Chapter 7. Deprecated functionality
This part provides an overview of functionality that has been deprecated in Red Hat Enterprise Linux 9.
Deprecated functionality will likely not be supported in future major releases of this product and is not recommended for new deployments. For the most recent list of deprecated functionality within a particular major release, refer to the latest version of release documentation.
The support status of deprecated functionality remains unchanged within Red Hat Enterprise Linux 9. For information about the length of support, see Red Hat Enterprise Linux Life Cycle and Red Hat Enterprise Linux Application Streams Life Cycle .
Deprecated hardware components are not recommended for new deployments on the current or future major releases. Hardware driver updates are limited to security and critical fixes only. Red Hat recommends replacing this hardware as soon as reasonably feasible.
A package can be deprecated and not recommended for further use. Under certain circumstances, a package can be removed from a product. Product documentation then identifies more recent packages that offer functionality similar, identical, or more advanced to the one deprecated, and provides further recommendations.
For information regarding functionality that is present in RHEL 8 but has been removed in RHEL 9, see Considerations in adopting RHEL 9 .
7.1. Installer and image creation
Deprecated Kickstart commands
The following Kickstart commands have been deprecated:
Note that where only specific options are listed, the base command and its other options are still available and not deprecated. Using the deprecated commands in Kickstart files prints a warning in the logs. You can turn the deprecated command warnings into errors with the
inst.ksstrict boot option.
SHA-1 is deprecated for cryptographic purposes
The usage of the SHA-1 message digest for cryptographic purposes has been deprecated in RHEL 9. The digest produced by SHA-1 is not considered secure because of many documented successful attacks based on finding hash collisions. The RHEL core crypto components no longer create signatures using SHA-1 by default. Applications in RHEL 9 have been updated to avoid using SHA-1 in security-relevant use cases.
Among the exceptions, the HMAC-SHA1 message authentication code and the Universal Unique Identifier (UUID) values can still be created using SHA-1 because these use cases do not currently pose security risks. SHA-1 also can be used in limited cases connected with important interoperability and compatibility concerns, such as Kerberos and WPA-2. See the List of RHEL applications using cryptography that is not compliant with FIPS 140-3 section in the RHEL 9 Security hardening document for more details.
If your scenario requires the use of SHA-1 for verifying existing or third-party cryptographic signatures, you can enable it by entering the following command:
# update-crypto-policies --set DEFAULT:SHA1
Alternatively, you can switch the system-wide crypto policies to the
LEGACY policy. Note that
LEGACY also enables many other algorithms that are not secure.
SCP is deprecated in RHEL 9
The secure copy protocol (SCP) is deprecated because it has known security vulnerabilities. The SCP API remains available for the RHEL 9 lifecycle but using it reduces system security.
scputility, SCP is replaced by the SSH File Transfer Protocol (SFTP) by default.
- The OpenSSH suite does not use SCP in RHEL 9.
SCP is deprecated in the
Digest-MD5 in SASL is deprecated
The Digest-MD5 authentication mechanism in the Simple Authentication Security Layer (SASL) framework is deprecated, and it might be removed from the
cyrus-sasl packages in a future major release.
OpenSSL deprecates MD2, MD4, MDC2, Whirlpool, RIPEMD160, Blowfish, CAST, DES, IDEA, RC2, RC4, RC5, SEED, and PBKDF1
The OpenSSL project has deprecated a set of cryptographic algorithms because they are insecure, uncommonly used, or both. Red Hat also discourages the use of those algorithms, and RHEL 9 provides them for migrating encrypted data to use new algorithms. Users must not depend on those algorithms for the security of their systems.
The implementations of the following algorithms have been moved to the legacy provider in OpenSSL: MD2, MD4, MDC2, Whirlpool, RIPEMD160, Blowfish, CAST, DES, IDEA, RC2, RC4, RC5, SEED, and PBKDF1.
/etc/pki/tls/openssl.cnf configuration file for instructions on how to load the legacy provider and enable support for the deprecated algorithms.
/etc/system-fips is now deprecated
Support for indicating FIPS mode through the
/etc/system-fips file has been removed, and the file will not be included in future versions of RHEL. To install RHEL in FIPS mode, add the
fips=1 parameter to the kernel command line during the system installation. You can check whether RHEL operates in FIPS mode by using the
fips-mode-setup --check command.
libcrypt.so.1 is now deprecated
libcrypt.so.1 library is now deprecated, and it might be removed in a future version of RHEL.
fapolicyd.rules is deprecated
/etc/fapolicyd/rules.d/ directory for files containing allow and deny execution rules replaces the
/etc/fapolicyd/fapolicyd.rules file. The
fagenrules script now merges all component rule files in this directory to the
/etc/fapolicyd/compiled.rules file. Rules in
/etc/fapolicyd/fapolicyd.trust are still processed by the
fapolicyd framework but only for ensuring backward compatibility.
iptables-nft have been deprecated
iptables-nft packages have been deprecated in RHEL. The
iptables-nft package contains different tools such as
arptables. These tools will no longer receive new features and using them for new deployments is not recommended. As a replacement, prefer using the
nft command-line tool provided by the
nftables package. Existing setups should migrate to
nft if possible.
When you load the
ipset module, the module logs the following warning to the
Warning: <module_name> - this driver is not recommended for new deployments. It continues to be supported in this RHEL release, but it is likely to be removed in the next major release. Driver updates and fixes will be limited to critical issues. Please contact Red Hat Support for additional information.
For more information on migrating to nftables, see Migrating from iptables to nftables, as well as the
ip6tables-translate(8) man pages.
Network teams are deprecated in RHEL 9
teamd service and the
libteam library are deprecated in Red Hat Enterprise Linux 9 and will be removed in the next major release. As a replacement, configure a bond instead of a network team.
Red Hat focuses its efforts on kernel-based bonding to avoid maintaining two features, bonds and teams, that have similar functions. The bonding code has a high customer adoption, is robust, and has an active community development. As a result, the bonding code receives enhancements and updates.
For details about how to migrate a team to a bond, see Migrating a network team configuration to network bond.
NetworkManager stores new network configurations to
/etc/NetworkManager/system-connections/ in a key-file format
Previously, NetworkManager stored new network configurations to
/etc/sysconfig/network-scripts/ in the
ifcfg format. Starting with RHEL 9.0, RHEL stores new network configurations at
/etc/NetworkManager/system-connections/ in a key-file format. The connections for which the configurations are stored to
/etc/sysconfig/network-scripts/ in the old format still work uninterrupted. Modifications in existing profiles continue updating the older files.
iptables back end in
firewalld is deprecated
In RHEL 9, the
iptables framework is deprecated. As a consequence, the
iptables backend and the
direct interface in
firewalld are also deprecated. Instead of the
direct interface you can use the native features in
firewalld to configure the required rules.
ATM encapsulation is deprecated in RHEL 9
Asynchronous Transfer Mode (ATM) encapsulation enables Layer-2 (Point-to-Point Protocol, Ethernet) or Layer-3 (IP) connectivity for the ATM Adaptation Layer 5 (AAL-5). Red Hat has not been providing support for ATM NIC drivers since RHEL 7. The support for ATM implementation is being dropped in RHEL 9. These protocols are currently used only in chipsets, which support the ADSL technology and are being phased out by manufacturers. Therefore, ATM encapsulation is deprecated in Red Hat Enterprise Linux 9.
For more information, see PPP Over AAL5, Multiprotocol Encapsulation over ATM Adaptation Layer 5, and Classical IP and ARP over ATM.
v4l/dvb television and video capture devices are no longer supported
With RHEL 9, Red Hat no longer supports
Linux DVB (
DVB) devices that consist of various television tuner cards and miscellaneous video capture cards and Red Hat no longer provides their associated drivers.
7.5. File systems and storage
lvm2-activation-generator and its generated services removed in RHEL 9.0
lvm2-activation-generator program and its generated services
lvm2-activation-net are removed in RHEL 9.0. The
lvm.conf event_activation setting, used to activate the services, is no longer functional. The only method for auto activating volume groups is event based activation.
7.6. Dynamic programming languages, web and database servers
libdb has been deprecated
RHEL 8 and RHEL 9 currently provide Berkeley DB (
libdb) version 5.3.28, which is distributed under the LGPLv2 license. The upstream Berkeley DB version 6 is available under the AGPLv3 license, which is more restrictive.
libdb package is deprecated as of RHEL 9 and might not be available in future major RHEL releases.
In addition, cryptographic algorithms have been removed from
libdb in RHEL 9 and multiple
libdb dependencies have been removed from RHEL 9.
libdb are advised to migrate to a different key-value database. For more information, see the Knowledgebase article Available replacements for the deprecated Berkeley DB (libdb) in RHEL.
(BZ#1927780, BZ#1974657, JIRA:RHELPLAN-80695)
7.7. Identity Management
SHA-1 in OpenDNSSec is now deprecated
OpenDNSSec supports exporting Digital Signatures and authentication records using the
SHA-1 algorithm. The use of the
SHA-1 algorithm is no longer supported. With the RHEL 9 release,
SHA-1 in OpenDNSSec is deprecated and it might be removed in a future minor release. Additionally, OpenDNSSec support is limited to its integration with Red Hat Identity Management. OpenDNSSec is not supported standalone.
The SSSD implicit files provider domain is disabled by default
The SSSD implicit
files provider domain, which retrieves user information from local files such as
/etc/shadow and group information from
/etc/groups, is now disabled by default.
To retrieve user and group information from local files with SSSD:
Configure SSSD. Choose one of the following options:
Explicitly configure a local domain with the
id_provider=filesoption in the
[domain/local] id_provider=files ...
filesprovider by setting
[sssd] enable_files_domain = true
Configure the name services switch.
# authselect enable-feature with-files-provider
7.8. Graphics infrastructures
X.org Server is now deprecated
The X.org display server is deprecated, and will be removed in a future major RHEL release. The default desktop session is now the Wayland session in most cases.
The X11 protocol remains fully supported using the XWayland back end. As a result, applications that require X11 can run in the Wayland session.
Red Hat is working on resolving the remaining problems and gaps in the Wayland session. For the outstanding problems in Wayland, see the Known issues section.
You can switch your user session back to the X.org back end. For more information, see Selecting GNOME environment and display protocol.
Motif has been deprecated
The Motif widget toolkit has been deprecated in RHEL, because development in the upstream Motif community is inactive.
The following Motif packages have been deprecated, including their development and debugging variants:
motif-static package has been removed.
Red Hat recommends using the GTK toolkit as a replacement. GTK is more maintainable and provides new features compared to Motif.
7.9. Red Hat Enterprise Linux System Roles
networking System Role displays a deprecation warning when configuring teams on RHEL 9 nodes
The network teaming capabilities have been deprecated in RHEL 9. As a result, using the
networking RHEL System Role on an RHEL 8 controller to configure a network team on RHEL 9 nodes, shows a warning about its deprecation.
SecureBoot image verification using SHA1-based signatures is deprecated
Performing SecureBoot image verification using SHA1-based signatures on UEFI (PE/COFF) executables has become deprecated. Instead, Red Hat recommends using signatures based on the SHA2 algorithm, or later.
Limited support for virtual machine snapshots
Creating snapshots of virtual machines (VMs) is currently only supported for VMs not using the UEFI firmware. In addition, during the snapshot operation, the QEMU monitor may become blocked, which negatively impacts the hypervisor performance for certain workloads.
Also note that the current mechanism of creating VM snapshots has been deprecated, and Red Hat does not recommend using VM snapshots in a production environment. However, a new VM snapshot mechanism is under development and is planned to be fully implemented in a future minor release of RHEL 9.
virt-manager has been deprecated
The Virtual Machine Manager application, also known as virt-manager, has been deprecated. The RHEL web console, also known as Cockpit, is intended to become its replacement in a subsequent release. It is, therefore, recommended that you use the web console for managing virtualization in a GUI. Note, however, that some features available in virt-manager may not be yet available in the RHEL web console.
libvirtd has become deprecated
libvirtd, has been deprecated in RHEL 9, and will be removed in a future major release of RHEL. Note that you can still use
libvirtd for managing virtualization on your hypervisor, but Red Hat recommends switching to the newly introduced modular
libvirt daemons. For instructions and details, see the RHEL 9 Configuring and Managing Virtualization document.
The virtual floppy driver has become deprecated
isa-fdc driver, which controls virtual floppy disk devices, is now deprecated, and will become unsupported in a future release of RHEL. Therefore, to ensure forward compatibility with migrated virtual machines (VMs), Red Hat discourages using floppy disk devices in VMs hosted on RHEL 9.
qcow2-v2 image format is deprecated
With RHEL 9, the qcow2-v2 format for virtual disk images has become deprecated, and will become unsupported in a future major release of RHEL. In addition, the RHEL 9 Image Builder cannot create disk images in the qcow2-v2 format.
Instead of qcow2-v2, Red Hat strongly recommends using qcow2-v3. To convert a qcow2-v2 image to a later format version, use the
qemu-img amend command.
Running RHEL 9 containers on a RHEL 7 host is not supported
Running RHEL 9 containers on a RHEL 7 host is not supported. It might work, but it is not guaranteed.
For more information, see Red Hat Enterprise Linux Container Compatibility Matrix.
SHA1 hash algorithm within Podman has been deprecated
The SHA1 algorithm used to generate the filename of the rootless network namespace is no longer supported in Podman. Therefore, rootless containers started before updating to Podman 4.1.1 from the RHBA-2022:5951 advisory have to be restarted if they are joined to a network (and not just using
slirp4netns) to ensure they can connect to containers started after the upgrade.
rhel9/pause has been deprecated
rhel9/pause container image has been deprecated.
7.12. Deprecated packages
This section lists packages that have been deprecated and will probably not be included in a future major release of Red Hat Enterprise Linux.
For changes to packages between RHEL 8 and RHEL 9, see Changes to packages in the Considerations in adopting RHEL 9 document.
The support status of deprecated packages remains unchanged within RHEL 9. For more information about the length of support, see Red Hat Enterprise Linux Life Cycle and Red Hat Enterprise Linux Application Streams Life Cycle.
The following packages have been deprecated in RHEL 9: