CentOS 7.x Red Hat Enterprise Linux 7.4 beta released

buik · May 30, 2017

Red Hat Enterprise Linux 7.4 beta is released.

Noteworthy changes for webservers: Openssl rebased to version 1.0.2k.

OpenSSL HTTP/2.0 enhancements: Added support for the Application-Layer Protocol Negotiation (ALPN).

Release notes

eva2000 · May 30, 2017

yay finally OpenSSL 1.0.2k for ALPN/HTTP/2 support !

Now to wait for CentOS 7.4

eva2000 · May 31, 2017

interesting https://access.redhat.com/documenta...se_Notes/new_features_compiler_and_tools.html

A new compatibility environmental variable for egrep and fgrep
In an earlier grep rebase, the egrep and fgrep commands were replaced by grep -E and grep -F respectively. This change could affect customer scripts because only grep was shown in the outupt of the ps command. To prevent such problems, this update introduces a new compatibility environmental variable: GREP_LEGACY_EGREP_FGREP_PS. To preserve showing egrep and fgrep in ps output, set the variable to 1:

GREP_LEGACY_EGREP_FGREP_PS=1
Click to expand...

tar now follows symlinks to directories when extracting from the archive
This update adds the --keep-directory-symlink option to the tar command. This option changes the behavior of tar when it encounters a symlink with the same name as the directory that it is about to extract. By default, tar would first remove the symlink and then proceed extracting the directory. The --keep-directory-symlink option disables this behavior and instructs tar to follow symlinks to directories when extracting from the archive.
Click to expand...

⁠wget now supports specification of the TLS protocol version
Previously, the wget utility used the highest TLS protocol version 1.2 by default when connecting to a remote server. With this update, wget has been enhanced to allow the user to explicitly select the TLS protocol minor version by adding the --secure-protocol=TLSv1_1 or --secure-protocol=TLSv1_2 command-line options to the wget command.
Click to expand...

centmin mod wget already supports this sort of
Code (Text):
wget -h
GNU Wget 1.19.1, a non-interactive network retriever.
Usage: wget [OPTION]... [URL]...

Mandatory arguments to long options are mandatory for short options too.

...

HTTPS (SSL/TLS) options:
       --secure-protocol=PR        choose secure protocol, one of auto, SSLv2,
                                     SSLv3, TLSv1 and PFS
Chapter 12. Kernel

⁠Jitter Entropy RNG added to the kernel
This update adds the Jitter Entropy Random Number Generator (RNG), which collects entropy through CPU timing differences to the Linux kernel. This RNG is by default available through the algif_rng interface. The generated numbers can be added back to the kernel through the /dev/random file, which makes these numbers available to other /dev/random users. As a result, the operating system now has more sources of entropy available.
Click to expand...

Chapter 13. Networking

telnet now supports the -6 option
With this update, the telnet utility supports the -6 option to test IPv6 connections.
Click to expand...

The scalability of UDP sockets has been improved
This update improves UDP forward memory accounting and reduces the lock contention of UDP sockets. As a result, the overall ingress throughput of UDP sockets receiving traffic from multiple peers is considerably increased without any outward functional changes.
Click to expand...

⁠iproute now supports lightweight tunnels
With this update, support for lightweight tunnels has been added to the iproute command. This allows users to manually create lightweight tunnels on the command line
Click to expand...

Chapter 14. Security

⁠openssh rebased to version 7.4
The openssh package has been updated to upstream version 7.4, which provides a number of enhancements, new features, and bug fixes, including:

Added support for the resumption of interrupted uploads in SFTP.

Added the extended log format for the authentication failure messages.

Added the UseDNS defaults No option.

Added a new fingerprint type that uses the SHA-256 algorithm.

Added support for using PKCS#11 devices with external PIN entry devices.

Removed support for the SSH-1 protocol from the OpenSSH server.

Removed support for the legacy v00 cert format.

Added the PubkeyAcceptedKeyTypes and HostKeyAlgorithms configuration options for the ssh utility and the sshd daemon to allow disabling key types selectively.

Added the AddKeysToAgent option for the OpenSSH client.

Added the ProxyJump ssh option and the corresponding -J command-line flag.

Added support for the Diffie-Hellman 2K, 4K, and 8K groups.

Added the Include directive for the ssh_config file.

Removed support for the UseLogin option.

Removed support for the pre-authentication compression in the server.

The seccomp filter is now used for the pre-authentication process. (BZ#1341754)

Click to expand...

for addons/auditd.sh users https://community.centminmod.com/th...td-support-added-in-latest-123-09beta01.9071/

audit rebased to version 2.7.6
The audit packages have been updated to upstream version 2.7.6, which provides a number of enhancements, new features, and bug fixes, including:

the auditd service now automatically adjusts logging directory permissions when it starts up. This helps keep directory permissions correct after performing a package upgrade.

the ausearch utility has a new --format output option. The --format text option presents an event as an English sentence describing what is happening. The --format csv option normalizes logs into a subject, object, action, results, and how it occurred in addition to some metadata fields which is output in the Comma Separated Value (CSV) format. This is suitable for pushing event information into a database, spreadsheet, or other analytic programs to view, chart, or analyze audit events.

the auditctl utility can now reset the lost event counter in the kernel through the --reset-lost command-line option. This makes checking for lost events easier since you can reset the value to zero daily.

ausearch and aureport now have a boot option for the --start command-line option to find events since the system booted.

ausearch and aureport provide a new --escape command-line option to better control what kind of escaping is done to audit fields. It currently supports raw, tty, shell, and shell_quoteescaping.

auditctl no longer allows rules with the entry filter. This filter has not been supported since Red Hat Enterprise Linux 5. Prior to this release, on Red Hat Enterprise Linux 6 and 7, auditctl moved any entry rule to the exit filter and displayed a warning that the entry filter is deprecated.

Click to expand...

my fav

openssl rebased to version 1.0.2k
The openssl package has been updated to upstream version 1.0.2k, which provides a number of enhancements, new features, and bug fixes, including:

Added support for the datagram TLS (DTLS) protocol version 1.2.

Added support for the TLS automatic elliptic curve selection.

Added support for the Application-Layer Protocol Negotiation (ALPN).

Added Cryptographic Message Syntax (CMS) support for the following schemes: RSA-PSS, RSA-OAEP, ECDH, and X9.42 DH.

Note that this version is compatible with the API and ABI in the OpenSSL library version in previous releases of Red Hat Enterprise Linux 7.
Click to expand...

⁠libreswan rebased to version 3.20
The libreswan packages have been upgraded to upstream version 3.20, which provides a number of bug fixes and enhancements over the previous version. Notable enhancements include:

Added support for Opportunistic IPsec (Mesh Encryption), which enables IPsec deployments that cover a large number of hosts using a single simple configuration on all hosts.

FIPS further tightened.

Added support for routed-based VPN using Virtual Tunnel Interface (VTI).

Improved support for non-root configurations.

Improved Online Certificate Status Protocol (OCSP) and Certificate Revocation Lists (CRL) support.

Added new whack command options: --fipsstatus, --fetchcrls, --globalstatus, and --shuntstatus.

Added support for the NAT Opportunistic Encryption (OE) Client Address Translation: leftcat=yes.

Added support for the Traffic Flow Confidentiality mechanism: tfc=.

Updated cipher preferences as per RFC 4307bis and RFC 7321bis.

Added support for Extended Sequence Numbers (ESN): esn=yes.

Added support for disabling and increasing the replay window: replay-window=

Click to expand...

ca-certificates now meet Mozilla Firefox 52.2 ESR requirements
The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017
Click to expand...

https://access.redhat.com/documenta..._Notes/new_features_servers_and_services.html

logrotate now uses /var/lib/logrotate/logrotate.status as the default state file
Previously, the logrotate cron job used a modified path to the logrotate state file. Consequently, the path used by the cron job did not match the default state file path used by logrotate itself. To prevent confusion, the default state file path used by logrotate has been changed to match the state file path used by logrotate cron job. As a result, logrotate now uses /var/lib/logrotate/logrotate.status as the default state file path in both scenarios.
Click to expand...

rsyslog rebased to version 8.24.0
The rsyslog utility has been rebased to upstream version 8.24.0, which includes numerous enhancements, new features and bug fixes. Notable improvements include:

A new core engine has been implemented, offering faster message processing.

Speed and stability when handling data in the JSON format have been improved.

The RainerScript configuration format has been selected as default and improved with more options.

A new mmexternal module for manipulation of messages inside rsyslog using external applications has been added.

The omprog module has received improvements for better communication with external binaries.

Modules imrelp and omrelp now support encrypted transmission using the TLS protocol.

The imuxsock module now supports rule sets for individual sockets, which override the global rule set.

When the imuxsock module is used, rate limiting messages now include PID of the process that causes the rate limiting.

The TCP server error messages now include the IP address of the remote host.

The imjournal module no longer stops receiving logs after switching to the persistent journaldconfiguration.

Logging to the runtime journal no longer completely stops after a reboot when the machine's clock was set to an earlier time.

Click to expand...

https://access.redhat.com/documenta..._Notes/chap-RHSCL.html#sect-RHSCL-Changes-DTS

Changes in Red Hat Developer Toolset
The following components have been upgraded in Red Hat Developer Toolset 6.1 compared to the previous release of Red Hat Developer Toolset:

GCC to version 6.3.1

elfutils to version 0.168

GDB to version 7.12.1

Additionally, a bug fix update is available for ltrace.
For detailed information on changes in 6.1, see the Red Hat Developer Toolset User Guide.
Click to expand...

eva2000 · May 31, 2017

hmm Chapter 1. Red Hat Software Collections 2.4

so much for OpenSSL 1.0.2K and Apache HTTP/2 ?

httpd24 component, BZ#1327548
The mod_ssl module does not support the Application-Layer Protocol Negotiation (ALPN) protocol on Red Hat Enterprise Linux. Consequently, clients that support upgrading TLS connections to HTTP/2 only using ALPN are limited to HTTP/1.1 support. Clients that support the NPN protocol in addition to ALPN are able to successfully upgrade to HTTP/2.
Click to expand...

httpd24 component, BZ#1224763
When using the mod_proxy_fcgi module with FastCGI Process Manager (PHP-FPM), httpd uses port 8000 for the FastCGI protocol by default instead of the correct port 9000. To work around this problem, specify the correct port explicitly in configuration
Click to expand...

httpd, mariadb, mongodb, mysql, nodejs, perl, php55, rh-php56, python, ruby, ror, thermostat, and v8314components, BZ#1072319
When uninstalling the httpd24, mariadb55, rh-mariadb100, mongodb24, rh-mongodb26, mysql55, rh-mysql56, nodejs010, perl516, rh-perl520, php55, rh-php56, python27, python33, rh-python34, ruby193, ruby200, rh-ruby22, ror40, rh-ror41, thermostat1, or v8314 packages, the order of uninstalling can be relevant due to ownership of dependent packages. As a consequence, some directories and files might not be removed properly and might remain on the system.
Click to expand...

httpd component
Compiling external applications against the Apache Portable Runtime (APR) and APR-util libraries from the httpd24 Software Collection is not supported. The LD_LIBRARY_PATH environment variable is not set in httpd24 because it is not required by any application in this Software Collection.
Click to expand...

eva2000 · May 31, 2017

Chapter 45. Deprecated Functionality

Deprecated Insecure Algorithms and Protocols
Algorithms that provide cryptographic hashes and encryption as well as cryptographic protocols have a lifetime after which they are considered either too risky to use or plain insecure.
Weak ciphers and algorithms are no longer used by default in OpenSSH
With this update, the OpenSSH library removes several weak ciphers and algorithms from default configurations. However, backward compatibility is ensured in most cases.
The following were removed from the OpenSSH server and client:

Host key algorithms:

ssh-rsa-cert-v00@openssh.com

and ssh-dss-cert-v00@openssh.com

Ciphers:

arcfour256

arcfour128

arcfour

rijndael-cbc@lysator.liu.se

MACs:

hmac-md5

hmac-md5-96

hmac-md5-96-etm@openssh.com

hmac-md5-etm@openssh.com

hmac-ripemd160

hmac-ripemd160-etm@openssh.com

hmac-ripemd160@openssh.com

hmac-sha1-96

hmac-sha1-96-etm@openssh.com (MD5, truncated SHA-1, RIPEMD160)

The following were removed from the OpenSSH client:

Ciphers: blowfish-cbc, cast128-cbc, and 3des-cbc.

OpenSSH no longer uses the SHA-1-based key exchange algorithms in FIPS mode
This update removes the SHA-1-based key exchange algorithms from the default list in FIPS mode. To enable those algorithms, use the following configuration snippet for the ~/.ssh/config and /etc/ssh/sshd_config files:
The SSH-1 protocol has been removed from the OpenSSH server
SSH-1 protocol support was removed from the OpenSSH server. For more information, see the The server-side SSH-1 protocol removal from RHEL 7.4 article.

MD5, MD4, and SHA0 can no longer be used as signing algorithms in OpenSSL
With this update, support for verification of MD5, MD4, and SHA0 signatures in certificates, Certificate Revocation Lists (CRL) and message signatures has been removed.
Additionally, the default algorithm for generating digital signatures has been changed from SHA-1 to SHA-256. The verification of SHA-1 signatures is still enabled for legacy purposes.

OpenSSL clients no longer allow connections to servers with DH shorter than 1024 bits
This update prevents OpenSSL clients from connecting to servers with Diffie-Hellman (DH) parameters shorter than 1024 bits. This ensures that clients using OpenSSL are not susceptible to vulnerabilities such as Logjam.
Click to expand...

eva2000 · Jun 18, 2017

More on Red Hat 7.4 beta and thus CentOS 7.4 https://access.redhat.com/blogs/766093/posts/3050871

Enhancing the security of the OS with cryptography changes in Red Hat Enterprise Linux 7.4

...with the release of Red Hat Enterprise Linux (RHEL) 7.4 beta, we are introducing several cryptographic updates to RHEL and we also are introducing a multitude of new features and enhancements. We continue and extend our protocol deprecation effort started in RHEL 6.9, improve access to kernel-provided PRNG with the getrandom system call, as well as ensure that HTTP/2 supporting technologies like ALPN in TLS, and DTLS 1.2, are supported universally in our operating system. Python applications are also made secure by default by enabling certificate verification by default in TLS sessions. We are also proud to bring the OpenSC smart card drivers into RHEL 7.4, incorporating our in-house developed drivers and merging our work with the OpenSC project community efforts. At the same time, the introduced crypto changes ensure that RHEL 7.4 meets the rigorous security certification requirements for FIPS140-2 cryptographic modules.
Click to expand...

Concluding remarks
All of the above changes ensure that Red Hat Enterprise 7 remains a leader in the adoption of new technologies with security built into the OS. Red Hat Enterprise Linux not only carefully evaluates and incorporates new technologies, but technologies that are no longer relevant and pose a security risk are regularly phased out. Specifically, HTTP/2-supporting protocols are made available in all of our cryptographic back-ends. We also align with the community on smart card development not only by bringing our improvements to the OpenSC project, but by introducing it as a fully supported component in Red Hat Enterprise Linux 7. Furthermore, with the introduction of Datagram TLS 1.2 in OpenSSL, and the updates in OpenSSH in order to support other than SHA-1 cryptographic hashes, we ensure that all Red Hat Enterprise Linux 7 applications utilize the right cryptographic algorithms which can resist today’s threats.

On the other hand, we reduce the attack surface of the operating system, by removing support for SSH 1.0, SSL 2.0, and the TLS ‘export’ cipher suites. That is a move which reduces the risk of successful future attacks, at the cost of removal of protocols which are today considered either too risky to use or plain insecure.

The removal of the previously mentioned protocols was an exceptional move because we are convinced that these are primarily used to attack misconfigured systems rather than for real-world use cases. Regarding any future changes, for example the disablement of SSL 3.0 or RC4, we would like to assure that it will be done in a way that systems can revert to the previous behavior when required by local policy.

All of these changes ensure Red Hat Enterprise Linux keeps pace with the reality of the security landscape around us, and improves its strong security foundation.
Click to expand...

Log in / Register

Forums

Welcome to Centmin Mod Community

CentOS 7.x Red Hat Enterprise Linux 7.4 beta released

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

CentOS 7.x Red Hat Enterprise Linux 7.4 beta released

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.