Summarizing OS Version Upgrade Compatibility Issues
When you upgrade your OS from RHEL 7.9 to RHEL 8.x, the identified compatibility issues are listed in Table 1 for your reference. The recommended solutions are provided to speed up your device recovery, reducing the upgrade impacts on the system.
| Component | Compatibility Issue | Compatibility Issue Category | Description | Check Procedure | Recovery Suggestion |
|---|---|---|---|---|---|
| vsftpd (FTP server software) | RHEL 8 does not support tcp_wrappers configuration (a simple firewall software based on the TCP layer). | The configuration item is discarded. | RHEL 8 does not support tcp_wrappers configuration. Therefore, related configuration items need to be removed to reduce system component redundancy. Check related configurations. firewalld can be used instead. | In RHEL 8, check whether the vsftpd configuration is supported, especially whether tcp_wrappers=YES is not set in the configuration file and whether vsftpd-related configurations can be found in the tcp_wrappers configuration file. You can perform the following steps:
The preceding steps ensure that the vsftpd configuration does not conflict with tcp_wrappers. | Rectify the fault by referring to the official document Replacing TCP Wrappers in RHEL 8 and 9. |
| openssh (SSH login) |
|
| Some security algorithms in the Ciphers and MAC configurations have expired. You need to query keywords and delete the discarded security algorithms.
| Configure the Ciphers and MAC keywords in the configuration file and check whether there are discarded security algorithms. | Run the following command to open the configuration file. vi /etc/ssh/sshd_config Delete the following discarded security algorithms. removed_ciphers = [
"blowfish-cbc",
"cast128-cbc",
"arcfour",
"arcfour128",
"arcfour256",
]
removed_macs = [
"hmac-ripemd160",
] |
| openssh (SSH login) | The value of the configuration item is discarded. | The configuration item is discarded. | ShowPatchLevel is a configuration item of the SSH Daemon (sshd). It specifies whether to display the patch level of the binary file in the identity authentication string. This option applies only to SSH 1 and is disabled by default (that is, the patch level is not displayed). ShowPatchLevel is used to display the patch level of sshd to the client. In RHEL 8, sshd disables SSH 1 by default and supports only SSH 2. The ShowPatchLevel configuration is useless in SSH 2. SSH 1 is considered insecure. If you need to view the patch level of a specific SSH server version, you may need to refer to the compilation configuration or related documents of the software instead of relying on this outdated option. Delete the configuration file related to ShowPatchLevel. | Run the following command to check whether ShowPatchLevel can be found. bash: grep "ShowPatchLevel" /etc/ssh/sshd_config | Run the following command to delete the ShowPatchLevel parameter: bash: sed -i /^\\s*ShowPatchLevel.*$/Id |
| openssh (SSH login) | The value of PermitRootLogin must be set to YES. | The preset value is changed. | PermitRootLogin is used to determine whether the root user can directly log in to the system through SSH. When RHEL 7 is upgraded to RHEL 8, if the old sshd_config configuration (for example, PermitRootLogin without-password) is used, and the root user may fail to log in to the system through SSH. In this case, you need to change the value of PermitRootLogin to yes for compatibility to allow root to log in to the system through SSH. | Run the following command. If the output is empty, there is no PermitRootLogin statement. bash: grep "PermitRootLogin" /etc/ssh/sshd_config | Run the following command. bash: sed -i "s#^PermitRootLogin.*#PermitRootLogin yes#g" /etc/ssh/sshd_config |
| Bind (DNS server software) |
|
|
listen-on-v6 is disabled by default on RHEL 7 and enabled by default on RHEL 8. RHEL 8 listens to all available IPv6 interfaces even if listen-on-v6 is not configured. After the upgrade, the configuration may conflict with the expectation. If listen-on-v6 is disabled (for example, listen-on-v6 { none; };) on RHEL 7, the configuration may become invalid due to configuration changes or priority changes after the upgrade. It is recommended that you configure the parameter explicitly, ensuring that the configuration is the same as expected. |
| Delete dnssec-lookaside. If this function is still required, modify it by referring to the official document. Display the configuration switch or do not configure listen-on-v6 based on the expected usage. |
| pam_pkcs11.so pam_krb5.so | The so library is no longer supported. | The so library is no longer supported. |
| Run the following commands to query the so library configuration: bash: grep "pam_pkcs11.so" /etc/pam.d/* grep "pam_krb5.so" /etc/pam.d/* | Remove or comment out the unsupported so library configuration. For details, see official documents. |
| pam_tally2.so | The so library is no longer supported. | The so library is no longer supported. | pam_tally2.so is a Pluggable Authentication Module (PAM), used to collect statistics on and limit the number of user login failures. This module can monitor the number of consecutive login failures of a user. When the preset threshold is reached, the user account is temporarily locked to prevent brute-force attacks or malicious login attempts. This enhances system security and is applicable to multiple authentication scenarios such as local login and SSH remote login. In RHEL 8, pam_tally2.so is replaced by pam_faillock.so and no longer installed by default and no longer maintained by the official website. If pam_tally2.so is still referenced in the PAM configuration file (such as /etc/pam.d/sshd and /etc/pam.d/system-auth) after the upgrade, the module cannot be found. (module not found is reported.) As a result, the authentication process fails. | Run the following command to query the so library configuration. bash: grep "pam_tally2.so" /etc/pam.d/* | Remove or comment out the unsupported so library configuration. |
| firewalld (Firewall software) | Many firewall rules are changed, and some usages are no longer supported. | The configuration item is changed. | firewalld simplifies the supported firewall rules, especially ebtables and ipset types. Only the subsets are supported. If the unsupported types are used, the rules will become invalid or the firewall will fail to be started. | Exclusion method:
| You need to check all firewall rules and configuration files, replace the types that do not meet the requirements with the supported types, and delete the unsupported usage (rectify the fault according to the description in the corresponding version document. For details, see RHEL 8 firewall configuration). |
| Btrfs (New file system) | The Btrfs component is discarded in RHEL 8. | Component deprecation | Btrfs is a modern file system designed to meet high-end storage requirements. It supports advanced functions such as snapshot, RAID, and dynamic volume management. Btrfs is an optional component in RHEL 7. Btrfs is discarded in RHEL 8. Btrfs is not provided as an optional file system during the upgrade. Partitions cannot be formatted as Btrfs during system installation. The core tool package of Btrfs is removed from the official repository. | You can check and rectify the fault by referring to official documents.
| |
| XFS (High-performance log file system) | The configuration item is discarded. | The configuration item is discarded. | XFS is a highly scalable, high-performance, robust, and mature 64-bit log file system that supports large files and file systems on a single host. It is the preset file system in RHEL 8 and has some discarded configuration items. | Check whether any discarded configuration items exist.
Run the following command. grep -E 'nodelaylog|delaylog|ihashsize|irixsgid|osyncisdsync|osyncisosync|nobarrier|barrier' /etc/fsta | Delete the discarded configuration items and replace them with new configuration items in the manual. |
| Docker (Container) | Docker is replaced by Podman. | Component replacement | Docker software package is provided in RHEL 7. In RHEL 8, Docker is discarded and Podman is recommended. You need to migrate the existing Docker containers to adapt to the RHEL 8 environment. For the upgrade, you may manually reinstall the system or use the Leapp tool. | For details, see official documents. | For details, see official documents. |
| babeld (Network traffic analysis tool) | Babeld is replaced by RIP, OSPF, or EIGRP. | Component replacement | In RHEL 8, the Babeld daemon (originally part of the Quagga implementation) is no longer included in FRRouting (FRR) due to licensing issues. This means that if you need to use the Babel protocol, you may need to find other alternatives or manually install Babeld. FRR has removed Babeld from its official software package. Therefore, users need to process the Babel protocol separately. If you have this requirement, you can obtain Babeld from the official website of the Babel project and install it. | Run the following command. bash: dnf list installed | grep -E "babeld|frr" If the preceding package is not displayed in RHEL 8 and FRR has been installed but the Babel component is not installed, Babeld has been removed. | If the network traffic analysis function is required, you need to manually deploy Babeld (download the source code from the Babel official website, compile and install Babeld) or install alternative software (such as OSPF, RIP, and IS-IS) in RHEL 8. |
| GRUB2 | Partition size is insufficient. | Partition size | In the GRUB 2 startup mechanism, core image core.img is an intermediate image that carries core function modules required for startup, such as basic hardware drivers, file system support, and boot logic. This image needs to be installed in a specific embedded area of the disk. If the embedded area is insufficient, GRUB 2 fails to install core.img. Generally, an error message is displayed, indicating that the embedded area is insufficient. As a result, the boot program cannot be installed. core.img generally is 20 KB to 30 KB. | For a traditional MBR disk, run the following command. bash: fdisk -l Check the starting position of the first disk. The MBR occupies one sector, so the size of the embedded area is (size of the start sector – 1) × 512 bytes. In this way, you can check whether the space of the embedding area is sufficient. | If the space is insufficient, the in-place upgrade is not supported. You need to reinstall the system or format the partition. |
| GRUB2 | GRUB 1 cannot be upgraded. GRUB 1 has been discarded in later versions. | Component deprecation | Starting from RHEL 7, GRUB Legacy has been replaced by GRUB 2. Therefore, GRUB Legacy is not usually found in the MBR on a newer system. | If you have installed GRUB 2, you can check the /boot/grub2/grub.cfg file or use the grub-install command to confirm the GRUB 2 status and indirectly determine whether GRUB Legacy has been removed. bash: grub-install --version Or, grub2-install --version If the system returns the GRUB 2 version information, GRUB 2 has been correctly installed, and GRUB Legacy has been removed. Run the ls -ld /boot/grub command to check whether GRUB Legacy residual exists. bash: ls -ld /boot/grub | Install GRUB 2 by referring to the official document. |
| pacemaker cluster | Cluster software upgrade is not supported. | Component deprecation | Leapp upgrade from RHEL 7 to RHEL 8 fails for pacemaker cluster. Red Hat officially states that Leapp is not recommended for in-place upgrade of cluster environments where High Availability or Resilient Storage add-ons are deployed. | Check whether the related configuration file exists. bash: ls /etc/corosync/corosync.conf ls /var/lib/pacemaker/cib/cib.xml If No such file or directory is displayed, no related configuration file exists. | In-place upgrade is not recommended. You can replace nodes one by one, perform distributed migration, and destroy the entire cluster. sh -c pcs cluster stop --all --wait && pcs cluster destroy --all For details, see official documents. |
| KDE | KDE desktop software is not supported. | Component deprecation | In RHEL 8, the KDE desktop environment is unavailable by default. If KDE-related software packages are installed in your system, they will be removed during the upgrade. Therefore, after the upgrade is complete, your system does not have any desktop environment. If a desktop environment is required, install the GNOME replacement software. | Run the following command to check whether the GNOME desktop software is installed. bash: rpm -qa | grep -i gnome-shell | Manually install the GNOME desktop software after the upgrade. dnf groupinstall "Server with GUI" -y Or, dnf groupinstall "Workstation" -y |
| sendmail | TCP Wrappers is not supported in later versions of sendmail. | The configuration item is discarded. | During the upgrade from RHEL 7 to RHEL 8, sendmail conflicts with TCP Wrappers. Check whether sendmail is installed and whether the configuration needs to be updated. If the TCP Wrappers tool is used, do not upgrade sendmail. To prevent sendmail service exceptions after the upgrade, perform the check operations before the upgrade. If sendmail depends on TCP Wrappers, do not upgrade the sendmail or adjust the configuration. |
| Remove the discarded configuration items or migrate the configuration items to the new ones. The original TCP Wrappers configuration is used for sendmail access control. Use firewalld for the same function (as recommended in RHEL 8). |
| SpamAssassin | Backward incompatibility | Backward incompatibility | RHEL 8 enhances software security, standardization, and modernization, and the SpamAssassin (e-mail spam filtering tool) is backward incompatible. Some configurations, command options, or protocols in RHEL 7 may be removed or modified in the new version. |
For the migration of configuration files, most of the work will be automatically completed by the SpamassassinConfigUpdate operator. | Many incompatible items and manual migration. |
| kernel | There are multiple versions of the kernel-debug rpm package. | Kernel package conflicts | If kernel-debug exists, the system boot option may be affected after the OS version is upgraded. As a result, the system cannot be accessed after the system is restarted. | Run the following command to view the system boot option information. bash: grubby --info=ALL | View the preset boot option and delete the configuration parameters. bash: grubby --default-index grubby --update-kernel=default boot option index --remove-args="rd.break easyup.rollback" |
| kernel | There are multiple versions of the kernel-devel rpm package. | Kernel package conflicts | kernel-devel is a kernel development file package. The content (such as kernel header files and module development tools) is strongly bound to a specific kernel version. Coexistence of multiple versions may cause path conflicts and dependency disorder. When processing the upgrade, the package manager needs to verify the dependency chains of the old and new versions. Coexistence of multiple versions complicates the dependency parse logic. As a result, errors such as version mismatch and dependency loop may occur. The upgrade process may be interrupted or the installation may be incomplete. Before the upgrade, ensure that the kernel-devel package does not exist in the environment. | Delete the kernel-devel package corresponding to the unused kernel so that only one kernel-devel package can be installed.
| Run the following command to uninstall the kernel development package. bash: yum -y remove <package_name> For details, see official documents. |
| device-mapper-multipath | The preset value of the configuration item is changed. | The preset value of the configuration item is changed. | device-mapper-multipath is used to aggregate multiple physical storage paths into one logical path, implementing storage access redundancy and load balancing. One of its core functions is path health check. path_checker is used to define the check method and determine whether the storage path is available. In RHEL 7, the default value of path_checker is directio. In RHEL 8, the default value of path_checker is tur. If the old configuration of path_checker is still retained in your configuration file, it may conflict with the default configuration. | Run the following command to check the current configuration. bash: grep "default_path_checker|detect_prio|detect_path_checker|reassign_maps|retain_attached_hw_handler" /etc/multipath.conf | Remove the original configuration or display the configuration. |
| Satellite | The data storage location is changed. | The data storage location is changed. | During the upgrade from RHEL 7 to RHEL 8, the /var/lib/pgsql/data directory contains original PostgreSQL data, and the storage space is insufficient when data is migrated from /var/opt/rh/rh-postgresql12/lib/pgsql/data/ to /var/lib/pgsql/data required by RHEL 8. As a result, automatic migration cannot be performed. | Check the installation status and version of RHEL Satellite in the current system. bash: rpm -q Satellite Precautions:
| Manually migrate data by referring to the official document. |
| SSSD |
|
| Key changes have been made to the System Security Services Daemon (SSSD) configuration in RHEL 8, which are related to compatibility and default behavior changes. These changes may affect system identity authentication and user information management. | 1. id_provider=local is no longer supported and will be ignored. 2. The ldap_groups_use_matching_rule_in_chain option is removed and will be ignored. 3. The ldap_initgroups_use_matching_rule_in_chain option is removed and will be ignored. 4. The preset value of ldap_sudo_include_regexp is changed from true to false. | Comment out the discarded configuration items. Modify the preset value. |
| tcp_wrappers | tcp_wrappers discarded | The configuration item is discarded. | TCP Wrappers is a security tool working at the fourth layer (transmission layer). It performs access control and security detection on specific services with stateful connections (TCP). All programs that invoke the libwrap.so library file can be controlled by TCP Wrappers. The main function of this tool is to control access of programs, such as rpcbind, vsftpd, sshd, and telnet. After the upgrade, the rules in hosts.deny and hosts.allow become invalid. RHEL 8 does not support tcp_wrappers configuration. Therefore, related configuration items need to be removed to reduce system component redundancy. Check related configurations. firewalld can be used instead. | For details, see official documents. | For details, see the official document to remove unsupported configuration items. |
| zipl | Boot tool conflicts | Boot tool conflicts | During the upgrade from RHEL 7 to RHEL 8, the boot tool zSeries Initial Program Loader (zipl) of the IBM S/390 and zSeries architectures may have compatibility issues due to configurations, functions, or dependency changes. The core issues involve the syntax and option support of the /etc/zipl.conf configuration file and the adaptation to new system components. Some configuration items that are valid in RHEL 7 are removed from or renamed in RHEL 8. As a result, the original configurations become invalid. |
|
|
| FILESYSTEM software package and file system mounting mechanism | If the ISO image is mounted to the /mnt directory, the filesystem software package upgrade will fail. | Image mounting errors | Run the mount command to mount the image file. When the ISO image is used as the source for system upgrade, do not mount the ISO image to the /mnt directory. Otherwise, the Filesystem software package upgrade will fail. | Check whether the system file is mounted to the /mnt directory. If yes, the system prompts you to unmount the file. bash: df -h | grep /mnt | Unmount the system files mounted to the /mnt directory. bash: umount /mnt |
| SELinux | SELinux rule differences | SELinux rule differences | During the SELinux upgrade, the system modifies or replaces a large number of files and processes, which may conflict with the SELinux security policy. As a result, the upgrade is affected. For details, see official documents. | Run the getenforce command to check the SELinux mode. bash: getenforce | If the SELinux mode is Enforcing, change it to Permissive temporarily. bash: sudo setenforce 0 |
| Files with special permissions | Files with special permissions | Files with special permissions | The logic of protecting files with special permissions conflicts with the operability requirements of files required for the upgrade. As a result, the upgrade may be interrupted. | Run the following command to query files with special permissions. bash: lsattr -alR ${dir} 2>/dev/null | grep -E "Append_Only|Immutable" Replace ${dir} in the command with the following path:
| Manually modify the permission of the files with special permissions. bash: chattr -a -i <specific-file-name> |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
