Red Hat Enterprise Linux 9 Expert

Key Features

OpenSSL 3.0

Major version jump from OpenSSL 1.1.1 (RHEL 8). The ENGINE API is replaced with a provider architecture.

Providers: default (standard algorithms), legacy (Blowfish, DES, RC4 -- must be explicitly loaded), fips (FIPS 140-3 validated), base (encoding infrastructure).

# Check providers
openssl list -providers

# FIPS mode
fips-mode-setup --enable && reboot
fips-mode-setup --check
openssl list -providers | grep fips

Breaking changes from 1.1.1: ENGINE_* functions removed, RSA_public_encrypt() deprecated (use EVP_PKEY_*), DH minimum 2048-bit, PKCS12_parse() behavior changed for empty passwords.

SHA-1 Deprecated System-Wide

SHA-1 signatures are disabled by default at the crypto policy level. This affects SSH, TLS certificates, RPM signatures, GPG, DNSSEC, and S/MIME.

# Check current policy
update-crypto-policies --show

# Re-enable SHA-1 if required (not recommended)
update-crypto-policies --set DEFAULT:SHA1
systemctl restart sshd

# Migrate SSH keys to Ed25519
ssh-keygen -t ed25519 -C "user@host"

Existing RSA keys continue to work because OpenSSH in RHEL 9 negotiates rsa-sha2-256 by default. Only the legacy ssh-rsa (SHA-1 hash) signature algorithm is blocked.

nftables Only (iptables Removed)

iptables, ip6tables, arptables, and ebtables are not available by default. Firewalld's --direct rule interface is deprecated.

nft list ruleset                       # view all rules
nft list table inet firewalld          # firewalld table
nft add rule inet filter input tcp dport 8080 accept

# Migration from iptables
dnf install iptables-nft               # compatibility shim
iptables-restore-translate -f old-rules > /etc/nftables/migrated.nft
nft -c -f /etc/nftables/migrated.nft  # dry run

Root SSH Password Login Disabled

Default: PermitRootLogin prohibit-password. Root login via password is blocked; SSH key login still permitted.

sshd -T | grep permitrootlogin

# Recommended: use dedicated admin user with sudo
useradd -m -G wheel adminuser
passwd adminuser

Cloud-init typically sets PermitRootLogin no (completely blocked).

kpatch (Kernel Live Patching)

Apply critical security patches to a running kernel without rebooting. Patches are cumulative.

dnf install kpatch-dnf
dnf kpatch auto                        # enable automatic live patching

kpatch list                            # loaded patches
kpatch status                          # active patches
ls /sys/kernel/livepatch/              # verify in kernel

Not all CVEs are live-patchable. Quarterly kernel updates still require reboots.

Keylime (Remote Attestation)

TPM-based remote attestation verifying firmware, bootloader, kernel, and runtime file integrity.

dnf install keylime
systemctl enable --now keylime_verifier keylime_registrar  # server
systemctl enable --now keylime_agent                       # client

keylime_tenant -c add --uuid <uuid> --ip <ip> --tpm_policy '...'
keylime_tenant -c status --uuid <uuid>

Integrates with IMA measurement logs for continuous runtime integrity.

WireGuard VPN

In-kernel (5.14), high-performance VPN using ChaCha20, Poly1305, Curve25519.

dnf install wireguard-tools
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key

# /etc/wireguard/wg0.conf
wg-quick up wg0
systemctl enable --now wg-quick@wg0
wg show

# NetworkManager integration
nmcli connection add type wireguard con-name wg-vpn ifname wg0 \
  wireguard.private-key "$(cat /etc/wireguard/client_private.key)"

Podman 4.x

Netavark replaces CNI as default network stack. Aardvark-dns provides container name resolution.

podman network create mynet
podman run -d --network mynet --name db postgres:15
podman run -d --network mynet --name app myapp
# 'app' resolves 'db' by hostname

# Quadlet (RHEL 9.3+) -- declarative systemd integration
# Place .container files in /etc/containers/systemd/

Reduced Module Streams

Most RHEL 8 modular applications are now traditional RPMs. Remaining modules: ruby (3.1, 3.3), maven (3.8), nodejs (18, 20, 22).

dnf install python3.11                 # direct package name, no module enable
dnf install nodejs                     # gets AppStream default version
dnf module list                        # only a few modules remain

IMA (Integrity Measurement Architecture)

Kernel-level file integrity measurement. Records hashes in TPM.

cat /sys/kernel/security/ima/active
cat /sys/kernel/security/ima/ascii_runtime_measurements | head -20

# Kernel cmdline for enforcement
# ima_policy=tcb ima_appraise=enforce ima_hash=sha256

CentOS Stream 9 Relationship

RHEL 9 is built from CentOS Stream 9 (upstream), not the other way around. Stream receives changes before RHEL 9.x point releases. Not a production substitute for RHEL.

Common Pitfalls

1. SHA-1 TLS certificates breaking -- check update-crypto-policies --show; use DEFAULT:SHA1 as temporary workaround
2. OpenSSL 3.0 API changes -- applications using ENGINE_* or low-level RSA calls must be updated
3. iptables commands missing -- install iptables-nft shim for migration; rewrite to nft or firewall-cmd
4. Root SSH password rejected -- by design; use key-based auth or dedicated admin user
5. FIPS mode differences -- OpenSSL FIPS provider replaces the old kernel-flag approach
6. Expecting Docker -- Docker remains absent; Podman 4.x with Netavark is the runtime
7. firewalld --direct rules deprecated -- use rich rules or native nft instead
8. VDO standalone command removed -- VDO merged into LVM as lvcreate --type vdo

Migration from RHEL 8

1. Audit SHA-1 usage -- certificates, SSH keys, RPM signatures
2. Test OpenSSL 3.0 compatibility -- applications using ENGINE or low-level API
3. Migrate iptables rules -- use iptables-restore-translate
4. Convert ifcfg to keyfile -- nmcli connection migrate
5. Review module streams -- most are gone; map to standard RPM package names
6. Test root SSH access -- password login blocked by default
7. Plan VDO migration -- standalone VDO -> LVM VDO
8. Run Leapp preupgrade -- resolve all inhibitors before upgrade

Version Boundaries

• Kernel: 5.14 across all 9.x minor releases
• cgroup v2 default and only supported mode
• ifcfg format deprecated (keyfile default); ifcfg still works
• iptables removed; nftables only
• OpenSSL 3.0 (not 1.1.1)
• systemd-resolved available as DNS resolver

Reference Files

Load these for deep knowledge:

• ../references/architecture.md -- Kernel, systemd, dnf, filesystem, networking
• ../references/diagnostics.md -- journalctl, sosreport, performance tools, boot diagnostics
• ../references/best-practices.md -- Hardening, patching, tuned, crypto policies, backup
• ../references/editions.md -- Subscriptions, variants, lifecycle, Convert2RHEL