplementary repositories. For more information about repository IDs, see the Optional and Supplementary repositories list in RHEL 7 repositories. For more information about the content of these repositories, see The CodeReady Linux Builder repository and The Supplementary repository.

5. Set the Red Hat Subscription Manager to use the latest RHEL 7 content:

   # subscription-manager release --unset

6. Optional: To use custom repositories, see the Configuring custom repositories Knowledgebase article.

7. If you use the yum-plugin-versionlock plug-in to lock packages to a specific version, clear the lock by running:

   # yum versionlock clear

   See How to restrict yum to install or upgrade a package to a fixed specific package version? for more information.

8. If you are upgrading using Red Hat Update Infrastructure (RHUI) on a public cloud, enable required RHUI repositories and install required RHUI packages to ensure your system is ready for upgrade.

   1. For AWS:

      # yum-config-manager --enable rhui-client-config-server-7
      # yum-config-manager --enable rhel-7-server-rhui-extras-rpms
      # yum -y install rh-amazon-rhui-client leapp-rhui-aws

   2. For Microsoft Azure:

      # yum-config-manager --enable rhui-microsoft-azure-rhel7
      # yum -y install rhui-azure-rhel7
      # yum-config-manager --enable rhui-rhel-7-server-rhui-extras-rpms
      # yum -y install leapp-rhui-azure

      Note

      If you locked the Azure virtual machine (VM) to a minor release, remove the version lock. For more information, see Switch a RHEL 7.x VM back to non-EUS.

   3. For Google Cloud Platform, follow the Leapp RHUI packages for Google Cloud Platform (GCP) Knowledgebase article.
9. If you manage containers in Docker, recreate those containers with the appropriate container images by using Podman and then attach any in-use volumes. For more information, see How do I migrate my Docker containers to Podman prior to moving from Red Hat Enterprise Linux 7 to Red Hat Enterprise Linux 8?

10. Update all packages to the latest RHEL 7 version:

    # yum update

11. Reboot the system:

    # reboot

12. Install the Leapp utility:

    # yum install leapp-upgrade

    Note that currently you need version 0.16.0 or later of the leapp package and version 0.19.0 or later of the leapp-repository package, which contains the leapp-upgrade-el7toel8 RPM package.

    Note

    If your system does not have internet access, download the following packages from the Red Hat Customer Portal:

    • leapp
    • leapp-deps
    • python2-leapp
    • leapp-upgrade-el7toel8
    • leapp-upgrade-el7toel8-deps See the How to install leapp packages on an offline system for RHEL 7.9 to RHEL 8.X upgrade? Knowledgebase article for more information.
13. The latest release of the leapp-upgrade-el7toel8 package contains all required data files. If you have replaced these data files with older versions, remove all JSON files in the /etc/leapp/files directory and reinstall the leapp-upgrade-el7toel8 package to ensure your data files are up-to-date.
14. Temporarily disable antivirus software to prevent the upgrade from failing.

15. Ensure that any configuration management system does not interfere with the in-place upgrade process:

    • If you use a configuration management system with a client-server architecture, such as Puppet, Salt, or Chef, disable the system before running the leapp preupgrade command. Do not enable the configuration management system until after the upgrade is complete to prevent issues during the upgrade.

    • If you use a configuration management system with agentless architecture, such as Ansible, do not execute the configuration and deployment file, such as an Ansible playbook, during the in-place upgrade as described in Performing the upgrade from RHEL 7 to RHEL 8.

      Automation of the pre-upgrade and upgrade process using a configuration management system is not supported by Red Hat. For more information, see Using configuration management systems to automate parts of the Leapp pre-upgrade and upgrade process on Red Hat Enterprise Linux.

16. Ensure your system does not use more than one Network Interface Card (NIC) with a name based on the prefix used by the kernel (eth). For instructions on how to migrate to another naming scheme before an in-place upgrade to RHEL 8, see How to perform an in-place upgrade to RHEL 8 when using kernel NIC names on RHEL 7.
17. If you are upgrading using an ISO image, verify that the ISO image contains the target OS version, for example RHEL 8.8, and is saved to a persistent local mount point to ensure that the Leapp utility can access the image throughout the upgrade process.
18. Ensure you have a full system backup or a virtual machine snapshot. You should be able to get your system to the pre-upgrade state if you follow standard disaster recovery procedures within your environment. For example, you can use the Relax-and-Recover (ReaR) utility. For more information, see the ReaR documentation and What is Relax and Recover (ReaR) and how can I use it for disaster recovery?. Alternatively, you can use LVM snapshots, or RAID splitting. In case of upgrading a virtual machine, you can create a snapshot of the whole VM.

Procedure

1. Verify that Satellite is on a version in full or maintenance support. For more information, see Red Hat Satellite Product Life Cycle.
2. Import a subscription manifest with RHEL 8 repositories into Satellite Server. For more information, see the Managing Red Hat Subscriptions chapter in the Managing Content Guide for the particular version of Red Hat Satellite, for example, for version 6.12.

3. Enable and synchronize all required RHEL 7 and RHEL 8 repositories on the Satellite Server with the latest updates for RHEL 7.9 and the target OS version, for example RHEL 8.6. Required repositories must be available in the Content View and enabled in the associated activation key.

   Note

   For RHEL 8 repositories, enable the target OS version of each repository, for example, 8.6. If you enable only the RHEL 8 version of the repositories, the in-place upgrade is inhibited.

   For example, for the Intel architecture without an Extended Update Support (EUS) subscription, enable at minimum the following repositories:

   • Red Hat Enterprise Linux 7 Server (RPMs)

     rhel-7-server-rpms

     x86_64 7Server

   • Red Hat Enterprise Linux 7 Server - Extras (RPMs)

     rhel-7-server-extras-rpms

     x86_64

   • Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)

     rhel-8-for-x86_64-appstream-rpms

     x86_64 <target_os_version>

   • Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)

     rhel-8-for-x86_64-baseos-rpms

     x86_64 <target_os_version>

     Replace target_os_version with the target OS version, for example 8.6.

     For other architectures, see RHEL 7 repositories and RHEL 8 repositories.

     For more information, see the Importing Content chapter in the Managing Content Guide for the particular version of Red Hat Satellite, for example, for version 6.12.

4. Attach the content host to a Content View containing the required RHEL 7 and RHEL 8 repositories.

   For more information, see the Managing Content Views chapter in the Managing Content Guide for the particular version of Red Hat Satellite, for example, for version 6.12.

Verification

1. Verify that the correct RHEL 7 and RHEL 8 repositories have been added to the correct Content View on Satellite Server.

   1. In the Satellite web UI, navigate to Content > Lifecycle > Content Views and click the name of the Content View.

   2. Click the Repositories tab and verify that the repositories appear correctly.

      Note

      You can also verify that the repositories have been added to the Content View using the following commands:

      # hammer repository list --search 'content_label ~ rhel-7' --content-view <content_view_name> --organization <organization> --lifecycle-environment <lifecycle_environment>
      # hammer repository list --search 'content_label ~ rhel-8' --content-view <content_view_name> --organization <organization> --lifecycle-environment <lifecycle_environment>

      Replace <content_view_name> with the name of the Content View, <organization> with the organization, and <lifecycle_environement> with the name of the lifecycle environment..

2. Verify that the correct RHEL 8 repositories are enabled in the activation key associated with the Content View:

   1. In Satellite web UI navigate to Content > Lifecycle > Activation Keys and click the name of the activation key.
   2. Click the Repository Sets tab and verify that the statuses of the required repositories are Enabled.

3. Verify that all expected RHEL 7 repositories are enabled in the host. For example:

   # subscription-manager repos --list-enabled | grep "^Repo ID"
   Repo ID:   rhel-7-server-extras-rpms
   Repo ID:   rhel-7-server-rpm

Procedure

1. On your RHEL 7 system, perform the pre-upgrade phase:

   # leapp preupgrade --target <target_os_version>

   Replace <target_os_version> with the target OS version, for example 8.6. If no target OS version is defined, Leapp uses the default target OS version specified in the table 1.1 in Supported upgrade paths.

   • If you are using custom repositories from the /etc/yum.repos.d/ directory for the upgrade, enable the selected repositories as follows:

     # leapp preupgrade --enablerepo <repository_id1> --enablerepo <repository_id2> ...

   • If you are upgrading without RHSM or using RHUI, add the --no-rhsm option.
   • If you have an Extended Upgrade Support (EUS), Advanced Update Support (AUS), or Update Services for SAP Solutions (E4S) subscription, add the --channel <channel> option. Replace <channel> with the channel name, for example, eus, aus, or e4s. Note that SAP HANA customers should perform the in-place upgrade using the How to in-place upgrade SAP environments from RHEL 7 to RHEL 8 guide.

2. Examine the report in the /var/log/leapp/leapp-report.txt file and manually resolve all the reported problems. Some reported problems contain remediation suggestions. Inhibitor problems prevent you from upgrading until you have resolved them.

   The report contains the following risk factor levels:

   High

   Very likely to result in a deteriorated system state.

   Medium

   Can impact both the system and applications.

   Low

   Should not impact the system but can have an impact on applications.

   Info

   Informational with no expected impact to the system or applications.

3. In certain system configurations, the Leapp utility generates true or false questions that you must answer manually. If the pre-upgrade report contains a Missing required answers in the answer file message, complete the following steps:

   1. Open the /var/log/leapp/answerfile file and review the true or false questions.

   2. Manually edit the /var/log/leapp/answerfile file, uncomment the confirm line of the file by deleting the # symbol, and confirm your answer as True or False. For more information, see the Leapp answerfile.

      Note

      Alternatively, you can answer the true or false question by running the following command:

      # leapp answer --section <question_section>.<field_name>=<answer>

      For example, to confirm a False response to the question Disable pam_pkcs11 module in PAM configuration?, execute the following command:

      # leapp answer --section remove_pam_pkcs11_module_check.confirm=False

4. Repeat the previous steps to rerun the pre-upgrade report to verify that you have resolved all critical issues.

Procedure

1. Install the cockpit-leapp plug-in:

   # dnf install cockpit-leapp

   Log in to the web console as root or as a user that has permissions to enter administrative commands with sudo. See Managing systems using the RHEL web console for more information about the web console.

2. On your RHEL 7 system, perform the pre-upgrade phase either from the command-line interface or from the web console terminal:

   # leapp preupgrade --target <target_os_version>

   Replace <target_os_version> with the target OS version, for example 8.6. If no target OS version is defined, Leapp uses the default target OS version specified in the table 1.1 in Supported upgrade paths.

   • If you are using custom repositories from the /etc/yum.repos.d/ directory for the upgrade, enable the selected repositories as follows:

     # leapp preupgrade --enablerepo <repository_id1> --enablerepo <repository_id2> ...

   • If you are upgrading without RHSM or using RHUI, add the --no-rhsm option.
   • If you have an Extended Upgrade Support (EUS), Advanced Update Support (AUS), or Update Services for SAP Solutions (E4S) subscription, add the --channel <channel> option. Replace <channel> with the channel name, for example, eus, aus, or e4s. Note that SAP HANA customers should perform the in-place upgrade using the How to in-place upgrade SAP environments from RHEL 7 to RHEL 8 Knowledgebase article.

3. In the web console, select Upgrade Report from the navigation menu to review all reported problems. Inhibitor problems prevent you from upgrading until you have resolved them. To view a problem in detail, select the row to open the Detail pane.

   Figure 4.1. In-place upgrade report in the web console

   

   The report contains the following risk factor levels:

   High

   Very likely to result in a deteriorated system state.

   Medium

   Can impact both the system and applications.

   Low

   Should not impact the system but can have an impact on applications.

   Info

   Informational with no expected impact to the system or applications.

4. In certain configurations, the Leapp utility generates true or false questions that you must answer manually. If the Upgrade Report contains a Missing required answers in the answer file row, complete the following steps:

   1. Select the Missing required answers in the answer file row to open the Detail pane. The default answer is stated at the end of the remediation command.
   2. To confirm the default answer, select Add to Remediation Plan to execute the remediation later or Run Remediation to execute the remediation immediately.

   3. To select the non-default answer instead, execute the leapp answer command in the terminal, specifying the question you are responding to and your confirmed answer.

      # leapp answer --section <question_section>.<field_name>=<answer>

      For example, to confirm a False response to the question Disable pam_pkcs11 module in PAM configuration?, execute the following command

      # leapp answer --section remove_pam_pkcs11_module_check.confirm=False

      Note

      You can also manually edit the /var/log/leapp/answerfile file, uncomment the confirm line of the file by deleting the # symbol, and confirm your answer as True or False. For more information, see the Leapp answerfile example.

5. Some problems have remediation commands that you can run to automatically resolve the problems. You can run remediation commands individually or all together in the remediation command.

   1. To run a single remediation command, open the Detail pane for the problem and click Run Remediation.

   2. To add a remediation command to the remediation plan, open the Detail pane for the problem and click Add to Remediation Plan.

      Figure 4.2. Detail pane

      
   3. To run the remediation plan containing all added remediation commands, click the Remediation plan link in the top right corner above the report. Click Execute Remediation Plan to execute all listed commands.
6. After reviewing the report and resolving all reported problems, repeat steps 3-7 to rerun the report to verify that you have resolved all critical issues.

Procedure

1. Ensure that there are no SELinux denials, for example, by using the ausearch utility:

   # ausearch -m AVC,USER_AVC -ts boot

   Note that the previous step covers only the most common scenario. To check for all possible SELinux denials, see the Identifying SELinux denials section in the Using SELinux title, which provides a complete procedure.

2. Open the /etc/selinux/config file in a text editor of your choice, for example:

   # vi /etc/selinux/config

3. Configure the SELINUX=enforcing option:

   # This file controls the state of SELinux on the system.
   # SELINUX= can take one of these three values:
   #       enforcing - SELinux security policy is enforced.
   #       permissive - SELinux prints warnings instead of enforcing.
   #       disabled - No SELinux policy is loaded.
   SELINUX=enforcing
   # SELINUXTYPE= can take one of these two values:
   #       targeted - Targeted processes are protected,
   #       mls - Multi Level Security protection.
   SELINUXTYPE=targeted

4. Save the change, and restart the system:

   # reboot

Verification

1. After the system restarts, confirm that the getenforce command returns Enforcing:

   $ getenforce
   Enforcing

Procedure

1. Find the appropriate security compliance data stream .xml file:

   $ ls /usr/share/xml/scap/ssg/content/
   ssg-firefox-cpe-dictionary.xml  ssg-rhel6-ocil.xml
   ssg-firefox-cpe-oval.xml        ssg-rhel6-oval.xml
   ...
   ssg-rhel6-ds-1.2.xml          ssg-rhel8-oval.xml
   ssg-rhel8-ds.xml              ssg-rhel8-xccdf.xml
   ...

   For additional information, see section Viewing compliance profiles.

2. Remediate the system according to the selected profile from the appropriate data stream:

   # oscap xccdf eval --profile pci-dss --remediate /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

   You can replace the pci-dss value in the --profile argument with the ID of the profile according to which you want to harden your system. For a full list of profiles supported in RHEL 8, see SCAP security profiles supported in RHEL.

   Warning

   If not used carefully, running the system evaluation with the Remediate option enabled might render the system non-functional. Red Hat does not provide any automated method to revert changes made by security-hardening remediations. Remediations are supported on RHEL systems in the default configuration. If your system has been altered after the installation, running remediation might not make it compliant with the required security profile.

3. Restart your system:

   # reboot

Verification

1. Verify that the system is compliant with the profile, and save the results in an HTML file:

   $ oscap xccdf eval --report pcidss_report.html --profile pci-dss /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml