SlideShare una empresa de Scribd logo
1 de 121
Descargar para leer sin conexión
Learn, build, and deploy with
Red Hat Enterprise Linux 8:
An interactive workshop
Ahmed El-Rayess
Solutions Architect
Red Hat MEA
Mohamed Farag
Solutions Architect
Redington
1
Welcome
2
Agenda
09:00 - 09:30 : Onsite Registration
09:30 - 10:00 : Opening & Red Hat Enterprise Linux Overview (30 min)
10:00 - 10:35 : Managing Software from an Application Stream (35 min)
10:35 - 11:10 : The future of infrastructure (35 min)
11:10 - 11:45 : Break (35 min)
11:45 - 12:20 : Deploying Containers Using Podman (35 min)
12:20 - 12:55 : Configuring Terminal Session Recording (35 min)
12:55 - 13:30 : Configuring RHEL System-Wide Crypto Policy (35 min)
13:30 - 14:00 : Wrap-Up and Closing Remarks (30 min)
14:00 : Lunch
EVENT PRESENTERS
3
Name: Ahmed El-Rayess
Role/team: MEA Solutions Architect
Where you’re from:
Egypt
Introductions
Name: Mohamed Farag
Role/team: Redington
Where you’re from:
Egypt
4
LINUX IS THE FUTURE
Only two operating systems remain.
Source: Worldwide Server Operating Environments Market Shares, 2015: Linux Continues to Shape the Future (IDC #US41360517, December 2016)
5
RED HAT LEADS PAID LINUX MARKET
WORLDWIDE LINUX SERVER OPERATING ENVIRONMENT NEW LICENSE PAID SHIPMENTS/SUBSCRIPTIONS
AND NON-PAID DEPLOYMENTS BY VENDOR, 2012–2016 (000)
Source: Worldwide Server Operating Environments Market Shares, 2015: Linux Continues to Shape the Future (IDC #US41360517, December 2016)
Tried. Tested. Trusted.
Company overview
RED HAT ENTERPRISE LINUX
FROM COMMUNITIES TO ENTERPRISE
Open source
Enterprise workloads
require trusted platform
and partners
8
REDHATENTERPRISELINUX8
CONFIDENTIAL Designator
9
RED HAT ENTERPRISE LINUX 8
To deliver business advantages today,
organizations are shifting IT from
traditional infrastructure operations
and are focusing on service delivery.
CONFIDENTIAL Designator
10
RED HAT ENTERPRISE LINUX 8
Build your future on a stable, high-performing
platform that can scale to meet the needs of
your organization today and tomorrow.
WHAT’S NEW?
11
Easier adoption
for staff new to Linux®
More subscription value
with Red Hat Insights, now included in all
Red Hat Enterprise Linux subscriptions
A consistent experience
across bare-metal, virtual, and public and
hybrid cloud environments
Eased transition
to and adoption of containerized workloads with
community-driven, new container management
tools
Increased speed and ease of deployment
Security first
Further enhanced to cover the latest industry
requirements
Red Hat Enterprise Linux 8
12
RED HAT ENTERPRISE LINUX 8
Trusted partner
Focus on your business
We focus on support and engineering so you
don’t have to
Speed integration with common platforms
Ease management and integration of your
business applications
Innovate faster
Get to your next big thing without
building ours
OPTIMIZED EXPERIENCES FOR MISSION-CRITICAL
DATABASES
13
● Red Hat Enterprise Linux is the
reference platform for SQL Server
on Linux
● Benchmark-breaking performance
● Fast deployment and portability
via containers
● Red Hat Enterprise Linux is 1 of only
2 certified Linux distributions
● More than 20 years of Red Hat and
SAP joint engineering collaboration
● Exceptional performance and
scalability —the largest SAP install in
the world runs on Red Hat
Enterprise Linux
RED HAT ENTERPRISE LINUX 8
HARDWARE PARTNER ECOSYSTEM
14
OEMSSILICON IHVS
RED HAT ENTERPRISE LINUX 8
RED HAT CERTIFIED CLOUD AND SERVICE
PROVIDERS
15
RED HAT ENTERPRISE LINUX 8
Improved service
delivery brings Linux
to more new users
16
REDHATENTERPRISELINUX8
WHAT YOU NEED
17
● Web console
● System roles
How we deliver it
● Everyone, not just those
comfortable with the command line,
can participate in the process.
Why you need it
DevOps
REMOTE SINGLE-SYSTEM VIEWS IN THE
WEB CONSOLE
18
Browser-based interface
Offers remotely accessible user interface
using host security mechanisms
Consolidated view
Provides single view of tasks to speed
understanding and completion
Standard management tools
Uses system tools to change state, not
a separate workflow
RED HAT ENTERPRISE LINUX 8
NEW IN THE WEB CONSOLE
19
RED HAT ENTERPRISE LINUX 8
Virtual machines
Create and manage virtual machines
Network-bound disk encryption
Enroll disks with Tang server and manage
LUKS keys
Single sign-on configuration
Automatically configure when joining a
domain
SPEED AUTOMATION CREATION WITH SYSTEM ROLES
20
Common automation
Manage multiple versions of
Red Hat Enterprise Linux from a single role
Reduced rework
Import provided roles to eliminate
task creation in playbooks
Easy switching of providers
Change between default and optional
tools quickly and safely
timesync
RED HAT ENTERPRISE LINUX 8
dbserver
SELinux
network
webserver
CONFIDENTIAL Designator
Demo
21
● Managing System Updates Using the Web Console
22
REDHATENTERPRISELINUX8
Developers need access
to the latest tools.
Operations needs to know
those are stable and supported.
WHAT YOU NEED
23
● Application stream
● Predictable release cadence
How we deliver it
● You can’t wait for a new major release in
order to access new userspace packages
such as languages and frameworks
Why you need it
Open source
integration
YOU CAN’T SATISFY ALL THE PEOPLE
ALL THE TIME … OR CAN YOU?
Different people have different needs
24
Developer
I need a newer package than what is included
in the distribution!*
-or-
This software was built 2 years ago, I need the
2 years ago package, not the package thing!*
Architect or Administrator
I need to support the efforts of developers,
nay, plan for it!*
-and-
I need to manage the longevity of my
application, platform, or product!*
Independent Software Vendor
I went through this certification program
for my software I can’t do that for every dot
release, but need to be confident that I can
continue to support customers on this
version!*
* Source: Scenario based on conversions with Red Hat customers
RED HAT ENTERPRISE LINUX 8
25
Faster time to “Hello World”
Simpler deployment options
Use standardized platforms
for any environments
Ability to plan with confidence
Remove uncertainty from your
platforms
Latest stable tools
Combine open source innovation
with enterprise reliability
PREDICTABLE UPDATES
RED HAT ENTERPRISE LINUX 8
26
6 months
Minor updates
3 years
Major releases
2 phases
Support life cycle
APPLICATION STREAMS
RED HAT ENTERPRISE LINUX 8
27
PostgreSQL 9.6 stream
Red Hat®
Enterprise Linux®
8
PostgreSQL 10 stream
PostgreSQL 12 stream
Time of support
Red Hat Enterprise Linux 7
More choice
Offers versions of the open source
tools and frameworks developers need
Newer versions
Provides access to newer versions as
they stabilize
Simpler access
Maintains standard locations for tools
and libraries
SIMPLIFIED ACCESS TO SOFTWARE
RED HAT ENTERPRISE LINUX 8
28
Red Hat Enterprise Linux 7 repositories
server
optionalsupplementaryextras rhscl dotnet devtools
Red Hat Enterprise Linux 8 repositories
baseos
appstream supplementary codeready-builder
GRAPHICAL EXAMPLE OF DIFFERENT WAYS AN
APPLICATION STREAM COULD BE MANAGED
An Example Application Stream
29
May 2019 ...
SoftwareA
9.6 stream
SoftwareA
10 stream
SoftwareB
7.2 stream
SoftwareB
7.3 stream
May 2020 May 2021 May 2022 May 2023 ...
THE NEWEST YUM PACKAGE MANAGER: VERSION 4
30
New technology
Maintains the same experience while adding
new tools
Better dependency management
Offers faster resolution and easier
minimization of what's installed
Stable API
Provides new application programming
interface (API) for extending yum that will
progress into the future
RED HAT ENTERPRISE LINUX 8
Repository
rpm
rpm
rpm
rpm
rpm
rpm
metadata
rpm rpmrpm
system
yum
CONFIDENTIAL Designator
FAQs
31
Frequently Asked Questions
32
No.
Isn’t this just Software Collections?
Frequently Asked Questions
33
No.
In the example on the earlier slide, postgresql 9.6 and 10 were
shown as simultaneously available versions. Can I have them both
installed?
Frequently Asked Questions
34
No.
Can I make application streams unique to my organization?
CONFIDENTIAL Designator
Demo
35
● Managing Software from an Application Stream
Rules of the Road
36
Application stream rules of the
road:
An application stream may offer multiple versions of a package, but only one may be installed on the system
Each application stream will have one version set as the default
Generally, you will want to use the module subcommand of yum when working with an application stream
Recommended practice: when changing to a different version of software in the application stream is to remove the installed version,
then install the preferred version
Instructor Demonstration
37
Listing available application
streams:
# yum module list
Name Stream Profiles Summary
ruby 2.5 [d] common [d] An interpreter of object-oriented scripting language
The resulting output will contain all the available packages managed as application streams.
Instructor Demonstration
38
Installing software from an
application stream:
# yum module install ruby:2.5
...
Preparing :
Installing : ruby-libs-2.5.3-103.module+el8+2671+ebcc7ee0.x86_64
Installing : rubygem-bigdecimal-1.3.4-103.module+el8+2671+ebcc7ee0.x86_64
Installing : rubygem-psych-3.0.2-103.module+el8+2671+ebcc7ee0.x86_64
Installing : rubygem-json-2.1.0-103.module+el8+2671+ebcc7ee0.x86_64
...
The future of
infrastructure
39
REDHATENTERPRISELINUX8
WHAT YOU NEED
40
● Amazon Web Services
● Microsoft Azure
● Google Cloud
● Bare metal
● Virtual
How we deliver it
● You get to enjoy the same Red Hat
Enterprise Linux experience
regardless of the underlying
infrastructure
Why you need it
Open hybrid cloud
and multi-cloud
WHAT YOU NEED
41
● Image builder
● Single variant for multiple use cases
● In-place upgrades
How we deliver it
● Your digital journey requires fast
adoption and deployment
Why you need it
Faster and easier
to deploy
CREATE IMAGES FOR ALL YOUR
ENVIRONMENTS WITH IMAGE BUILDER
42
Single source
Lets you create gold images for any environment
from the same blueprint increasing stability and
consistency
Any footprint
Supports public cloud, private cloud, enterprise
hypervisors, and bare metal
Simple interface
Provides web-based view within the web console
for selecting packages and creating blueprints
Blueprint
Bare metal
Hypervisors
Public clouds
Private clouds
RED HAT ENTERPRISE LINUX 8
43
Faster and more consistent delivery
in any deployment
Maintain standards
Simple common machine
images for any environment
Improve automation
Automation expertise from the
engineers who wrote the platform
Gain rapid intelligence
Information that helps you focus on
business initiatives, not fighting fires
RED HAT ENTERPRISE LINUX 8
IN-PLACE UPGRADES FOR YOUR SYSTEMS
44
Reduced migrations
Analyze systems to determine if upgrading in
place can avoid a costly migration
Easy rollback options
Combine with bootable LVM snapshots for safety
Improved framework
Get better analysis and a simplified process with
a more extensible framework
RED HAT ENTERPRISE LINUX 8
Upgrade framework
Applications
7 8
RUN LEAPP
CREATE BOOTABLE
LVM SNAPSHOT
CAN I UPGRADE THIS HOST?
45
RED HAT ENTERPRISE LINUX 8
PICK
CANDIDATE
SERVER
ANALYZE CHECK
OUTPUT
REBOOT TO FINISH
UPGRADE
UPGRADE
COMPLETE
Flow for actioning on issues & vulnerabilities
46
Analyze Identify Prioritize Resolve
RED HAT ENTERPRISE LINUX 8
DETECT AND FIX ISSUES WITH RED HAT INSIGHTS
47
Proactive advice
Identification of issues before they
become problems
Continuous assessment
Real-world results to help find new risks
Simpler remediations
Tailored results at the host level
RED HAT ENTERPRISE LINUX 8
RED HAT INSIGHTS
Included with your Red Hat Enterprise Linux subscription
Assesses
customer’s Red Hat
environments
Remediates
findings with prescriptive
remediation steps or an
Ansible playbook
Insights
rule contributions directly
from Red Hat subject
matter experts
Identifying risks for availability, performance, stability and security
Quick Value in 15 Minutes or Less
No infrastructure cost
Quick setup
Planned response Tailored resolution
Real-time
risk assessment
Proactive alerts
SaaS
Insights installs in minutes
● Registers to Satellite or Customer Portal
● Automation-enabled
● Simple registration (one command)
● Reporting available instantly
● Client runs at customer defined interval
Security is built in. Insights customers
have control via blacklist and
obfuscation of any metadata collected.
ENTERPRISE INFRASTRUCTURE MONITORING
Value for Customers
PROACTIVE
GUIDANCE
Risks are identified before they ever
impact infrastructure or business
operations
CONTINUOUS
INSIGHTS
New checks added continuously as
new threats to enterprise workloads
are identified
REMEDIATION
PLAN
Issues identified should be
accompanied by tailored
step-by-step instructions for their
remediation
INTEGRATED
MANAGEMENT
Insights integrates with Red Hat’s
management portfolio providing
streamlined operations workflow
capabilities with automation
CONFIDENTIAL Designator
FAQs
51
Frequently Asked Questions
52
No.
Does Insights Collect a ton of GDPR Data?
Frequently Asked Questions
53
Yes
Can some data be excluded from collection?
Frequently Asked Questions
54
Yes.
If I use RHEL from a public cloud provider
can I still access Insights?
CONFIDENTIAL Designator
Demo
55
● Using Web console to build Virtual Images
Power The Adoption Of
Containers
56
REDHATENTERPRISELINUX8
WHAT YOU NEED
57
● New tools
● Red Hat Universal Base Image
How we deliver it
● Building, running, and managing containers
shouldn’t need root privileges or a daemon
● The foundation for building
enterprise-ready containerized
applications is more secure and reliable.
Why you need it
Containers
WHY DO I CARE ABOUT RED HAT’S
CONTAINER TOOLS?
Different people have different needs
58
Developer Architect or Administrator
I need to support the efforts of
developers, but don’t want to have
additional attack surface on my systems*
-or-
I don’t want to provide root access to
non-administrators on my systems*
Independent Software Vendor
I need to build applications that I can
provide to customers*
* Source: Scenario based on conversions with Red Hat customers
I need to make containers that are Open
Container Initiative (OCI) compliant that I
can deploy *
CONTAINERS ARE LINUX
59
Namespaces
CPU Memory Storage Network
Cgroups
Seccomp
SELinux
Run
Build
CONTAINERS
Application dependencies
Application binaries
RED HAT ENTERPRISE LINUX 8
POWERING THE ADOPTION OF
CONTAINERIZED WORKLOADS
60
Red Hat Enterprise Linux
(Podman/Buildah/Skopeo)
TRADITIONAL DEVELOPMENT
Find Run Build Share
CLOUD-NATIVE
Integrate Deploy
Quay
Red Hat OpenShift®
(Kubernetes)
RED HAT ENTERPRISE LINUX 8
Red Hat Container Tools
Meet the container tools
61
Deploy containers
Familiar syntax, compared to other container flavors
Create new container images
Update/modify existing container images
Inspect, audit, and share container images
Why choose podman
62
Why podman?
● Open Container Initiative (OCI) compliant
● Daemonless
● Linux native technology stack
● Rootless deployments
● Compatible with other OCI compliant toolsets
MANAGE CONTAINERS WITH PODMAN
63
Fast and lightweight
No daemons required
Advanced namespace isolation
Rootless operations for container run
and build
Open standards compliant
Creates and maintains any standard
Open Containers Initiative (OCI)
-compliant containers and pods
Podman
RunC
Kernel
Images
RED HAT ENTERPRISE LINUX 8
CREATE IMAGES WITH BUILDAH
64
More control
Scriptable tooling for fine-grained
image control, and maximum control
starting from base or scratch images
Minimization of images
Elimination of unneeded dependencies
by using host-based tools
From base, multilayer From scratch, single layer
RED HAT ENTERPRISE LINUX 8
Java runtime and
dependencies, and
application
OS update layer
Java™ runtime layer
Application layer
Base Red Hat
Enterprise Linux
INSPECT AND TRANSPORT IMAGES WITH SKOPEO
65
Inspect images remotely
Examine image metadata without needing to
download
Publish and transfer images
Copy images from registries to hosts or directly
between registries
Sign and verify images
Supports GPG key signing on publish
Image registry Image registry
Image repositoryMetadata signature
Host
SKOPEO
RED HAT ENTERPRISE LINUX 8
CONFIDENTIAL Designator
FAQs
66
Frequently Asked Questions
67
No. But if you really, really need a command called docker on your
system, try installing the podman-dockerpackage. (This isn’t
actually docker, though)
Does RHEL8 ship Docker?
Frequently Asked Questions
68
Yes! We distribute the Universal Base Image (UBI). This container
image is supported by Red Hat when deployed on a supported
Red Hat platform (RHEL/OpenShift).
Does Red Hat provide any supported container images?
Frequently Asked Questions
69
With the compatibility built into the Red Hat Container tools, you can use a
combination of both. Red Hat has two seats on the Technical Oversight Board of
the Open Container Initiative [a project of the Linux Foundation], which is a
commitment to delivering tools that use open standards. Included as part of Red
Hat Enterprise Linux, no additional subscriptions required.
Why should I use this instead of Docker?
CONFIDENTIAL Designator
Demo
70
● Deploying Containers Using Podman
Instructor Demonstration
71
Inspect available container
images:
# podman images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.access.redhat.com/ubi8/ubi-init latest cda12d4c316c 6 weeks ago 255MB
Instructor Demonstration
72
Deploy a container:
Interactive, with a bash shell
# podman run -it ubi-init /bin/bash
Detached mode, with an exposed port
# podman run -dt -p 8080:80/tcp ubi-init
More options in the podman-run(1) manpage
Instructor Demonstration
73
Viewing deployed containers:
# podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9df2431bf9b0 ...redhat.com/ubi8/ubi-init:latest /sbin/init 36 seconds Up 36 seconds romantic_feynman
Note: each container runtime is assigned a unique ID and NAME to use with other actions.
Instructor Demonstration
74
Terminating detached
containers:
Using stop with either a CONTAINER ID or NAME
# podman stop 9df2431bf9b0
or
# podman stop romantic_feynman
Instructor Demonstration
75
Destroying container image
overlays:
# podman rm 9df2431bf9b0
or
# podman rm romantic_feynman
More options in the podman-rm(1) manpage
Instructor Demonstration
76
Merging container image
overlays:
# podman commit 9df2431bf9b0 New_Container_Name
or
# podman commit romantic_feynman New_Container_Name
More options in the podman-commit(1)manpage
Configuring Terminal Session
Recording
77
REDHATENTERPRISELINUX8
RECORDING USER TERMINAL SESSIONS
78
RED HAT ENTERPRISE LINUX 8
Audit activities
Create a record of actions taken for
review against security policies
Create visual guides
Build run books and training
materials with demonstrations
Record and play back
Logged via standard channels with
multiple playback options
WHERE ARE SOME SITUATIONS WHERE TERMINAL
SESSION RECORDING MIGHT BE USEFUL?
Different people have different needs
79
Architect
How do I know that we are capturing audit information for
users and administrators across our infrastructure?*
-and-
When there is a problem, outage, or issue, it would be great if
we could know what was happening on that system!*
* Source: Scenario based on conversions with Red Hat customers
Administrator
It would be really nice to know what the administrators on my
team are doing!
-and-
I just got a reported problem on a system, I wonder what has
been going on there lately!*
Quick facts for terminal session recording
80
Quick Facts:
● Based on tlog
● Official Red Hat guide available: https://red.ht/2pWcvni
● Other modes of session recording can still be used (auditd, script, sudo, etc.)
● Integrated into the web console
● Multiple players available for playback
Why choose terminal session recording
81
Why terminal session
recording?
● Data integrated into existing system logging
● Ability to disable capture of input (e.g. keylogging)
● Web console player includes searchability of the session transcript and accelerated playback
● Easily configure which users or groups should be recorded
CONFIDENTIAL Designator
FAQs
82
Frequently Asked Questions
83
Configuring session recording with pam_tty_audit
captures the data entered by the audited user on the
command-line. Output and error messages are missing
from this method of collecting session data.
How is this different than capturing session
information with auditd?
Frequently Asked Questions
84
No.
Is this only available through the web
console?
Frequently Asked Questions
85
No.
Can session recording record my Graphical
User Interface (GUI) sessions as well?
CONFIDENTIAL Designator
Demo
86
● Configuring Terminal Session Recording
Instructor Demonstration
87
Install the web console plugin:
# yum install cockpit-session-recording
============================================================================================
Package Arch Version Repository Size
============================================================================================
Installing:
cockpit-session-recording noarch 1-29.el8 AppStream 2.4 M
Installing dependencies:
tlog x86_64 6-1.el8 AppStream 118 k
Instructor Demonstration
88
Restart the web console:
# systemctl restart cockpit
Instructor Demonstration
89
Attach to the web console:
https://localhost:9090
Instructor Demonstration
90
Navigate to session recording:
Instructor Demonstration
91
Apply settings:
Instructor Demonstration
92
Review configuration files:
# less /etc/tlog/tlog-rec-session.conf
# less /etc/sssd/conf.d/sssd-session-recording.conf
Instructor Demonstration
93
View recorded sessions:
Instructor Demonstration
94
Review a single session:
Configuring Red Hat
Enterprise Linux System-wide
Crypto Policy
95
REDHATENTERPRISELINUX8
WHAT YOU NEED
96
● Systemwide encryption policy
● Nftables/firewalld
● Terminal session recording
How we deliver it
● You spend less effort and time
managing and configuring
services for security needs,
without compromising core
security needs
● Activity auditing available
Why you need it
SECURITY
A HIGHLY SECURE PLATFORM
97
Latest protocol support
Including TLS 1.3 via OpenSSL 1.1.1
Hardened code
Including PIE and RELRO binaries and code analysis in
our pipelines
Integrated identity management
As a stand-alone provider or trusted member of an
Active Directory, with expanded integrations to tools
like the web console
Updated tools
Including the LUKS v2 on-disk format for encryption
RED HAT ENTERPRISE LINUX 8
Security
policy, process,
and procedures
DESIGN BUILD
RUN
MANAGE
ADAPT
CONFIGURING SYSTEMWIDE CRYPTOGRAPHIC
POLICIES
98
Central configuration
Set acceptable algorithms from
a single tool
Improved consistency
Covers multiple cryptographic
providers and consumers like
TLS, kerberos, and Java
Built-in policies
Including legacy systems
requiring 64-bit security and
FIPS allowed or approved
algorithms
RED HAT ENTERPRISE LINUX 8
Default
Legacy
Client
Future
Encryption
algorithm OpenSSL
httpd
Secured
communications
IMPROVED FIREWALL MANAGEMENT WITH
NFTABLES
99
Consolidated filtering
Supports IPv4, IPv6, ARP, and Bridge
filtering in a single tool
Simpler rule creation
Multiple matches and actions reduce
the number of rules required
Improved tracing
Provides easier debugging and
verification of actions taken on any
packet
RED HAT ENTERPRISE LINUX 8
HOW DOES IT BENEFIT ME?
Different people have different needs
100
developer
How can I test and adapt my applications
against current state-of-the art and
future cryptographic libraries?*
Architect or Administrator
How can I use a consistent way to enforce
security standards and best practices
across different applications running on
RHEL?*
Independent Software Vendor
How can I ensure that my software stack
is FIPS compliant?*
* Source: Scenario based on conversions with Red Hat customers
THE ISSUE: COMPLEXITY
Each crypto provider used its own configuration
● Difficult, and entirely manual, process to change the defaults
● No consistent means to enforce standard configurations or best practices
● Auditing is more difficult or relies on manual examination of each crypto library
● Configuring a system for FIPS compliance was more error prone
○ Though FIPS does force a standard across all cryptographic providers!
CONSISTENT AND STRONG CRYPTO POLICY
LEGACY
DEFAULT
FIPS 140
FUTURE
4 policies
● Solves the problem of ensuring systemwide consistent cryptography
settings for addressing compliance requirements
● Easy to use and easy to automate - far less error prone
# update-crypto-policies --set <<Crypto Policy>>
# update-crypto-policies --show
● Sets allowed key lengths, hashes, parameters, protocols, and algorithms
● Crypto policies can be found in man pages
# man crypto-policies
SYSTEMWIDE EFFECTS OF CRYPTO POLICY
libkrb5
OpenSSL
GnuTLS
Libreswan
NSS
BIND
OpenJDK
OpenSSH
Python
Applications and groups that follow the crypto policies
Guidance
● Use the Red Hat Enterprise
Linux-provided Crypto libraries and Red
Hat Enterprise Linux-provided utilities
● Test with DEFAULT and FUTURE policies
● Consider using SHA256 hashes
● Libssh, Golang and more coming!
CONFIDENTIAL Designator
FAQs
104
Frequently Asked Questions
105
Not at this time.
Can I define my own crypto policies?
Frequently Asked Questions
106
Sometimes.
Can I use crypto policies to control
particular applications rather than system
wide enforcement?
Frequently Asked Questions
107
No. It only means that the system is using FIPS
140 compliant ciphers, which is not the only thing
necessary for FIPS compliance.
Does setting FIPS 140 crypto policy mean
that my instance is FIPS compliant?
CONFIDENTIAL Designator
Demo
108
● Configuring the system-wide cryptographic policy
Instructor Demonstration
109
Getting the currently set system
wide crypto policy:
# update-crypto-policies --show
DEFAULT
The resulting output will contain the crypto policy that is currently in effect. In this case, it is DEFAULT
Instructor Demonstration
110
Setting system-wide crypto
policies :
# update-crypto-policies --set FUTURE
Setting system policy to FUTURE
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change to policies to fully take place.
Wrap-up & Closing
Remarks
111
REDHATENTERPRISELINUX8
WHAT’S NEW?
112
Easier adoption
for staff new to Linux®
More subscription value
with Red Hat Insights, now included in all
Red Hat Enterprise Linux subscriptions
A consistent experience
across bare-metal, virtual, and public and
hybrid cloud environments
Eased transition
to and adoption of containerized workloads with
community-driven, new container management
tools
Increased speed and ease of deployment
Security first
Further enhanced to cover the latest industry
requirements
Red Hat Enterprise Linux 8
CUSTOMER CHALLENGES
Red Hat portfolio
IT optimization
Transform your
existing IT
infrastructure
Agile integration
Integrate your
applications &
services
Hybrid cloud
infrastructure
Improve & accelerate
IT service delivery
Cloud-native
development
Build innovative
applications faster
Automation
Automate infrastructure
& applications
TRANSFORM YOUR EXISTING IT INFRASTRUCTURE
Red Hat portfolio
Security & services
Applications & business processes
Developer
tools
Automation &
management
Physical hardware & cloud infrastructure
RH0075-02
Middleware & application services
Container platforms
Infrastructure software
IMPROVE & ACCELERATE IT SERVICE
DELIVERY
Red Hat portfolio
Infrastructure software
Security & services
Applications & business processes
Developer
tools
Automation &
management
Physical hardware & cloud infrastructure
RH0075-02
Middleware & application services
Container platforms
BUILD INNOVATIVE APPLICATIONS FASTER
Red Hat portfolio
RH0075-02
Security & services
Applications & business processes
Automation
&
management
Physical hardware & cloud infrastructure
Middleware & application services
Developer
tools
Container platforms
Infrastructure software
RH0075-02
INTEGRATE YOUR APPLICATIONS & SERVICES
Red Hat portfolio
Physical hardware & cloud infrastructure
Container platforms
Infrastructure software
Middleware & application services
Security & services
Applications & business processes
Developer
tools
Automation &
management
RH0075-02
Red Hat portfolio
AUTOMATE INFRASTRUCTURE & APPLICATIONS
Security & services
Applications & business processes
Developer
tools
Physical hardware & cloud infrastructure
Middleware & application services
Container platforms
Infrastructure software
Automation &
management
Security
Applications & business processes
Physical hardware & cloud infrastructure
Infrastructure software
Automation &
management
Middleware & application services
Container platforms
Developer
tools
Services
linkedin.com/company/red-hat
youtube.com/user/RedHatVideos
facebook.com/redhatinc
twitter.com/RedHat
Red Hat is the world’s leading provider of enterprise
open source software solutions. Award-winning
support, training, and consulting services make
Red Hat a trusted adviser to the Fortune 500.
Thank you
120
CONFIDENTIAL Designator
Demos
121
● Managing Software from an Application Stream
● Managing System Updates Using the Web Console
● Red Hat Insights
● Using Web console to build Virtual Images
● Creating Images with Buildah
● Deploying Containers Using Podman
● Configuring Terminal Session Recording
● Configuring the system-wide cryptographic policy
-

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Open shift 4-update
Open shift 4-updateOpen shift 4-update
Open shift 4-update
 
Kubernates vs Openshift: What is the difference and comparison between Opensh...
Kubernates vs Openshift: What is the difference and comparison between Opensh...Kubernates vs Openshift: What is the difference and comparison between Opensh...
Kubernates vs Openshift: What is the difference and comparison between Opensh...
 
Building Kubernetes images at scale with Tanzu Build Service
Building Kubernetes images at scale with Tanzu Build ServiceBuilding Kubernetes images at scale with Tanzu Build Service
Building Kubernetes images at scale with Tanzu Build Service
 
IBM RedHat OCP Vs xKS.pptx
IBM RedHat OCP Vs xKS.pptxIBM RedHat OCP Vs xKS.pptx
IBM RedHat OCP Vs xKS.pptx
 
OpenShift Virtualization- Technical Overview.pdf
OpenShift Virtualization- Technical Overview.pdfOpenShift Virtualization- Technical Overview.pdf
OpenShift Virtualization- Technical Overview.pdf
 
Containers Anywhere with OpenShift by Red Hat
Containers Anywhere with OpenShift by Red HatContainers Anywhere with OpenShift by Red Hat
Containers Anywhere with OpenShift by Red Hat
 
Red Hat Container Strategy
Red Hat Container StrategyRed Hat Container Strategy
Red Hat Container Strategy
 
VMware Vsphere Graduation Project Presentation
VMware Vsphere Graduation Project PresentationVMware Vsphere Graduation Project Presentation
VMware Vsphere Graduation Project Presentation
 
Red Hat OpenShift on Bare Metal and Containerized Storage
Red Hat OpenShift on Bare Metal and Containerized StorageRed Hat OpenShift on Bare Metal and Containerized Storage
Red Hat OpenShift on Bare Metal and Containerized Storage
 
OpenShift-Technical-Overview.pdf
OpenShift-Technical-Overview.pdfOpenShift-Technical-Overview.pdf
OpenShift-Technical-Overview.pdf
 
Introduction to openshift
Introduction to openshiftIntroduction to openshift
Introduction to openshift
 
OpenShift Introduction
OpenShift IntroductionOpenShift Introduction
OpenShift Introduction
 
VMware Tanzu Introduction
VMware Tanzu IntroductionVMware Tanzu Introduction
VMware Tanzu Introduction
 
OpenShift 4, the smarter Kubernetes platform
OpenShift 4, the smarter Kubernetes platformOpenShift 4, the smarter Kubernetes platform
OpenShift 4, the smarter Kubernetes platform
 
VMware Tanzu Introduction- June 11, 2020
VMware Tanzu Introduction- June 11, 2020VMware Tanzu Introduction- June 11, 2020
VMware Tanzu Introduction- June 11, 2020
 
Azure storage deep dive
Azure storage deep diveAzure storage deep dive
Azure storage deep dive
 
Cloud Native Applications on OpenShift
Cloud Native Applications on OpenShiftCloud Native Applications on OpenShift
Cloud Native Applications on OpenShift
 
Kubernetes architecture
Kubernetes architectureKubernetes architecture
Kubernetes architecture
 
Upgrade Kubernetes the boring way
Upgrade Kubernetes the boring wayUpgrade Kubernetes the boring way
Upgrade Kubernetes the boring way
 
vSphere7 with Tanzu
vSphere7 with Tanzu vSphere7 with Tanzu
vSphere7 with Tanzu
 

Similar a Red Hat Enterprise Linux 8 Workshop

Faster Computing has contacted Go2Linux and requested a brief prop
Faster Computing has contacted Go2Linux and requested a brief propFaster Computing has contacted Go2Linux and requested a brief prop
Faster Computing has contacted Go2Linux and requested a brief prop
ChereCheek752
 

Similar a Red Hat Enterprise Linux 8 Workshop (20)

Red Hat Enterprise Linux 8 Technical overview v1(1).pdf
Red Hat Enterprise Linux 8 Technical overview v1(1).pdfRed Hat Enterprise Linux 8 Technical overview v1(1).pdf
Red Hat Enterprise Linux 8 Technical overview v1(1).pdf
 
RHTE 2016 - Get your App Dev on in the Cloud
RHTE 2016 - Get your App Dev on in the CloudRHTE 2016 - Get your App Dev on in the Cloud
RHTE 2016 - Get your App Dev on in the Cloud
 
Painless containerization in your very own private Cloud
Painless containerization in your very own private CloudPainless containerization in your very own private Cloud
Painless containerization in your very own private Cloud
 
Red Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShiftRed Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShift
 
[OpenStack Days Korea 2016] Track1 - Red Hat enterprise Linux OpenStack Platform
[OpenStack Days Korea 2016] Track1 - Red Hat enterprise Linux OpenStack Platform[OpenStack Days Korea 2016] Track1 - Red Hat enterprise Linux OpenStack Platform
[OpenStack Days Korea 2016] Track1 - Red Hat enterprise Linux OpenStack Platform
 
FICO Open Shift presentation
FICO Open Shift presentationFICO Open Shift presentation
FICO Open Shift presentation
 
Building 12 factor apps with ASP.NET Core, Сергій Калинець
Building 12 factor apps with ASP.NET Core, Сергій КалинецьBuilding 12 factor apps with ASP.NET Core, Сергій Калинець
Building 12 factor apps with ASP.NET Core, Сергій Калинець
 
Faster Computing has contacted Go2Linux and requested a brief prop
Faster Computing has contacted Go2Linux and requested a brief propFaster Computing has contacted Go2Linux and requested a brief prop
Faster Computing has contacted Go2Linux and requested a brief prop
 
DevOps on Steroids Featuring Red Hat & Alantiss - Pop-up Loft Tel Aviv
DevOps on Steroids Featuring Red Hat & Alantiss - Pop-up Loft Tel AvivDevOps on Steroids Featuring Red Hat & Alantiss - Pop-up Loft Tel Aviv
DevOps on Steroids Featuring Red Hat & Alantiss - Pop-up Loft Tel Aviv
 
OpenStack Benelux Conference 2014 | Plenair | RedHat
OpenStack Benelux Conference 2014 | Plenair | RedHatOpenStack Benelux Conference 2014 | Plenair | RedHat
OpenStack Benelux Conference 2014 | Plenair | RedHat
 
ansible_rhel_90.pdf
ansible_rhel_90.pdfansible_rhel_90.pdf
ansible_rhel_90.pdf
 
Openstack Benelux Conference 2014 Red Hat Keynote
Openstack Benelux Conference 2014  Red Hat KeynoteOpenstack Benelux Conference 2014  Red Hat Keynote
Openstack Benelux Conference 2014 Red Hat Keynote
 
Open cloud infrastructure built for the enterprise
Open cloud infrastructure built for the enterpriseOpen cloud infrastructure built for the enterprise
Open cloud infrastructure built for the enterprise
 
OSDC 2011 | RedHat Satellite - Einsatzweise und Möglichkeiten by Dirk Hermann
OSDC 2011 | RedHat Satellite - Einsatzweise und Möglichkeiten by Dirk HermannOSDC 2011 | RedHat Satellite - Einsatzweise und Möglichkeiten by Dirk Hermann
OSDC 2011 | RedHat Satellite - Einsatzweise und Möglichkeiten by Dirk Hermann
 
2010-11-08 NSA Technical Symposium
2010-11-08 NSA Technical Symposium2010-11-08 NSA Technical Symposium
2010-11-08 NSA Technical Symposium
 
WMworld Europe 2014: Hybrid Sandboxing – Create the Ultimate On and Off Premi...
WMworld Europe 2014: Hybrid Sandboxing – Create the Ultimate On and Off Premi...WMworld Europe 2014: Hybrid Sandboxing – Create the Ultimate On and Off Premi...
WMworld Europe 2014: Hybrid Sandboxing – Create the Ultimate On and Off Premi...
 
Red Hat OpenShift Enterprise 2 Launch Webcast Slides Dec 3, 2013
Red Hat OpenShift Enterprise 2 Launch Webcast Slides Dec 3, 2013Red Hat OpenShift Enterprise 2 Launch Webcast Slides Dec 3, 2013
Red Hat OpenShift Enterprise 2 Launch Webcast Slides Dec 3, 2013
 
Best Practices for Building Hybrid-Cloud Architectures | Hans Jespersen
Best Practices for Building Hybrid-Cloud Architectures | Hans JespersenBest Practices for Building Hybrid-Cloud Architectures | Hans Jespersen
Best Practices for Building Hybrid-Cloud Architectures | Hans Jespersen
 
Cloud Native Application @ VMUG.IT 20150529
Cloud Native Application @ VMUG.IT 20150529Cloud Native Application @ VMUG.IT 20150529
Cloud Native Application @ VMUG.IT 20150529
 
Red Hat OpenShift Container Platform Overview
Red Hat OpenShift Container Platform OverviewRed Hat OpenShift Container Platform Overview
Red Hat OpenShift Container Platform Overview
 

Último

CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
Health
 
TECUNIQUE: Success Stories: IT Service provider
TECUNIQUE: Success Stories: IT Service providerTECUNIQUE: Success Stories: IT Service provider
TECUNIQUE: Success Stories: IT Service provider
mohitmore19
 

Último (20)

Unlocking the Future of AI Agents with Large Language Models
Unlocking the Future of AI Agents with Large Language ModelsUnlocking the Future of AI Agents with Large Language Models
Unlocking the Future of AI Agents with Large Language Models
 
How to Choose the Right Laravel Development Partner in New York City_compress...
How to Choose the Right Laravel Development Partner in New York City_compress...How to Choose the Right Laravel Development Partner in New York City_compress...
How to Choose the Right Laravel Development Partner in New York City_compress...
 
HR Software Buyers Guide in 2024 - HRSoftware.com
HR Software Buyers Guide in 2024 - HRSoftware.comHR Software Buyers Guide in 2024 - HRSoftware.com
HR Software Buyers Guide in 2024 - HRSoftware.com
 
Tech Tuesday-Harness the Power of Effective Resource Planning with OnePlan’s ...
Tech Tuesday-Harness the Power of Effective Resource Planning with OnePlan’s ...Tech Tuesday-Harness the Power of Effective Resource Planning with OnePlan’s ...
Tech Tuesday-Harness the Power of Effective Resource Planning with OnePlan’s ...
 
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
 
Introducing Microsoft’s new Enterprise Work Management (EWM) Solution
Introducing Microsoft’s new Enterprise Work Management (EWM) SolutionIntroducing Microsoft’s new Enterprise Work Management (EWM) Solution
Introducing Microsoft’s new Enterprise Work Management (EWM) Solution
 
CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICECHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE
 
The Guide to Integrating Generative AI into Unified Continuous Testing Platfo...
The Guide to Integrating Generative AI into Unified Continuous Testing Platfo...The Guide to Integrating Generative AI into Unified Continuous Testing Platfo...
The Guide to Integrating Generative AI into Unified Continuous Testing Platfo...
 
Azure_Native_Qumulo_High_Performance_Compute_Benchmarks.pdf
Azure_Native_Qumulo_High_Performance_Compute_Benchmarks.pdfAzure_Native_Qumulo_High_Performance_Compute_Benchmarks.pdf
Azure_Native_Qumulo_High_Performance_Compute_Benchmarks.pdf
 
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdfLearn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
 
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
 
AI & Machine Learning Presentation Template
AI & Machine Learning Presentation TemplateAI & Machine Learning Presentation Template
AI & Machine Learning Presentation Template
 
How To Use Server-Side Rendering with Nuxt.js
How To Use Server-Side Rendering with Nuxt.jsHow To Use Server-Side Rendering with Nuxt.js
How To Use Server-Side Rendering with Nuxt.js
 
TECUNIQUE: Success Stories: IT Service provider
TECUNIQUE: Success Stories: IT Service providerTECUNIQUE: Success Stories: IT Service provider
TECUNIQUE: Success Stories: IT Service provider
 
A Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docxA Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docx
 
Exploring the Best Video Editing App.pdf
Exploring the Best Video Editing App.pdfExploring the Best Video Editing App.pdf
Exploring the Best Video Editing App.pdf
 
Unveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
Unveiling the Tech Salsa of LAMs with Janus in Real-Time ApplicationsUnveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
Unveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
 
The Ultimate Test Automation Guide_ Best Practices and Tips.pdf
The Ultimate Test Automation Guide_ Best Practices and Tips.pdfThe Ultimate Test Automation Guide_ Best Practices and Tips.pdf
The Ultimate Test Automation Guide_ Best Practices and Tips.pdf
 
Define the academic and professional writing..pdf
Define the academic and professional writing..pdfDefine the academic and professional writing..pdf
Define the academic and professional writing..pdf
 

Red Hat Enterprise Linux 8 Workshop

  • 1. Learn, build, and deploy with Red Hat Enterprise Linux 8: An interactive workshop Ahmed El-Rayess Solutions Architect Red Hat MEA Mohamed Farag Solutions Architect Redington 1
  • 2. Welcome 2 Agenda 09:00 - 09:30 : Onsite Registration 09:30 - 10:00 : Opening & Red Hat Enterprise Linux Overview (30 min) 10:00 - 10:35 : Managing Software from an Application Stream (35 min) 10:35 - 11:10 : The future of infrastructure (35 min) 11:10 - 11:45 : Break (35 min) 11:45 - 12:20 : Deploying Containers Using Podman (35 min) 12:20 - 12:55 : Configuring Terminal Session Recording (35 min) 12:55 - 13:30 : Configuring RHEL System-Wide Crypto Policy (35 min) 13:30 - 14:00 : Wrap-Up and Closing Remarks (30 min) 14:00 : Lunch
  • 3. EVENT PRESENTERS 3 Name: Ahmed El-Rayess Role/team: MEA Solutions Architect Where you’re from: Egypt Introductions Name: Mohamed Farag Role/team: Redington Where you’re from: Egypt
  • 4. 4 LINUX IS THE FUTURE Only two operating systems remain. Source: Worldwide Server Operating Environments Market Shares, 2015: Linux Continues to Shape the Future (IDC #US41360517, December 2016)
  • 5. 5 RED HAT LEADS PAID LINUX MARKET WORLDWIDE LINUX SERVER OPERATING ENVIRONMENT NEW LICENSE PAID SHIPMENTS/SUBSCRIPTIONS AND NON-PAID DEPLOYMENTS BY VENDOR, 2012–2016 (000) Source: Worldwide Server Operating Environments Market Shares, 2015: Linux Continues to Shape the Future (IDC #US41360517, December 2016)
  • 6. Tried. Tested. Trusted. Company overview RED HAT ENTERPRISE LINUX
  • 7. FROM COMMUNITIES TO ENTERPRISE Open source
  • 8. Enterprise workloads require trusted platform and partners 8 REDHATENTERPRISELINUX8
  • 9. CONFIDENTIAL Designator 9 RED HAT ENTERPRISE LINUX 8 To deliver business advantages today, organizations are shifting IT from traditional infrastructure operations and are focusing on service delivery.
  • 10. CONFIDENTIAL Designator 10 RED HAT ENTERPRISE LINUX 8 Build your future on a stable, high-performing platform that can scale to meet the needs of your organization today and tomorrow.
  • 11. WHAT’S NEW? 11 Easier adoption for staff new to Linux® More subscription value with Red Hat Insights, now included in all Red Hat Enterprise Linux subscriptions A consistent experience across bare-metal, virtual, and public and hybrid cloud environments Eased transition to and adoption of containerized workloads with community-driven, new container management tools Increased speed and ease of deployment Security first Further enhanced to cover the latest industry requirements Red Hat Enterprise Linux 8
  • 12. 12 RED HAT ENTERPRISE LINUX 8 Trusted partner Focus on your business We focus on support and engineering so you don’t have to Speed integration with common platforms Ease management and integration of your business applications Innovate faster Get to your next big thing without building ours
  • 13. OPTIMIZED EXPERIENCES FOR MISSION-CRITICAL DATABASES 13 ● Red Hat Enterprise Linux is the reference platform for SQL Server on Linux ● Benchmark-breaking performance ● Fast deployment and portability via containers ● Red Hat Enterprise Linux is 1 of only 2 certified Linux distributions ● More than 20 years of Red Hat and SAP joint engineering collaboration ● Exceptional performance and scalability —the largest SAP install in the world runs on Red Hat Enterprise Linux RED HAT ENTERPRISE LINUX 8
  • 14. HARDWARE PARTNER ECOSYSTEM 14 OEMSSILICON IHVS RED HAT ENTERPRISE LINUX 8
  • 15. RED HAT CERTIFIED CLOUD AND SERVICE PROVIDERS 15 RED HAT ENTERPRISE LINUX 8
  • 16. Improved service delivery brings Linux to more new users 16 REDHATENTERPRISELINUX8
  • 17. WHAT YOU NEED 17 ● Web console ● System roles How we deliver it ● Everyone, not just those comfortable with the command line, can participate in the process. Why you need it DevOps
  • 18. REMOTE SINGLE-SYSTEM VIEWS IN THE WEB CONSOLE 18 Browser-based interface Offers remotely accessible user interface using host security mechanisms Consolidated view Provides single view of tasks to speed understanding and completion Standard management tools Uses system tools to change state, not a separate workflow RED HAT ENTERPRISE LINUX 8
  • 19. NEW IN THE WEB CONSOLE 19 RED HAT ENTERPRISE LINUX 8 Virtual machines Create and manage virtual machines Network-bound disk encryption Enroll disks with Tang server and manage LUKS keys Single sign-on configuration Automatically configure when joining a domain
  • 20. SPEED AUTOMATION CREATION WITH SYSTEM ROLES 20 Common automation Manage multiple versions of Red Hat Enterprise Linux from a single role Reduced rework Import provided roles to eliminate task creation in playbooks Easy switching of providers Change between default and optional tools quickly and safely timesync RED HAT ENTERPRISE LINUX 8 dbserver SELinux network webserver
  • 21. CONFIDENTIAL Designator Demo 21 ● Managing System Updates Using the Web Console
  • 22. 22 REDHATENTERPRISELINUX8 Developers need access to the latest tools. Operations needs to know those are stable and supported.
  • 23. WHAT YOU NEED 23 ● Application stream ● Predictable release cadence How we deliver it ● You can’t wait for a new major release in order to access new userspace packages such as languages and frameworks Why you need it Open source integration
  • 24. YOU CAN’T SATISFY ALL THE PEOPLE ALL THE TIME … OR CAN YOU? Different people have different needs 24 Developer I need a newer package than what is included in the distribution!* -or- This software was built 2 years ago, I need the 2 years ago package, not the package thing!* Architect or Administrator I need to support the efforts of developers, nay, plan for it!* -and- I need to manage the longevity of my application, platform, or product!* Independent Software Vendor I went through this certification program for my software I can’t do that for every dot release, but need to be confident that I can continue to support customers on this version!* * Source: Scenario based on conversions with Red Hat customers
  • 25. RED HAT ENTERPRISE LINUX 8 25 Faster time to “Hello World” Simpler deployment options Use standardized platforms for any environments Ability to plan with confidence Remove uncertainty from your platforms Latest stable tools Combine open source innovation with enterprise reliability
  • 26. PREDICTABLE UPDATES RED HAT ENTERPRISE LINUX 8 26 6 months Minor updates 3 years Major releases 2 phases Support life cycle
  • 27. APPLICATION STREAMS RED HAT ENTERPRISE LINUX 8 27 PostgreSQL 9.6 stream Red Hat® Enterprise Linux® 8 PostgreSQL 10 stream PostgreSQL 12 stream Time of support Red Hat Enterprise Linux 7 More choice Offers versions of the open source tools and frameworks developers need Newer versions Provides access to newer versions as they stabilize Simpler access Maintains standard locations for tools and libraries
  • 28. SIMPLIFIED ACCESS TO SOFTWARE RED HAT ENTERPRISE LINUX 8 28 Red Hat Enterprise Linux 7 repositories server optionalsupplementaryextras rhscl dotnet devtools Red Hat Enterprise Linux 8 repositories baseos appstream supplementary codeready-builder
  • 29. GRAPHICAL EXAMPLE OF DIFFERENT WAYS AN APPLICATION STREAM COULD BE MANAGED An Example Application Stream 29 May 2019 ... SoftwareA 9.6 stream SoftwareA 10 stream SoftwareB 7.2 stream SoftwareB 7.3 stream May 2020 May 2021 May 2022 May 2023 ...
  • 30. THE NEWEST YUM PACKAGE MANAGER: VERSION 4 30 New technology Maintains the same experience while adding new tools Better dependency management Offers faster resolution and easier minimization of what's installed Stable API Provides new application programming interface (API) for extending yum that will progress into the future RED HAT ENTERPRISE LINUX 8 Repository rpm rpm rpm rpm rpm rpm metadata rpm rpmrpm system yum
  • 32. Frequently Asked Questions 32 No. Isn’t this just Software Collections?
  • 33. Frequently Asked Questions 33 No. In the example on the earlier slide, postgresql 9.6 and 10 were shown as simultaneously available versions. Can I have them both installed?
  • 34. Frequently Asked Questions 34 No. Can I make application streams unique to my organization?
  • 35. CONFIDENTIAL Designator Demo 35 ● Managing Software from an Application Stream
  • 36. Rules of the Road 36 Application stream rules of the road: An application stream may offer multiple versions of a package, but only one may be installed on the system Each application stream will have one version set as the default Generally, you will want to use the module subcommand of yum when working with an application stream Recommended practice: when changing to a different version of software in the application stream is to remove the installed version, then install the preferred version
  • 37. Instructor Demonstration 37 Listing available application streams: # yum module list Name Stream Profiles Summary ruby 2.5 [d] common [d] An interpreter of object-oriented scripting language The resulting output will contain all the available packages managed as application streams.
  • 38. Instructor Demonstration 38 Installing software from an application stream: # yum module install ruby:2.5 ... Preparing : Installing : ruby-libs-2.5.3-103.module+el8+2671+ebcc7ee0.x86_64 Installing : rubygem-bigdecimal-1.3.4-103.module+el8+2671+ebcc7ee0.x86_64 Installing : rubygem-psych-3.0.2-103.module+el8+2671+ebcc7ee0.x86_64 Installing : rubygem-json-2.1.0-103.module+el8+2671+ebcc7ee0.x86_64 ...
  • 40. WHAT YOU NEED 40 ● Amazon Web Services ● Microsoft Azure ● Google Cloud ● Bare metal ● Virtual How we deliver it ● You get to enjoy the same Red Hat Enterprise Linux experience regardless of the underlying infrastructure Why you need it Open hybrid cloud and multi-cloud
  • 41. WHAT YOU NEED 41 ● Image builder ● Single variant for multiple use cases ● In-place upgrades How we deliver it ● Your digital journey requires fast adoption and deployment Why you need it Faster and easier to deploy
  • 42. CREATE IMAGES FOR ALL YOUR ENVIRONMENTS WITH IMAGE BUILDER 42 Single source Lets you create gold images for any environment from the same blueprint increasing stability and consistency Any footprint Supports public cloud, private cloud, enterprise hypervisors, and bare metal Simple interface Provides web-based view within the web console for selecting packages and creating blueprints Blueprint Bare metal Hypervisors Public clouds Private clouds RED HAT ENTERPRISE LINUX 8
  • 43. 43 Faster and more consistent delivery in any deployment Maintain standards Simple common machine images for any environment Improve automation Automation expertise from the engineers who wrote the platform Gain rapid intelligence Information that helps you focus on business initiatives, not fighting fires RED HAT ENTERPRISE LINUX 8
  • 44. IN-PLACE UPGRADES FOR YOUR SYSTEMS 44 Reduced migrations Analyze systems to determine if upgrading in place can avoid a costly migration Easy rollback options Combine with bootable LVM snapshots for safety Improved framework Get better analysis and a simplified process with a more extensible framework RED HAT ENTERPRISE LINUX 8 Upgrade framework Applications 7 8
  • 45. RUN LEAPP CREATE BOOTABLE LVM SNAPSHOT CAN I UPGRADE THIS HOST? 45 RED HAT ENTERPRISE LINUX 8 PICK CANDIDATE SERVER ANALYZE CHECK OUTPUT REBOOT TO FINISH UPGRADE UPGRADE COMPLETE
  • 46. Flow for actioning on issues & vulnerabilities 46 Analyze Identify Prioritize Resolve RED HAT ENTERPRISE LINUX 8
  • 47. DETECT AND FIX ISSUES WITH RED HAT INSIGHTS 47 Proactive advice Identification of issues before they become problems Continuous assessment Real-world results to help find new risks Simpler remediations Tailored results at the host level RED HAT ENTERPRISE LINUX 8
  • 48. RED HAT INSIGHTS Included with your Red Hat Enterprise Linux subscription Assesses customer’s Red Hat environments Remediates findings with prescriptive remediation steps or an Ansible playbook Insights rule contributions directly from Red Hat subject matter experts Identifying risks for availability, performance, stability and security
  • 49. Quick Value in 15 Minutes or Less No infrastructure cost Quick setup Planned response Tailored resolution Real-time risk assessment Proactive alerts SaaS Insights installs in minutes ● Registers to Satellite or Customer Portal ● Automation-enabled ● Simple registration (one command) ● Reporting available instantly ● Client runs at customer defined interval Security is built in. Insights customers have control via blacklist and obfuscation of any metadata collected.
  • 50. ENTERPRISE INFRASTRUCTURE MONITORING Value for Customers PROACTIVE GUIDANCE Risks are identified before they ever impact infrastructure or business operations CONTINUOUS INSIGHTS New checks added continuously as new threats to enterprise workloads are identified REMEDIATION PLAN Issues identified should be accompanied by tailored step-by-step instructions for their remediation INTEGRATED MANAGEMENT Insights integrates with Red Hat’s management portfolio providing streamlined operations workflow capabilities with automation
  • 52. Frequently Asked Questions 52 No. Does Insights Collect a ton of GDPR Data?
  • 53. Frequently Asked Questions 53 Yes Can some data be excluded from collection?
  • 54. Frequently Asked Questions 54 Yes. If I use RHEL from a public cloud provider can I still access Insights?
  • 55. CONFIDENTIAL Designator Demo 55 ● Using Web console to build Virtual Images
  • 56. Power The Adoption Of Containers 56 REDHATENTERPRISELINUX8
  • 57. WHAT YOU NEED 57 ● New tools ● Red Hat Universal Base Image How we deliver it ● Building, running, and managing containers shouldn’t need root privileges or a daemon ● The foundation for building enterprise-ready containerized applications is more secure and reliable. Why you need it Containers
  • 58. WHY DO I CARE ABOUT RED HAT’S CONTAINER TOOLS? Different people have different needs 58 Developer Architect or Administrator I need to support the efforts of developers, but don’t want to have additional attack surface on my systems* -or- I don’t want to provide root access to non-administrators on my systems* Independent Software Vendor I need to build applications that I can provide to customers* * Source: Scenario based on conversions with Red Hat customers I need to make containers that are Open Container Initiative (OCI) compliant that I can deploy *
  • 59. CONTAINERS ARE LINUX 59 Namespaces CPU Memory Storage Network Cgroups Seccomp SELinux Run Build CONTAINERS Application dependencies Application binaries RED HAT ENTERPRISE LINUX 8
  • 60. POWERING THE ADOPTION OF CONTAINERIZED WORKLOADS 60 Red Hat Enterprise Linux (Podman/Buildah/Skopeo) TRADITIONAL DEVELOPMENT Find Run Build Share CLOUD-NATIVE Integrate Deploy Quay Red Hat OpenShift® (Kubernetes) RED HAT ENTERPRISE LINUX 8
  • 61. Red Hat Container Tools Meet the container tools 61 Deploy containers Familiar syntax, compared to other container flavors Create new container images Update/modify existing container images Inspect, audit, and share container images
  • 62. Why choose podman 62 Why podman? ● Open Container Initiative (OCI) compliant ● Daemonless ● Linux native technology stack ● Rootless deployments ● Compatible with other OCI compliant toolsets
  • 63. MANAGE CONTAINERS WITH PODMAN 63 Fast and lightweight No daemons required Advanced namespace isolation Rootless operations for container run and build Open standards compliant Creates and maintains any standard Open Containers Initiative (OCI) -compliant containers and pods Podman RunC Kernel Images RED HAT ENTERPRISE LINUX 8
  • 64. CREATE IMAGES WITH BUILDAH 64 More control Scriptable tooling for fine-grained image control, and maximum control starting from base or scratch images Minimization of images Elimination of unneeded dependencies by using host-based tools From base, multilayer From scratch, single layer RED HAT ENTERPRISE LINUX 8 Java runtime and dependencies, and application OS update layer Java™ runtime layer Application layer Base Red Hat Enterprise Linux
  • 65. INSPECT AND TRANSPORT IMAGES WITH SKOPEO 65 Inspect images remotely Examine image metadata without needing to download Publish and transfer images Copy images from registries to hosts or directly between registries Sign and verify images Supports GPG key signing on publish Image registry Image registry Image repositoryMetadata signature Host SKOPEO RED HAT ENTERPRISE LINUX 8
  • 67. Frequently Asked Questions 67 No. But if you really, really need a command called docker on your system, try installing the podman-dockerpackage. (This isn’t actually docker, though) Does RHEL8 ship Docker?
  • 68. Frequently Asked Questions 68 Yes! We distribute the Universal Base Image (UBI). This container image is supported by Red Hat when deployed on a supported Red Hat platform (RHEL/OpenShift). Does Red Hat provide any supported container images?
  • 69. Frequently Asked Questions 69 With the compatibility built into the Red Hat Container tools, you can use a combination of both. Red Hat has two seats on the Technical Oversight Board of the Open Container Initiative [a project of the Linux Foundation], which is a commitment to delivering tools that use open standards. Included as part of Red Hat Enterprise Linux, no additional subscriptions required. Why should I use this instead of Docker?
  • 71. Instructor Demonstration 71 Inspect available container images: # podman images REPOSITORY TAG IMAGE ID CREATED SIZE registry.access.redhat.com/ubi8/ubi-init latest cda12d4c316c 6 weeks ago 255MB
  • 72. Instructor Demonstration 72 Deploy a container: Interactive, with a bash shell # podman run -it ubi-init /bin/bash Detached mode, with an exposed port # podman run -dt -p 8080:80/tcp ubi-init More options in the podman-run(1) manpage
  • 73. Instructor Demonstration 73 Viewing deployed containers: # podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 9df2431bf9b0 ...redhat.com/ubi8/ubi-init:latest /sbin/init 36 seconds Up 36 seconds romantic_feynman Note: each container runtime is assigned a unique ID and NAME to use with other actions.
  • 74. Instructor Demonstration 74 Terminating detached containers: Using stop with either a CONTAINER ID or NAME # podman stop 9df2431bf9b0 or # podman stop romantic_feynman
  • 75. Instructor Demonstration 75 Destroying container image overlays: # podman rm 9df2431bf9b0 or # podman rm romantic_feynman More options in the podman-rm(1) manpage
  • 76. Instructor Demonstration 76 Merging container image overlays: # podman commit 9df2431bf9b0 New_Container_Name or # podman commit romantic_feynman New_Container_Name More options in the podman-commit(1)manpage
  • 78. RECORDING USER TERMINAL SESSIONS 78 RED HAT ENTERPRISE LINUX 8 Audit activities Create a record of actions taken for review against security policies Create visual guides Build run books and training materials with demonstrations Record and play back Logged via standard channels with multiple playback options
  • 79. WHERE ARE SOME SITUATIONS WHERE TERMINAL SESSION RECORDING MIGHT BE USEFUL? Different people have different needs 79 Architect How do I know that we are capturing audit information for users and administrators across our infrastructure?* -and- When there is a problem, outage, or issue, it would be great if we could know what was happening on that system!* * Source: Scenario based on conversions with Red Hat customers Administrator It would be really nice to know what the administrators on my team are doing! -and- I just got a reported problem on a system, I wonder what has been going on there lately!*
  • 80. Quick facts for terminal session recording 80 Quick Facts: ● Based on tlog ● Official Red Hat guide available: https://red.ht/2pWcvni ● Other modes of session recording can still be used (auditd, script, sudo, etc.) ● Integrated into the web console ● Multiple players available for playback
  • 81. Why choose terminal session recording 81 Why terminal session recording? ● Data integrated into existing system logging ● Ability to disable capture of input (e.g. keylogging) ● Web console player includes searchability of the session transcript and accelerated playback ● Easily configure which users or groups should be recorded
  • 83. Frequently Asked Questions 83 Configuring session recording with pam_tty_audit captures the data entered by the audited user on the command-line. Output and error messages are missing from this method of collecting session data. How is this different than capturing session information with auditd?
  • 84. Frequently Asked Questions 84 No. Is this only available through the web console?
  • 85. Frequently Asked Questions 85 No. Can session recording record my Graphical User Interface (GUI) sessions as well?
  • 87. Instructor Demonstration 87 Install the web console plugin: # yum install cockpit-session-recording ============================================================================================ Package Arch Version Repository Size ============================================================================================ Installing: cockpit-session-recording noarch 1-29.el8 AppStream 2.4 M Installing dependencies: tlog x86_64 6-1.el8 AppStream 118 k
  • 88. Instructor Demonstration 88 Restart the web console: # systemctl restart cockpit
  • 89. Instructor Demonstration 89 Attach to the web console: https://localhost:9090
  • 92. Instructor Demonstration 92 Review configuration files: # less /etc/tlog/tlog-rec-session.conf # less /etc/sssd/conf.d/sssd-session-recording.conf
  • 95. Configuring Red Hat Enterprise Linux System-wide Crypto Policy 95 REDHATENTERPRISELINUX8
  • 96. WHAT YOU NEED 96 ● Systemwide encryption policy ● Nftables/firewalld ● Terminal session recording How we deliver it ● You spend less effort and time managing and configuring services for security needs, without compromising core security needs ● Activity auditing available Why you need it SECURITY
  • 97. A HIGHLY SECURE PLATFORM 97 Latest protocol support Including TLS 1.3 via OpenSSL 1.1.1 Hardened code Including PIE and RELRO binaries and code analysis in our pipelines Integrated identity management As a stand-alone provider or trusted member of an Active Directory, with expanded integrations to tools like the web console Updated tools Including the LUKS v2 on-disk format for encryption RED HAT ENTERPRISE LINUX 8 Security policy, process, and procedures DESIGN BUILD RUN MANAGE ADAPT
  • 98. CONFIGURING SYSTEMWIDE CRYPTOGRAPHIC POLICIES 98 Central configuration Set acceptable algorithms from a single tool Improved consistency Covers multiple cryptographic providers and consumers like TLS, kerberos, and Java Built-in policies Including legacy systems requiring 64-bit security and FIPS allowed or approved algorithms RED HAT ENTERPRISE LINUX 8 Default Legacy Client Future Encryption algorithm OpenSSL httpd Secured communications
  • 99. IMPROVED FIREWALL MANAGEMENT WITH NFTABLES 99 Consolidated filtering Supports IPv4, IPv6, ARP, and Bridge filtering in a single tool Simpler rule creation Multiple matches and actions reduce the number of rules required Improved tracing Provides easier debugging and verification of actions taken on any packet RED HAT ENTERPRISE LINUX 8
  • 100. HOW DOES IT BENEFIT ME? Different people have different needs 100 developer How can I test and adapt my applications against current state-of-the art and future cryptographic libraries?* Architect or Administrator How can I use a consistent way to enforce security standards and best practices across different applications running on RHEL?* Independent Software Vendor How can I ensure that my software stack is FIPS compliant?* * Source: Scenario based on conversions with Red Hat customers
  • 101. THE ISSUE: COMPLEXITY Each crypto provider used its own configuration ● Difficult, and entirely manual, process to change the defaults ● No consistent means to enforce standard configurations or best practices ● Auditing is more difficult or relies on manual examination of each crypto library ● Configuring a system for FIPS compliance was more error prone ○ Though FIPS does force a standard across all cryptographic providers!
  • 102. CONSISTENT AND STRONG CRYPTO POLICY LEGACY DEFAULT FIPS 140 FUTURE 4 policies ● Solves the problem of ensuring systemwide consistent cryptography settings for addressing compliance requirements ● Easy to use and easy to automate - far less error prone # update-crypto-policies --set <<Crypto Policy>> # update-crypto-policies --show ● Sets allowed key lengths, hashes, parameters, protocols, and algorithms ● Crypto policies can be found in man pages # man crypto-policies
  • 103. SYSTEMWIDE EFFECTS OF CRYPTO POLICY libkrb5 OpenSSL GnuTLS Libreswan NSS BIND OpenJDK OpenSSH Python Applications and groups that follow the crypto policies Guidance ● Use the Red Hat Enterprise Linux-provided Crypto libraries and Red Hat Enterprise Linux-provided utilities ● Test with DEFAULT and FUTURE policies ● Consider using SHA256 hashes ● Libssh, Golang and more coming!
  • 105. Frequently Asked Questions 105 Not at this time. Can I define my own crypto policies?
  • 106. Frequently Asked Questions 106 Sometimes. Can I use crypto policies to control particular applications rather than system wide enforcement?
  • 107. Frequently Asked Questions 107 No. It only means that the system is using FIPS 140 compliant ciphers, which is not the only thing necessary for FIPS compliance. Does setting FIPS 140 crypto policy mean that my instance is FIPS compliant?
  • 108. CONFIDENTIAL Designator Demo 108 ● Configuring the system-wide cryptographic policy
  • 109. Instructor Demonstration 109 Getting the currently set system wide crypto policy: # update-crypto-policies --show DEFAULT The resulting output will contain the crypto policy that is currently in effect. In this case, it is DEFAULT
  • 110. Instructor Demonstration 110 Setting system-wide crypto policies : # update-crypto-policies --set FUTURE Setting system policy to FUTURE Note: System-wide crypto policies are applied on application start-up. It is recommended to restart the system for the change to policies to fully take place.
  • 112. WHAT’S NEW? 112 Easier adoption for staff new to Linux® More subscription value with Red Hat Insights, now included in all Red Hat Enterprise Linux subscriptions A consistent experience across bare-metal, virtual, and public and hybrid cloud environments Eased transition to and adoption of containerized workloads with community-driven, new container management tools Increased speed and ease of deployment Security first Further enhanced to cover the latest industry requirements Red Hat Enterprise Linux 8
  • 113. CUSTOMER CHALLENGES Red Hat portfolio IT optimization Transform your existing IT infrastructure Agile integration Integrate your applications & services Hybrid cloud infrastructure Improve & accelerate IT service delivery Cloud-native development Build innovative applications faster Automation Automate infrastructure & applications
  • 114. TRANSFORM YOUR EXISTING IT INFRASTRUCTURE Red Hat portfolio Security & services Applications & business processes Developer tools Automation & management Physical hardware & cloud infrastructure RH0075-02 Middleware & application services Container platforms Infrastructure software
  • 115. IMPROVE & ACCELERATE IT SERVICE DELIVERY Red Hat portfolio Infrastructure software Security & services Applications & business processes Developer tools Automation & management Physical hardware & cloud infrastructure RH0075-02 Middleware & application services Container platforms
  • 116. BUILD INNOVATIVE APPLICATIONS FASTER Red Hat portfolio RH0075-02 Security & services Applications & business processes Automation & management Physical hardware & cloud infrastructure Middleware & application services Developer tools Container platforms Infrastructure software RH0075-02
  • 117. INTEGRATE YOUR APPLICATIONS & SERVICES Red Hat portfolio Physical hardware & cloud infrastructure Container platforms Infrastructure software Middleware & application services Security & services Applications & business processes Developer tools Automation & management RH0075-02
  • 118. Red Hat portfolio AUTOMATE INFRASTRUCTURE & APPLICATIONS Security & services Applications & business processes Developer tools Physical hardware & cloud infrastructure Middleware & application services Container platforms Infrastructure software Automation & management
  • 119. Security Applications & business processes Physical hardware & cloud infrastructure Infrastructure software Automation & management Middleware & application services Container platforms Developer tools Services
  • 120. linkedin.com/company/red-hat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHat Red Hat is the world’s leading provider of enterprise open source software solutions. Award-winning support, training, and consulting services make Red Hat a trusted adviser to the Fortune 500. Thank you 120
  • 121. CONFIDENTIAL Designator Demos 121 ● Managing Software from an Application Stream ● Managing System Updates Using the Web Console ● Red Hat Insights ● Using Web console to build Virtual Images ● Creating Images with Buildah ● Deploying Containers Using Podman ● Configuring Terminal Session Recording ● Configuring the system-wide cryptographic policy -