I have been applying a fix for the recently reported 8 compromised certificates and figured I'd share the script I'm using.

Designed for RH and clones, I'll share it as a text file you can review before you rename and apply. It's a simple script based directly on the disclosure page linked to that I found after the original article here on reddit.

I hope it helps, here is distrust.sh - downloaded as a .txt file you can read/review before renaming to distrust.sh and running it as /bin/bash distrust.sh. If your system isn't vulnerable it does nothing.

Hi All,

Has anyone succesfully configured Remote Login into Rocky Linux 10 from Windows 11..

I have tried many way but can't login, always fails showsAn authentication error has occurred. More data is available in RDP, while in RL it shows

Oct 20 15:30:19 tailscale gnome-remote-desktop-daemon[3003]: [15:30:19:242] [3003:00000bc4] [ERROR][com.freerdp.core.auth] - [credssp_auth_authenticate]: AcceptSecurityContext failed with SEC_E_INVALID_HANDLE [0x80090301]

Oct 20 15:30:19 tailscale gnome-remote-desktop-daemon[3003]: [15:30:19:316] [3003:00000bc7] [WARN][com.freerdp.core.connection] - [rdp_server_accept_nego]: server supports only NLA Security <-----

Oct 20 15:30:19 tailscale gnome-remote-desktop-daemon[3003]: [15:30:19:316] [3003:00000bc7] [ERROR][com.freerdp.core.connection] - [rdp_server_accept_nego]: Protocol security negotiation failure

Oct 20 15:30:19 tailscale gnome-remote-desktop-daemon[3003]: [15:30:19:316] [3003:00000bc7] [ERROR][com.freerdp.core.connection] - [rdp_server_accept_nego]: Protocol security negotiation failed, disconnecting.

After researching found this seems to be tied to Windows NLA, I'm unable to disable it due to security policies, and had RL9.6 working fine as well..

Has anyone been successful in configuring RL to accept with NLA enabled ?

Thank You

A successful pre-upgrade check does not prove that the recovery path works. A system may boot after a failed upgrade while third-party repositories, kernel modules, storage mounts, SELinux policy, network configuration, or application data remain inconsistent. A VM snapshot is useful, but it may not cover external volumes or prove that restore time is acceptable.

A practical drill could preserve package and repository inventories, configuration, boot entries, encryption details, and application data; restore that material into an isolated clone; then verify the running kernel, failed units, mounts, network policy, AVC denials, scheduled jobs, monitoring, backups, and application health. For in-place upgrades, the plan also needs a clear point after which rollback means restoring the whole system rather than trying to reverse packages.

What do Rocky Linux operators test before approving a major-version upgrade? Which parts of a Leapp-based move are realistically reversible, and what recovery evidence do you keep until the upgraded host has survived reboots and a normal observation window?

The Rocky Linux Testing team has been utilizing the Linux Hardware Project for hardware validation and testing for a few years now, though the most growth has been in the last year. Testing Team would like to see a wider range of hardware submitted and tested as this helps both the Rocky Linux community and the larger Linux community as well.

You can help Rocky and the Linux Hardware Project today by submitting a hardware probe. Report your submission to this post before 10/15 for a chance at winning swag to one of our merch shops! Details here:- https://docs.rockylinux.org/teams/testing/documentation/hardware/hardware_compat/

Hi,
on a Rocky 9 after latest updates I had to remove ffmpeg because of conflicts and now I cannot add it back. This error happens even if I cleared the dnf cache.

Any suggestion?

# dnf install ffmpeg
Last metadata expiration check: 0:00:07 ago on Wed 30 Sep 2026 09:10:45 CEST.
Error:
 Problem: problem with installed package ffmpeg5-libavcodec-free-5.1.9-3.el9.x86_64
  - package ffmpeg5-libavcodec-free-5.1.9-3.el9.x86_64 from  conflicts with libavcodec.so.59()(64bit) provided by libavcodec-1:5.1.10-1.el9.x86_64 from epel-multimedia
  - package ffmpeg5-libavcodec-free-5.1.9-3.el9.x86_64 from epel conflicts with libavcodec.so.59()(64bit) provided by libavcodec-1:5.1.10-1.el9.x86_64 from epel-multimedia
  - package libavfilter-1:5.1.10-1.el9.x86_64 from epel-multimedia requires libavcodec(x86-64) = 1:5.1.10-1.el9, but none of the providers can be installed
  - package ffmpeg-1:5.1.10-1.el9.x86_64 from epel-multimedia requires libavfilter.so.8()(64bit), but none of the providers can be installed
  - package ffmpeg-1:5.1.10-1.el9.x86_64 from epel-multimedia requires libavfilter.so.8(LIBAVFILTER_8)(64bit), but none of the providers can be installed
  - package ffmpeg5-libavfilter-free-5.1.9-3.el9.x86_64 from epel requires ffmpeg5-libavformat-free(x86-64) = 5.1.9-3.el9, but none of the providers can be installed
  - problem with installed package libavformat-1:5.1.10-1.el9.x86_64
  - package ffmpeg5-libavformat-free-5.1.9-3.el9.x86_64 from epel conflicts with libavformat.so.59()(64bit) provided by libavformat-1:5.1.10-1.el9.x86_64 from 
  - package ffmpeg5-libavformat-free-5.1.9-3.el9.x86_64 from epel conflicts with libavformat.so.59()(64bit) provided by libavformat-1:5.1.10-1.el9.x86_64 from epel-multimedia
  - cannot install the best candidate for the job
(try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

Hello all,

I have been experimenting with Rocky 10 as I eagerly await Autodesk Maya to get support for EL10. I remembered that EL10 updated their GNOME version to 49, so I know that enterprise Linux can update their DE version if they wanted to, which got me excited. I then noticed that inside EPEL, they have KDE 6.7, which I found was a great KDE version when I was on Fedora. I wanted to see if it actually worked, but after installing Rocky 10 in a VM as a custom OS and installing the KDE-Desktop package group from EPEL, I noticed that the KDE version is still on 6.6.4, even though when you look at the package list for EPEL 10, Plasma 6.7 is there. I tried downloading the RPMs manually from the package lists and I could not get it running properly yet.

Has anyone managed to get that KDE version running on their Rocky installs from EPEL? Is this just a matter of waiting for other things to fall into place before we get a new DE version?

Thanks, and I am really excited to get to use EL10

Fairly new to linux in general... but determined to bail on Windows completely. I am currently running Zorin OS. I got DaVinci installed but many work arounds required and some features never did work. I then installed RockyLinux on a different machine and could not even get DaVinci installed. It just keeps asking me to install packages that have already been installed. I am stuck in the dual boot world until I get this resolved. Bottom line... is RockyLinux the best distro to use (Only one officially supported by BlackMagicDesign), and if so... are there any clear steps out there to help a newbie figure this out and get it running? Thanks in advance!

Installed Rocky 10.2 Desktop this morning in a VM (host is current Fedora). I am retired and have a number of machines I've acquired over the years (I am down to five laptops and three desktops only because She Who Must Be Obeyed doesn't know about all of them). I run various distros (Fedora, Debian testing, Arch, GhostBSD, including two dual-booters with Windows for when I do my income taxes or am forced for some reason to help a friend or family member).

When I am keeping up/evaluating for use/casually distro-hopping, I use a standard set of apps that I configure - mostly office-ish and casually dev-ish (e.g., Jupyter Notebook running some python scripts). I noticed, when post-installing Rocky, that as an enterprise-centric OS it seemed to pay a little more attention to security compared to the run-of-the-mill desktop distro. This is not to say one can't harden any of the mainstream (RH/Debian/Arch/Slackware) distros and their derivatives, it's a question of the work involved. Not interested in an atomic desktop, that's a lot of work for limited payback IMO; but Rocky left me with the impression that without a lot of extra work (I consider post-install part of the installation), it is a lot more secure OOTB. Kernel 6.12 aside, it seems a lot more usable as a desktop then RH Dev version if one is not a full-time developer.

Is it usable long-term as a desktop for a non-gamer (my last regular gaming was Diablo II :-) ) who will use it for office stuff, financial planning/investing, and casual coding (probably python)?

Thanks!

Para quem quiser testar essas instruções para instalar o eToken Aladdin 64k VID:PID 0529:0600 no Rocky Linux 9.

Fiz uma sessão de debug com o Gemini e conseguimos fazer funcionar depois de algumas horas. A luz do token fica piscando, mas ele funciona normalmente. Teste realizado tanto no Firefox quanto no Chrome no site do eCAC da Receita Federal.

Utilizar o Safe Net versão 9 disponível em https://www.certificadoranacional.com/suporte/ (SAC 9.0.43 (RPM) )

sudo dnf localinstall -y SACCore-9*x8664rpm

mkdir p ~/compatopenssl

ln -s /usr/lib64/libcrypto.so.1.1.1k ~/compat_openssl/libcrypto.so.10

ln -s /usr/lib64/libcrypto.so.1.1.1k ~/compat_openssl/libcrypto.so.1.0.0

ln -s /usr/lib64/libcrypto.so.1.1.1k ~/compatopenssl/libcrypto.so

echo $HOME/compat_openssl | sudo tee /etc/ld.so.conf.d/safenetcompat.conf

sudo ldconfig

pkcs11tool module /usr/lib64/libeTPkcs11.so listslots

Firefox

Apontar para /usr/lib64/libeTPkcs11.so nos modulos de segurança do dispositivo

Chrome

mkdir -p $HOME/.pki/nssdb

sudo dnf install -y nss-tools

modutil -dbdir sql:$HOME/.pki/nssdb -add "SafeNet eToken" -libfile /usr/lib64/libeTPkcs11.so

modutil dbdir sql:$HOME/.pki/nssdb list

Looking online it says to enable the epel-release repo but it is still not in the package manager or do I just have to download and maintain the binary manually.

There’s no rush to upgrade, but when will you make the change to Rocky 10?

What are the considerations to make before deciding to upgrade my production environment to Rocky 10?

I have the luxury to run Rocky 10 side-by-side Rocky 9. My process is clear, but my timing is not.

Hey guys, I'm trying to find the rpm package or repository to install Visual Studio Code on Rocky Linux 10. I'm able to following the instruction from the site: https://linuxcapable.com/how-to-install-vscode-on-rocky-linux/ to install the package. However, I'm only able to install vscode version: code-1.126.0-1782208129.el8.x86_64 which is older and also it's focused for EL8. I did search on https://packages.microsoft.com/ manually and I couldn't find any package for EL10, Rocky Linux 10, or anything apart from EL8 packages. This makes me to wonder aren't official packages being released by Microsoft for EL10 ? If release, where can I find the package ? Did anyone come across this ?

Hi all,

I am thinking to develop AI appliance products using Rocky Linux. Since there will be a lot of IP involved, I plan on encrypting the storage and not allowing shell access. So these appliances will be similar to industry routers in terms of operations: users perform their operations via UIs. Users do not have root or shell access.

Is Rocky Linux a good fit for my intended applications? Thanks.

I'm posting this thread as a hub for my upcoming series on installing Rocky Linux 10.2 with a modern NVIDIA GPU (I'll be using a 5060 Ti):

• Part 1: Unboxing the 5060 Ti
  • Video: https://youtu.be/lpoJniK63bo
• Part 2: Updating NVIDIA drivers on an existing distro without reinstalling (including a fix for the dreaded black screen issue)
  • Video: https://youtu.be/R_kGHvQZ67g
• Part 3: Overview of my Rocky Linux + NVIDIA install script, plus a full install walkthrough
  • Video: https://youtu.be/eWgOxOs5Fvw
  • GitHub: https://github.com/TheLinuxITGuy/Rocky-Scripts

Has anyone been able to do this? And if so im assuming I would need to compile i doubt EPEL has these? Thank you all

An age old question I know... did a search but couldn't find any recent conversation around this so asking the group...

Switched to Linux from Windows 3 months ago. I would be happily operating on Mint, or Zorin were it not for my complete dependence (for work), on DaVinci Resolve. The Dual Boot system I am currently using (Windows/Zorin) is not sustainable (wrought with constant conflicts and forced shut downs), so here I am... installing RockyLinux as the only officially supported distro for DaVinci by BlackMagic Design. And yet again... install issues. BlackMagic's installer .run file is asking me to install packages that when typed into the terminal... RockyLinux tells me are already installed and running? Just reaching out here in hopes some one can point me in the direction of recent documentation or conversation on how to successfully install DaVinci... a full working edition with all codec compatibilities and features in tact, on RockyLinux. BlackMagic's own instructions (updated June 23, 2006) don't seem to help. Thanks in advance for any guidance!!

I did this successfully with Rocky 9.6, but for some reason am having a lot more trouble this time. I have a fresh install of 9.8 (separate from the 9.6 install,) and my goal is to be able to use my wired xbox controller on it. I found xpad, and think that is what I used before, but when I run sudo dkms install -m xpad -v 0.4 after cloning the github, it fails, saying to check the make.log for more info. Doing that, I'm told my kernel configuration is invalid and I need to run make oldconfig && make prepare to fix it, but make prepare fails on objtool, and I don't know how to fix that one. If anyone has a way to get it so I can build xpad, or a different way to get my controller working, please let me know.

(Edit) I found the fix, or rather someone on github did, and I found the issue post about it. Commenting out the from_timer backwards compatibility line did indeed make the driver compile properly.

Hi everyone,

Im a new admin and Im really confused with this problem I'am facing.

when I do:

dnf updateinfo list updates security - I get multiple patches that needs to be installed.

But when I do:

dnf update --security - It says nothing todo!

Im using GCP cloud kernel. Does that mean the cloud kernels are outdated?

Looks like mesa-libOSMesa and mesa-libOSMesa-devel packages are deprecated and officially removed from 9.8 and this breaks wine and wine-core for me. Is any here using wine on 9.8?

Hello, I’m sure this has been asked a million times. Currently have an nvidia 1070 and a functioning Rocky Linux 9.8 (Headless). At one point I had it installed with drivers and the cuda package. Then after one reboot it all went to crud. No more nvidia-smi command. I can still see the GPU under the PCI devices. My question is if I should be following the Rocky official documentation or the nvidia documentation? I’ve spent months trying to solve this issue but it all seems to end with me giving up and leaving it just installed in the system. Any guidance from the community would be appreciated.