Chapter 7. Infrastructure services 7.1. Time synchronization Accurate timekeeping is important for a number of reasons. In Linux systems, the Network Time Protocol (NTP) protocol is implemented by a daemon running in user space. 7.1.1. Implementation of NTP RHEL 7 supported two implementations of the NTP protocol: ntp and chrony . In RHEL 8, the NTP protocol is implemented only by the chronyd daemon, provided by the chrony package. The ntp daemon is no longer available. If you used ntp on your RHEL 7 system, you might need to migrate to chrony . Possible replacements for ntp features that are not supported by chrony are documented in Achieving some settings previously supported by ntp in chrony . 7.1.2. Introduction to chrony suite chrony is an implementation of NTP , which performs well in a wide range of conditions, including intermittent network connections, heavily congested networks, changing temperatures (ordinary computer clocks are sensitive to temperature), and systems that do not run continuously, or run on a virtual machine. You can use chrony : To synchronize the system clock with NTP servers To synchronize the system clock with a reference clock, for example a GPS receiver To synchronize the system clock with a manual time input As an NTPv4(RFC 5905) server or peer to provide a time service to other computers in the network For more information about chrony , see Configuring basic system settings . 7.1.2.1. Differences between chrony and ntp See the following resources for information about differences between chrony and ntp : Differences Between ntpd and chronyd Comparison of NTP implementations 7.1.2.1.1. Chrony applies leap second correction by default In RHEL 8, the default chrony configuration file, /etc/chrony.conf , includes the leapsectz directive. The leapsectz directive enables chronyd to: Get information about leap seconds from the system tz database ( tzdata ) Set the TAI-UTC offset of the system clock in order that the system provides an accurate International Atomic Time (TAI) clock (CLOCK_TAI) The directive is not compatible with servers that hide leap seconds from their clients using a leap smear , such as chronyd servers configured with the leapsecmode and smoothtime directives. If a client chronyd is configured to synchronize to such servers, remove leapsectz from the configuration file. 7.1.3. Additional information For more information about how to configure NTP using the chrony suite, see Configuring time synchronization . 7.2. BIND - Implementation of DNS RHEL 8 includes BIND (Berkeley Internet Name Domain) in version 9.11. This version of the DNS server introduces multiple new features and feature changes compared to version 9.10. New features: A new method of provisioning secondary servers called Catalog Zones has been added. Domain Name System Cookies are now sent by the named service and the dig utility. The Response Rate Limiting feature can now help with mitigation of DNS amplification attacks. Performance of response-policy zone (RPZ) has been improved. A new zone file format called map has been added. Zone data stored in this format can be mapped directly into memory, which enables zones to load significantly faster. A new tool called delv (domain entity lookup and validation) has been added, with dig-like semantics for looking up DNS data and performing internal DNS Security Extensions (DNSSEC) validation. A new mdig command is now available. This command is a version of the dig command that sends multiple pipelined queries and then waits for responses, instead of sending one query and waiting for the response before sending the query. A new prefetch option, which improves the recursive resolver performance, has been added. A new in-view zone option, which allows zone data to be shared between views, has been added. When this option is used, multiple views can serve the same zones authoritatively without storing multiple copies in memory. A new max-zone-ttl option, which enforces maximum TTLs for zones, has been added. When a zone containing a higher TTL is loaded, the load fails. Dynamic DNS (DDNS) updates with higher TTLs are accepted but the TTL is truncated. New quotas have been added to limit queries that are sent by recursive resolvers to authoritative servers experiencing denial-of-service attacks. The nslookup utility now looks up both IPv6 and IPv4 addresses by default. The named service now checks whether other name server processes are running before starting up. When loading a signed zone, named now checks whether a Resource Record Signature's (RSIG) inception time is in the future, and if so, it regenerates the RRSIG immediately. Zone transfers now use smaller message sizes to improve message compression, which reduces network usage. Feature changes: The version 3 XML schema for the statistics channel, including new statistics and a flattened XML tree for faster parsing, is provided by the HTTP interface. The legacy version 2 XML schema is no longer supported. The named service now listens on both IPv6 and IPv4 interfaces by default. The named service no longer supports GeoIP databases. Access control lists (ACLs) defined by presumed location of query sender are unavailable. Since RHEL 8.2, the named service supports GeoIP2, which is provided in the libmaxminddb data format. 7.3. DNS resolution In RHEL 7, the nslookup and host utilities were able to accept any reply without the recursion available flag from any name server listed. In RHEL 8, nslookup and host ignore replies from name servers with recursion not available unless it is the name server that is last configured. In case of the last configured name server, answer is accepted even without the recursion available flag. However, if the last configured name server is not responding or unreachable, name resolution fails. To prevent such fail, you can use one of the following approaches: Ensure that configured name servers always reply with the recursion available flag set. Allow recursion for all internal clients. Optionally, you can also use the dig utility to detect whether recursion is available or not. 7.4. Postfix By default in RHEL 8, Postfix uses MD5 fingerprints with the TLS for backward compatibility. But in FIPS mode, the MD5 hashing function is not available, which may cause TLS to incorrectly function in the default Postfix configuration. As a workaround, the hashing function needs to be changed to SHA-256 in the postfix configuration file. For more details, see the related link: https://access.redhat.com/articles/5824391 7.5. Printing 7.5.1. Print settings tools The Print Settings configuration tool, which was used in RHEL 7, is no longer available. To achieve various tasks related to printing, you can choose one of the following tools: CUPS web user interface (UI) GNOME Control center For more information about print setting tools in RHEL 8, see Configuring printing . 7.5.2. Location of CUPs logs CUPS provides three kinds of logs: Error log Access log Page log In RHEL 8, the logs are no longer stored in specific files within the /var/log/cups directory, which was used in RHEL 7. Instead, all three types are logged centrally in systemd-journald together with logs from other programs. For more information about how to use CUPS logs in RHEL 8, see Accessing the CUPS logs in the systemd journal . 7.5.3. Additional information For more information about how to configure printing in RHEL 8, see Configuring printing . 7.6. Performance and power management options 7.6.1. Notable changes in the recommended TuneD profile In RHEL 8, the recommended TuneD profile, reported by the tuned-adm recommend command, is selected based on the following rules: If the syspurpose role (reported by the syspurpose show command) contains atomic , and at the same time: if TuneD is running on bare metal, the atomic-host profile is selected if TuneD is running in a virtual machine, the atomic-guest profile is selected If TuneD is running in a virtual machine, the virtual-guest profile is selected If the syspurpose role contains desktop or workstation and the chassis type (reported by dmidecode ) is Notebook , Laptop , or Portable , then the balanced profile is selected If none of the above rules matches, the throughput-performance profile is selected Note that the first rule that matches takes effect. 7.7. Other changes to infrastructure services components The summary of other notable changes to particular infrastructure services components follows. Table 7.1. Notable changes to infrastructure services components Name Type of change Additional information acpid Option change -d (debug) no longer implies -f (foreground) bind Configuration option removal dnssec-lookaside auto removed; use no instead brltty Configuration option change --message-delay brltty renamed to --message-timeout brltty Configuration option removal -U [--update-interval=] removed brltty Configuration option change A Bluetooth device address may now contain dashes (-) instead of colons (:). The bth: and bluez: device qualifier aliases are no longer supported. cups Functionality removal Upstream removed support of interface scripts because of security reasons. Use ppds and drivers provided by OS or proprietary ones. cups Directive options removal Removed Digest and BasicDigest authentication types for AuthType and DefaultAuthType directives in /etc/cups/cupsd.conf . Migrate to Basic . cups Directive options removal Removed Include from cupsd.conf cups Directive options removal Removed ServerCertificate and ServerKey from cups-files.conf use Serverkeychain instead cups Directives moved between conf files SetEnv and PassEnv moved from cupsd.conf to cups-files.conf cups Directives moved between conf files PrintcapFormat moved from cupsd.conf to cups-files.conf cups-filters Default configuration change Names of remote print queues discovered by cups-browsed are now created based on device ID of printer, not on the name of remote print queue. cups-filters Default configuration change CreateIPPPrinterQueues must be set to All for automatic creation of queues of IPP printers cyrus-imapd Data format change Cyrus-imapd 3.0.7 has different data format. dhcp Behavior change dhclient sends the hardware address as a client identifier by default. The client-id option is configurable. For more information, see the /etc/dhcp/dhclient.conf file. dhcp Options incompatibility The -I option is now used for standard-ddns-updates. For the functionality (dhcp-client-identifier), use the new -C option. dosfstools Behavior change Data structures are now automatically aligned to cluster size. To disable the alignment, use the -a option. fsck.fat now defaults to interactive repair mode which previously had to be selected with the -r option. finger Functionality removal GeoIP Functionality removal grep Behavior change grep now treats files containining data improperly encoded for the current locale as binary. grep Behavior change grep -P no longer reports an error and exits when given invalid UTF-8 data grep Behavior change grep now warns if the GREP_OPTIONS environment variable is now used. Use an alias or script instead. grep Behavior change grep -P eports an error and exits in locales with multibyte character encodings other than UTF-8 grep Behavior change When searching binary data, grep may treat non-text bytes as line terminators, which impacts performance significantly. grep Behavior change grep -z no longer automatically treats the byte '\200' as binary data. grep Behavior change Context no longer excludes selected lines omitted because of -m . irssi Behavior change SSLv2 and SSLv3 no longer supported lftp Change of options xfer:log and xfer:log-file deprecated; now available under log:enabled and log:file commands ntp Functionality removal ntp has been removed; use chrony instead postfix Configuration change 3.x version have compatibility safety net that runs Postfix programs with backwards-compatible default settings after an upgrade. postfix Configuration change In the Postfix MySQL database client, the default option_group value has changed to client , set it to empty value for backward compatible behavior. postfix Configuration change The postqueue command no longer forces all message arrival times to be reported in UTC. To get the old behavior, set TZ=UTC in main.cf:import_environment . For example, import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ=UTC XAUTHORITY DISPLAY LANG=C. postfix Configuration change ECDHE - smtpd_tls_eecdh_grade defaults to auto ; new parameter tls_eecdh_auto_curves with the names of curves that may be negotiated postfix Configuration change Changed defaults for append_dot_mydomain (new: no, old: yes), master.cf chroot (new: n, old: y), smtputf8 (new: yes, old: no). postfix Configuration change Changed defaults for relay_domains (new: empty, old: USDmydestination). postfix Configuration change The mynetworks_style default value has changed from subnet to host . powertop Option removal -d removed powertop Option change -h is no longer alias for --html . It is now an alias for --help . powertop Option removal -u removed quagga Functionality removal sendmail Configuration change sendmail uses uncompressed IPv6 addresses by default, which permits a zero subnet to have a more specific match. Configuration data must use the same format, so make sure patterns such as IPv6:[0-9a-fA-F:]*:: and IPv6:: are updated before using 8.15. spamassasin Command line option removal Removed --ssl-version in spamd. spamassasin Command line option change In spamc, the command line option -S/--ssl can no longer be used to specify SSL/TLS version. The option can now only be used without an argument to enable TLS. spamassasin Change in supported SSL versions In spamc and spamd, SSLv3 is no longer supported. spamassasin Functionality removal sa-update no longer supports SHA1 validation of filtering rules, and uses SHA256/SHA512 validation instead. vim Default settings change Vim runs default.vim script, if no ~/.vimrc file is available. vim Default settings change Vim now supports bracketed paste from terminal. Include 'set t_BE=' in vimrc for the behavior. vsftpd Default configuration change anonymous_enable disabled vsftpd Default configuration change strict_ssl_read_eof now defaults to YES vsftpd Functionality removal tcp_wrappers no longer supported vsftpd Default configuration change TLSv1 and TLSv1.1 are disabled by default wireshark Python bindings removal Dissectors can no longer be written in Python, use C instead. wireshark Option removal -C suboption for -N option for asynchronous DNS name resolution removed wireshark Ouput change With the -H option, the output no longer shows SHA1, RIPEMD160 and MD5 hashes. It now shows SHA256, RIPEMD160 and SHA1 hashes. wvdial Functionality removal

Commands: