Sometimes assets which are running a particular distribution of enterprise Linux will show up as a different one. This is likely for the following distributions:
- AlmaLinux OS
- CentOS Linux
- CentOS Stream
- CloudLinux OS
- RedHat Enterprise Linux (RHEL)
- Rocky Linux
- Oracle Linux
Originally, these Red Hat Enterprise Linux (RHEL) derivatives were built from exactly the same source code as RHEL. Red Hat has changed this a bit recently were now RHEL is built from CentOS Stream. All of the non-RHEL distributions were intended to be indistinguishable from RHEL for maximum compatibility with commercial software that is only supported on RHEL. This means that with a default minimal install, they respond to probes in exactly the same way as RHEL. This makes it exceptionally difficult for runZero to tell them apart.
In some cases, a service running on the system will provide enough distribution-specific information to enable RHEL variants to be distinguished. For example, if you are running the checkmk agent or cockpit service on the Linux server, it will report the OS vendor and allow accurate fingerprinting. SNMP will also sometimes reveal enough information to identify the specific Linux distribution though in many cases the derivatives report the exact same kernel as RHEL.
As of January, 2024 we have adopted the OS Value RHEL Derivative Linux in cases where we have identified that the asset is running one of the derivatives of RHEL but aren't certain which. This was done in order to avoid incorrectly asserting a specific OS and causing confusion.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article