Technical Introduction to RHEL8
- 1. TECHNICAL INTRODUCTION TO RHEL 8 Antonio C. Vélez Báez Cloud Security Consultant OSCP, RHCE, RHCI, RHCX, RHCSA-RHOS, Linux+ August 30, 2019
- 2. AGENDA • What’s new - Overview • Where to get RHEL 8 ? • System management with Cockpit • What is new in package management ? • Container technologies : Podman, Buildah and Skopeo • Build your own RHEL images with Image Builder • Centralized user session recording with System recorder (tlog) • Networking changes • Storage changes • Security changes
- 3. :: WHAT’S NEW ?
- 4. WHAT’S NEW IN RHEL 8 ? • Cockpit improvements • YUM 4 , Application stream and Flatpak • Python 3.6 (**note on Ansible, 2.8+) • Kernel 4.18 (RHEL 7 : Kernel 3.10) • 5-level page table (up to 4 PB ram) • Networking changes • Security Changes • Nvdimm storage support • Containers : Podman, Buildah and Skopeo • Composer ( build custom RHEL images ) • System purpose ( record the intended use ) • Wayland ( xorg replacement ) • Stratis ( lvm replacement ) • Leapp ( release upgrade tool ) • New patches schedule • And more ...
- 5. :: WHERE TO GET RHEL 8 ?
- 6. Customer portal: • https://access.redhat.com/products/red-hat-enterprise-linux/ • ISO and KVM images Developer program: • https://developers.redhat.com/rhel8/ • VirtualBox image https://developers.redhat.com/rhel8/install-rhel8- vbox/ Architectures available: • x86_64 • ppc64le • aarch64 (raspberry pi) • S390x DOWNLOAD RHEL 8
- 7. :: SYSTEM MANAGEMENT WITH COCKPIT
- 8. COCKPIT Cockpit is an interactive server admin interface (https://cockpit-project.org/) • IDM - idm domain admin can manage Cockpit • Manage remote server via dashboard • New Subscription manager gui • Manage users and groups • Manage and configure networks • Install and remove packages • Tlog (session recorder) gui • Composer - gui • Virt manager replacement
- 9. :: WHAT IS NEW IN PACKAGE MANAGEMENT ?
- 10. APPLICATION STREAM Provides modularity to package management • RHEL 8 content is distributed through the two main repositories: BaseOS and Application Stream (AppStream). BaseOS • The BaseOS repository provides the core set of the underlying OS content in the form of traditional RPM packages. Same lifecycle as RHEL 7 Application Stream • The Application Stream repository provides content with varying life cycles as both modules and traditional packages.
- 11. FLATPAK Flatpak is a next-generation technology for building and distributing desktop applications on Linux
- 12. :: BUILD YOUR OWN RHEL IMAGES WITH IMAGE BUILDER
- 20. :: BUILD YOUR OWN RHEL IMAGES WITH IMAGE BUILDER
- 22. :: SYSTEM RECORDER - TLOG
- 26. IPVLAN connects containers nested in virtual machines to networking hosts • IPVLAN is a driver for a virtual network device that can be used in a container environment to access the host network • IPVLAN exposes a single MAC address to the external network, regardless the number of IPVLAN devices inside the host network • So even with multiple IPVLAN devices in multiple containers, the local switch will see one single MAC address only.
- 29. • Stratis is a new volume management file system that is faster and easier to manage than its predecessors • It is Red Hat’s answer to Btrfs, ZFS and LVM and enables advanced storage features • Thin provisioning • Snapshosts • Cache tire • Programmatic API • Monitoring and Repair • Stratis is not a file system, it’s a solution that helps organizing storage into pools from which multiple independent file systems can be created UNDERSTANDING STRATIS
- 30. :: SECURITY NFS TABLES
- 31. • nftables is the successor of iptables • In RHEL 8, nftables is used as the back-end to firewalld • Architecture is very similar to iptables syntax Many improvements: • Support for lookup tables, which means that rules no longer a scanned in a linear way • Updates to chains are atomic and don't require a reload of the entire table • Kernel can update applications about rule changes • Using the "inet" protocol family, rules can be applied for IPv4 and IPv6 simultaneously UNDERSTANDING NFTABLES