DOCSLIB.ORG

Linux on IBM Z and Linuxone How to Troubleshoot —

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Linux on IBM Z and Linuxone How to Troubleshoot — Linux on IBM Z and LinuxONE How to troubleshoot July 16, 2020 — Sa Liu Linux on IBM Z and LinuxONE Service & Support Trademarks The following are trademarks of the International Business Machines Corporation in the United States and/or other countries. CICS* Global Business Services* MQ* SPSS* XIV* z/VSE* Cognos* IBM* Parallel Sysplex* System Storage* zEnterprise* DataStage* IBM (logo)* QualityStage System x* z/OS* DB2* InfoSphere Rational* Tivoli* z Systems* GDPS Maximo* Smarter Cities WebSphere* z/VM* * Registered trademarks of IBM Corporation Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. IT Infrastructure Library is a Registered Trade Mark of AXELOS Limited. ITIL is a Registered Trade Mark of AXELOS Limited. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom. UNIX is a registered trademark of The Open Group in the United States and other countries. VMware, the VMware logo, VMware Cloud Foundation, VMware Cloud Foundation Service, VMware vCenter Server, and VMware vSphere are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in the United States and/or other jurisdictions. Other product and service names might be trademarks of IBM or other companies. Notes: Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput improvements equivalent to the performance ratios stated here. IBM hardware products are manufactured from new parts, or new and serviceable used parts. Regardless, our warranty terms apply. All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics will vary depending on individual customer configurations and conditions. This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without notice. Consult your local IBM business contact for information on the product or services available in your area. All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Information about non-IBM products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance, compatibility, or any other claims related to non- IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography. This information provides only general descriptions of the types and portions of workloads that are eligible for execution on Specialty Engines (e.g, zIIPs, zAAPs, and IFLs) ("SEs"). IBM authorizes customers to use IBM SE only to execute the processing of Eligible Workloads of specific Programs expressly authorized by IBM as specified in the “Authorized Use Table for IBM Machines” provided at www.ibm.com/systems/support/machine_warranties/machine_code/aut.html (“AUT”). No other workload processing1 is authorized for execution on an SE. IBM offers SE at a lower price than General Processors/Central Processors because customers are authorized to use SEs only to process certain types and/or amounts of workloads as specified by IBM in the AUT. INTRODUCTION DATA STORAGE NETWORK PERFORMANCE CUSTOMER COLLECTION TROUBLESHOOTING TROUBLESHOOTING TROUBLESHOOTING CASES Agenda 2 Linux on Z troubleshooting § Understand the problem § What are the symptoms of the problem? § Where / When / Under which condition does the problem occur? § Can the problem be reproduced? § What do you need to do? § Collect data before recovery § Collect data right after the problem occurs § Collect data from a healthy system § Keep track of the system setup and the latest changes 3 Linux on Z troubleshooting § How to do it? § Get the system prepared for data collection § Install packages for Linux tools (s390-tools, sysstat, perf …) § Enable Linux kdump / have disks ready for standalone dump § Enable regular system activity monitoring § Learn to use the tools for data analysis 4 § System data § Performance data Data Collection § System dump 5 Collect System Data § dbginfo.sh § sosreport - RHEL § supportconfig - SLES § sosreport - Ubuntu 6 Collect System Data § dbginfo.sh – a script that collects data for debugging Linux on Z (requires root authority ) § It collects: § System information and generic configuration data Run before reboot! § List of devices and their configurations § System logs / trace data Distribution Package name § s390 debug buffer RHEL s390util § z/VM or KVM basic data SLES s390-tools (if Linux runs under z/VM or KVM) Ubuntu s390-tools 7 dbginfo.sh output root@system: # dbginfo.sh dbginfo.sh: Debug information script version 2.11.0-7.27 Copyright IBM Corp. 2002, 2018 Hardware platform = s390x Kernel version = 5.3.18 (5.3.18-22-default) Runtime environment = LPAR root@system # cd /tmp/DBGINFO-2020-07-15-08-44-18-test-1CA1E7/ s8315028:/tmp/DBGINFO-2020-07-15-08-44-18-test-1CA1E7 1 of 13: Collecting command output root@system # ls -t 2 of 13: Collecting z/VM command dbginfo.log etc sysfs.tgz 3 of 13: Collecting procfs osa_oat_eth3.raw usr proc 4 of 13: Collecting sysfs osa_oat.out lib zvm_runtime.out 5 of 13: Collecting log files osa_oat_eth1.raw boot runtime.out 6 of 13: Collecting config files osa_oat_eth2.raw run journalctl.out 7 of 13: Collecting osa oat output osa_oat_eth0.raw var 8 of 13: Collecting ethtool output 9 of 13: Collecting OpenVSwitch output skipped 10 of 13: Collecting domain xml files skipped 11a of 13: Collecting docker container output skipped Linux commands output z/VM commands output 11b of 13: Collecting docker network output skipped 12 of 13: Collecting nvme output 13 of 13: Postprocessing Finalizing: Creating archive with collected data Make sure you have enough disk space under /tmp Collected data was saved to: >> /tmp/DBGINFO-2020-07-15-08-44-18-test-1CA1E7.tgz << Use “dbginfo.sh -d <directory>” to specify another location for the tarball Review the collected data before sending to your service 8 organization. Collect Performance Data § sadc – system activity data collector § perf – performance analysis tool § iostat – monitors I/O device load and the CPU utilization § dasdstat – display DASD performance data § ziomon / ziorep – collect FCP performance data and generate reports § z/VM MONWRITE – collects CP *MONITOR data § hyptop – dynamic real-time view of hypervisor For more details refer to the book Troubleshooting Guide 9 Collect Performance Data § sadc – system activity data collector (sysstat package) root@system: #/usr/lib64/sa/sadc -S XALL 10 sadc_output § Collect all counters at 10 second interval to a binary output file § sar – system activity report root@system: # sar -A -f sadc_output > sar_output § Convert the binary output file to a plain text report § Start sysstat service as a permanent service (recommended) § sadc default configuration at 10-minute intervals (/var/log/sa/) § Under z/VM, collect MONWRITE data in the same time period and same interval as sadc data! 10 Collect Performance Data § kSar – graphical sar analysis tool 11 Collect Performance Data § Recommended data collection process § 1) run dbginfo.sh # /sbin/dbginfo.sh § 2) start sadc at 5 second interval # /usr/lib64/sa/sadc -S XALL 5 /tmp/server_sadc.out & § 3) run the test with workload § 4) stop the sadc with # killall sadc § 5) run dbginfo again # /sbin/dbginfo.sh § 6) convert sadc output file to a report # sar -A -f /tmp/server_sadc.out > server_sar 12 Collect System Dump For more details refer to the book Using the Dump Tools 13 kdump – Kernel Crash Dump § To boot a new instance of the kernel in a pre- reserved memory section § To copy the existing memory untouched to storage or via network § kexec tool § crashkernel=auto ( minimum amount of memory required: 4GB) 14 Configure the kdump on RHEL § Install kdump service # yum install
Load more

Recommended publications
  • MLNX OFED Documentation Rev 5.0-2.1.8.0
    MLNX_OFED Documentation Rev 5.0-2.1.8.0 Exported on May/21/2020 06:13 AM https://docs.mellanox.com/x/JLV-AQ Notice This document is provided for information purposes only and shall not be regarded as a warranty of a certain functionality, condition, or quality of a product. NVIDIA Corporation (“NVIDIA”) makes no representations or warranties, expressed or implied, as to the accuracy or completeness of the information contained in this document and assumes no responsibility for any errors contained herein. NVIDIA shall have no liability for the consequences or use of such information or for any infringement of patents or other rights of third parties that may result from its use. This document is not a commitment to develop, release, or deliver any Material (defined below), code, or functionality. NVIDIA reserves the right to make corrections, modifications, enhancements, improvements, and any other changes to this document, at any time without notice. Customer should obtain the latest relevant information before placing orders and should verify that such information is current and complete. NVIDIA products are sold subject to the NVIDIA standard terms and conditions of sale supplied at the time of order acknowledgement, unless otherwise agreed in an individual sales agreement signed by authorized representatives of NVIDIA and customer (“Terms of Sale”). NVIDIA hereby expressly objects to applying any customer general terms and conditions with regards to the purchase of the NVIDIA product referenced in this document. No contractual obligations are formed either directly or indirectly by this document. NVIDIA products are not designed, authorized, or warranted to be suitable for use in medical, military, aircraft, space, or life support equipment, nor in applications where failure or malfunction of the NVIDIA product can reasonably be expected to result in personal injury, death, or property or environmental damage.
    [Show full text]
  • Storage Administration Guide Storage Administration Guide SUSE Linux Enterprise Server 12 SP4
    SUSE Linux Enterprise Server 12 SP4 Storage Administration Guide Storage Administration Guide SUSE Linux Enterprise Server 12 SP4 Provides information about how to manage storage devices on a SUSE Linux Enterprise Server. Publication Date: September 24, 2021 SUSE LLC 1800 South Novell Place Provo, UT 84606 USA https://documentation.suse.com Copyright © 2006– 2021 SUSE LLC and contributors. All rights reserved. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”. For SUSE trademarks, see https://www.suse.com/company/legal/ . All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its aliates. Asterisks (*) denote third-party trademarks. All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its aliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof. Contents About This Guide xii 1 Available Documentation xii 2 Giving Feedback xiv 3 Documentation Conventions xiv 4 Product Life Cycle and Support xvi Support Statement for SUSE Linux Enterprise Server xvii • Technology Previews xviii I FILE SYSTEMS AND MOUNTING 1 1 Overview
    [Show full text]
  • Course Outline & Schedule
    Course Outline & Schedule Call US 408-759-5074 or UK +44 20 7620 0033 Suse Linux Advanced System Administration Curriculum Linux Course Code SLASA Duration 5 Day Course Price $2,425 Course Description This instructor led SUSE Linux Advanced System Administration training course is designed to teach the advanced administration, security, networking and performance tasks required on a SUSE Linux Enterprise system. Targeted to closely follow the official LPI curriculum (generic Linux), this course together with the SUSE Linux System Administration course will enable the delegate to work towards achieving the LPIC-2 qualification. Exercises and examples are used throughout the course to give practical hands-on experience with the techniques covered. Objectives The delegate will learn and acquire skills as follows: Perform administrative tasks with supplied tools such as YaST Advanced network configuration Network troubleshooting and analysing packets Creating Apache virtual hosts and hosting user web content Sharing Windows and Linux resources with SAMBA Configuring a DNS server and configuring DNS logging Configuring a DHCP server and client Sharing Linux network resources with NFS Creating Unit Files Configuring AutoFS direct and indirect maps Configuring a secure FTP server Configuring a SQUID proxy server Creating Btrfs subvolumes and snapshots Backing-up and restoring XFS filesystems Configuring LVM and managing Logical Volumes Managing software RAID Centralised storage with iSCSI Monitoring disk status and reliability with SMART Perpetual
    [Show full text]
  • Fstrim, Lvm and Dmcrypt
    Blog Projects About me Contact Tweet synaptic fault mind dumped How to properly activate TRIM for your SSD on Linux: fstrim, lvm and dm­crypt Language Posted on Saturday, 23rd February 2013 27 comments English Español Unlike hard disk drives (HDDs), NAND flash memory that make SSD cannot overwrite existing data. This means that you first have to delete the old data before writing new one. Flash memory is divided into blocks, which is further divided in pages. The minimum write unit is a page, but the smallest erase unit is a Tags block. apache Applet debian email fpga game Git GNOME hack hardware kernel linux meego networking packages performance power management procmail python RFKill Security ssd tor trim usb virtualization war webkit wireless Categories http://planet.igalia.com http://planet.webkit.org http://planet.webkitgtk.org http://planetsecurity.org Share it! Data can be written directly into an empty page, but only whole blocks can be erased. Therefore, to reclaim the space taken up by invalid data, all the valid data from one block must be first copied and written into the empty pages of a new block. Only then can the invalid data in the original block be erased, making it ready Recent Posts for new valid data to be written. WebKitGTK+ Performance Bot! Do you see the problem? This means that as time goes on, the SSD will internally fragment the blocks How to connect to .onion Tor domains with among the different pages, until that it reaches a point where there won’t be available any empty page.
    [Show full text]
  • Certification Report BSI-DSZ-CC-0999-2016
    BSI-DSZ-CC-0999-2016 for Red Hat Enterprise Linux Version 7.1 from Red Hat BSI - Bundesamt für Sicherheit in der Informationstechnik, Postfach 20 03 63, D-53133 Bonn Phone +49 (0)228 99 9582-0, Fax +49 (0)228 9582-5477, Infoline +49 (0)228 99 9582-111 Certification Report V1.0 CC-Zert-327 V5.14 BSI-DSZ-CC-0999-2016 (*) Operating System Red Hat Enterprise Linux Version 7.1 from Red Hat SOGIS Recognition Agreement PP Conformance: Operating System Protection Profile, Version 2.0, 01 June 2010, BSI-CC-PP-0067-2010, OSPP Extended Package – Advanced Management, Version 2.0, 28 May 2010, OSPP Extended Package – Labeled Security, Version 2.0, 28 May 2010 Functionality: PP conformant plus product specific extensions Common Criteria Part 2 extended Assurance: Common Criteria Part 3 conformant EAL 4 augmented by ALC_FLR.3 The IT Product identified in this certificate has been evaluated at an approved evaluation facility using the Common Methodology for IT Security Evaluation (CEM), Version 3.1 extended by Scheme Interpretations for conformance to the Common Criteria for IT Security Evaluation (CC), Version 3.1. CC and CEM are also published as ISO/IEC 15408 and ISO/IEC 18045. (*) This certificate applies only to the specific version and release of the product in its evaluated configuration and in conjunction with the complete Certification Report and Notification. For details on the validity see Certification Report part A chapter 4 The evaluation has been conducted in accordance with the provisions of the certification Common Criteria scheme of the German Federal Office for Information Security (BSI) and the conclusions Recognition Arrangement of the evaluation facility in the evaluation technical report are consistent with the evidence adduced.
    [Show full text]
  • Emulex Drivers for Linux User Guide Table of Contents
    Emulex® Drivers for Linux User Guide Release 12.6 Broadcom DRVLin-UG126-100 February 4, 2020 Broadcom, the pulse logo, Connecting everything, Avago Technologies, Avago, the A logo, Emulex, ExpressLane, and OneCommand are among the trademarks of Broadcom and/or its affiliates in the United States, certain other countries, and/ or the EU. Copyright © 2003–2020 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. For more information, please visit www.broadcom.com. Broadcom reserves the right to make changes without further notice to any products or data herein to improve reliability, function, or design. Information furnished by Broadcom is believed to be accurate and reliable. However, Broadcom does not assume any liability arising out of the application or use of this information, nor the application or use of any product or circuit described herein, neither does it convey any license under its patent rights nor the rights of others. Emulex Drivers for Linux User Guide Table of Contents Chapter 1: Introduction ...................................................................................................................... 5 1.1 Overview ....................................................................................................................................................................5 1.2 Abbreviations ............................................................................................................................................................5 Chapter 2: Installing
    [Show full text]
  • Red Hat Enterprise Linux 7 Kernel Administration Guide
    Red Hat Enterprise Linux 7 Kernel Administration Guide Examples of Tasks for Managing the Kernel Last Updated: 2018-05-21 Red Hat Enterprise Linux 7 Kernel Administration Guide Examples of Tasks for Managing the Kernel Marie Dolezelova Red Hat Customer Content Services [email protected] Mark Flitter Red Hat Customer Content Services Douglas Silas Red Hat Customer Content Services Eliska Slobodova Red Hat Customer Content Services Jaromir Hradilek Red Hat Customer Content Services Maxim Svistunov Red Hat Customer Content Services Robert Krátký Red Hat Customer Content Services Stephen Wadeley Red Hat Customer Content Services Florian Nadge Red Hat Customer Content Services Legal Notice Copyright © 2018 Red Hat, Inc. The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/ . In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates.
    [Show full text]
  • Linux Virtual Machine Preparation Guide for Protecting Virtual
    Linux Virtual Machine Preparation Guide For protecting virtual machines to Azure Version 2.0 Update 0520 Table of Contents ABOUT THIS GUIDE ................................................................................................................. 2 END STATE OPERATIONS GOALS ............................................................................................ 2 HOW TO PREPARE A CENTOS 6X OR REDHAT 6X-BASED VIRTUAL MACHINES ..................... 3 Assumptions .................................................................................................................. 3 Step 1: Modify Grub Options ........................................................................................ 3 Step 2: Configure agetty serial console ......................................................................... 4 Step 3: Add HyperV drivers to the dracut config .......................................................... 4 Step 4: Check to see if Hyper-V modules are loaded .................................................... 5 Step 4: Add persistent rule for Azure Nics .................................................................... 5 Step 5: Creating an ifcfg-eth file for the Azure NIC: ...................................................... 6 HOW TO PREPARE A CENTOS 7X OR REDHAT 7X-BASED VIRTUAL MACHINES ..................... 8 Assumptions .................................................................................................................. 8 Step 1: Modify Grub Options .......................................................................................
    [Show full text]
  • Security Policy
    Red Hat Enterprise Linux OpenSSL Cryptographic Module version 7.0 FIPS 140-2 Non-proprietary Security Policy version 1.3 Last Update: 2019-09-19 Red Hat Enterprise Linux OpenSSL Cryptographic Module FIPS 140-2 Non-proprietary Security Policy Table of Contents 1. Cryptographic Modules' Specifications.......................................................................................................3 1.1. Description of the Module........................................................................................................................3 1.2. Description of the Approved Modes.........................................................................................................4 1.3. Cryptographic Boundary.......................................................................................................................... 7 1.3.1. Hardware Block Diagram...........................................................................................................8 1.3.2. Software Block Diagram.............................................................................................................9 2. Cryptographic Modules' Ports and Interfaces...........................................................................................10 3. Roles, Services and Authentication..........................................................................................................11 3.1. Roles....................................................................................................................................................
    [Show full text]
  • Red Hat Enterprise Linux 8 Security Hardening
    Red Hat Enterprise Linux 8 Security hardening Securing Red Hat Enterprise Linux 8 Last Updated: 2020-10-14 Red Hat Enterprise Linux 8 Security hardening Securing Red Hat Enterprise Linux 8 Legal Notice Copyright © 2020 Red Hat, Inc. The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/ . In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js ® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
    [Show full text]
  • Storage Administration Guide Storage Administration Guide SUSE Linux Enterprise Server 15
    SUSE Linux Enterprise Server 15 Storage Administration Guide Storage Administration Guide SUSE Linux Enterprise Server 15 Provides information about how to manage storage devices on a SUSE Linux Enterprise Server. Publication Date: September 24, 2021 SUSE LLC 1800 South Novell Place Provo, UT 84606 USA https://documentation.suse.com Copyright © 2006– 2021 SUSE LLC and contributors. All rights reserved. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”. For SUSE trademarks, see https://www.suse.com/company/legal/ . All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its aliates. Asterisks (*) denote third-party trademarks. All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC, its aliates, the authors nor the translators shall be held liable for possible errors or the consequences thereof. Contents About This Guide xi 1 Available Documentation xi 2 Giving Feedback xiii 3 Documentation Conventions xiii 4 Product Life Cycle and Support xv Support Statement for SUSE Linux Enterprise Server xvi • Technology Previews xvii I FILE SYSTEMS AND MOUNTING 1 1 Overview of File Systems
    [Show full text]
  • Security Capabilities of Red Hat Enterprise Linux 8
    TOP 10 SECURITY CHANGES IN RED HAT ENTERPRISE LINUX 8 Taymour Elerian Ron Marshall Sr. Solution Architect Sr. Solution Architect WHAT WE ARE TALKING ABOUT Red Hat® Enterprise Linux® 8, of course We aren’t talking about New, or new to you, features in The full Red Hat Enterprise Linux Roadmap Red Hat Enterprise Linux 8 Provide some guidance to you Open source community leadership about what action to take next Focused on the security features Hardware, software, and of Red Hat Enterprise Linux cloud provider partnership Not talking about ALL of the Hundreds of existing security features : Common security enhancements Criteria & FIPS validations, NBDE & LUKS disk crypto, AIDE, IMA, Identity Management, Web SSO etc. AGENDA Consistent and strong crypto policy Libssh: SSH communications Compiler flags and static code analysis Software identification (SWID) tags FIPS mode made easy Session recording Smart cards and HSMs Finer-grained SELinux support TLS 1.3 systemwide Trusted platform module usage CONSISTENT AND STRONG CRYPTO POLICY 4 policies LEGACY ● Solves the problem of ensuring systemwide consistent cryptography settings for addressing compliance requirements DEFAULT ● Easy to use and easy to automate - far less error prone # update-crypto-policies --set FUTURE FIPS 140 # update-crypto-policies --show ● Sets allowed key lengths, hashes, parameters, protocols, and algorithms FUTURE SYSTEMWIDE EFFECTS OF CRYPTO POLICY Applications and groups that follow the crypto policies libkrb5 BIND Guidance ● Use the Red Hat Enterprise OpenSSL OpenJDK Linux-provided Crypto libraries and Red Hat Enterprise Linux-provided utilities GnuTLS OpenSSH ● Test with DEFAULT and FUTURE policies ● Consider using SHA256 hashes Libreswan Python instead of SHA1 NSS EXAMPLE : TLS 1.1 LEGACY allows TLS 1.1 # update-crypto-policies --set LEGACY # wget https://tls-v1-1.badssl.com:1011/ HTTP request sent, awaiting response..
    [Show full text]