SLES 15 SP6 Version Expert

# Verify OpenSSL version
openssl version

# List active providers
openssl list -providers

# Check available algorithms
openssl list -cipher-algorithms | head -20

Breaking changes:

• Applications using the deprecated ENGINE API will fail
• Legacy algorithms (Blowfish, RC4, DES) require explicitly loading the legacy provider
• FIPS provider replaces FIPS_mode() API
• Test application compatibility before upgrading: openssl s_client -connect <host>:443 -showcerts

cgroup v2 Unified Hierarchy (systemd 254)

SP6 defaults to cgroup v2 unified hierarchy. SP5 used hybrid mode. This affects container runtimes, resource management tools, and monitoring agents.

# Verify cgroup v2 is active
mount | grep cgroup
# Should show: cgroup2 on /sys/fs/cgroup type cgroup2

# Check systemd version
systemctl --version | head -1

# Resource control with systemd cgroup v2
systemctl set-property myservice.service MemoryMax=512M CPUQuota=50%

Container runtime impact: Podman with cgroup v2 requires --cgroup-manager=systemd. Docker may need --cgroup-parent adjustment. Check podman info | grep cgroupVersion.

LUKS2 Full Support in YaST

SP6 adds full YaST Partitioner support for LUKS2 with Argon2 KDF (memory-hard, resists GPU brute-force).

# Create LUKS2 volume
cryptsetup luksFormat --type luks2 /dev/sdX

# Verify LUKS version
cryptsetup luksDump /dev/sdX | grep Version

# Encrypt /boot with LUKS2 (requires GRUB2 >= 2.06)
cryptsetup luksFormat --type luks2 --pbkdf argon2id /dev/sda1

OpenSSH 9.6p1 — RSA Key Policy

RSA keys smaller than 2048 bits are rejected by default. Existing SSH keys or certificates using RSA-1024 will fail authentication.

# Check host key strength
for key in /etc/ssh/ssh_host_*_key.pub; do
    ssh-keygen -l -f "$key"
done

# Replace weak keys
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
# Or: ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_new

NFS over TLS (RFC 9289)

Kernel-level NFS traffic encryption without requiring Kerberos or VPN.

# Server: enable rpc-tlsd
systemctl enable --now rpc-tlsd
# Export: /srv/nfs  *(rw,sec=tls)

# Client: mount with TLS
mount -t nfs -o tls <server>:/srv/nfs /mnt/nfs

Confidential Computing Module (Tech Preview)

Initial support for Intel TDX and AMD SEV hardware-isolated VMs.

SUSEConnect -p sle-module-confidential-computing/15.6/x86_64
dmesg | grep -i "tdx\|sev"

FRRouting Replaces Quagga

FRR is the active fork with BGP EVPN, BFD, and YANG/NETCONF support.

# Install FRRouting
zypper install frr
systemctl enable --now frr

# Unified CLI
vtysh
# show ip bgp summary
# show ip ospf neighbor

Migration: copy configurations from /etc/quagga/ to /etc/frr/ and convert to integrated config with vtysh -c "write integrated".

BIND 9.18 with DoT and DoH

Native DNS over TLS (port 853) and DNS over HTTPS (port 443) support.

zypper search-packages

Search across ALL modules and extensions, not just enabled repositories.

zypper search-packages <packagename>
# Output includes module name and SUSEConnect command to enable it

HPC Module (From Separate Product)

HPC capabilities moved from separate SLE HPC product into a module available to all SP6 customers.

SUSEConnect -p sle-module-hpc/15.6/x86_64
zypper install slurm mpi-selector openmpi4

SP7 Deprecation Warnings

SP6 officially deprecates the following for removal in SP7:

# Check for deprecated packages
for pkg in php7 php74 ibm-java openldap2 ceph-common; do
    rpm -q "$pkg" &>/dev/null && echo "DEPRECATED: $pkg"
done

SP6 Common Pitfalls

1. Applications breaking with OpenSSL 3 provider model Applications using the deprecated ENGINE API will fail. Check with ldd /path/to/app | grep libssl and test before upgrading.

2. Monitoring agents failing with cgroup v2 Tools reading cgroup v1 paths (/sys/fs/cgroup/cpu/) will break. Update monitoring agents to read cgroup v2 paths (/sys/fs/cgroup/).

3. SSH authentication failures from weak RSA keys OpenSSH 9.6 rejects RSA < 2048 bits. Audit all host keys and authorized_keys before upgrading.

4. Quagga configurations not migrated to FRRouting FRR uses /etc/frr/ instead of /etc/quagga/. Configuration format is compatible but paths and daemon management differ.

5. Not planning for SP7 deprecated packages Begin migration of PHP 7.4, IBM Java, OpenLDAP, and Ceph client now to avoid SP7 upgrade blockers.

Diagnostic Script

Version Routing

• For general SLES topics, defer to the parent os-sles agent
• For SP5-specific features (kernel 5.14, Netavark, NVMe-oF TCP), route to 15-sp5/SKILL.md