1. Register a node with the Red Hat Subscription Manager. Run the following command and when prompted, enter your Red Hat Customer Portal credentials:

   # subscription-manager register

2. Pull the latest subscription data from the CDN server:

   # subscription-manager refresh

3. List all available subscriptions and find the appropriate Red Hat Ceph Storage subscription and determine its Pool ID.

   # subscription-manager list --available

4. Attach the subscriptions:

   # subscription-manager attach --pool=<pool-id>

   Replace <pool-id> with the Pool ID determined in the previous step.

5. Enable the Red Hat Enterprise Linux 7 Server Base repository:

   # subscription-manager repos --enable=rhel-7-server-rpms

6. Enable the Red Hat Enterprise Linux 7 Server Extras repository:

   # subscription-manager repos --enable=rhel-7-server-extras-rpms

7. Update the node:

   # yum update

Configuring Access

1. On all Ceph nodes, as root, start the firewalld service, enable it to run on boot, and ensure that it is running:

   # systemctl enable firewalld
   # systemctl start firewalld
   # systemctl status firewalld

2. As root, on all Ceph Monitor nodes, open port 6789 on the public network:

   # firewall-cmd --zone=public --add-port=6789/tcp
   # firewall-cmd --zone=public --add-port=6789/tcp --permanent

   To limit access based on the source address, run the following commands:

   # firewall-cmd --zone=public --add-rich-rule="rule family="ipv4" \
   source address="<IP-address>/<prefix>" port protocol="tcp" \
   port="6789" accept"
   # firewall-cmd --zone=public --add-rich-rule="rule family="ipv4" \
   source address="<IP-address>/<prefix>" port protocol="tcp" \
   port="6789" accept" --permanent

3. If calamari-lite is running on the Ceph Monitor node, as root, open port 8002 on the public network:

   # firewall-cmd --zone=public --add-port=8002/tcp
   # firewall-cmd --zone=public --add-port=8002/tcp --permanent

   To limit access based on the source address, run the following commands:

   # firewall-cmd --zone=public --add-rich-rule="rule family="ipv4" \
   source address="<IP-address>/<prefix>" port protocol="tcp" \
   port="8002" accept"
   # firewall-cmd --zone=public --add-rich-rule="rule family="ipv4" \
   source address="<IP-address>/<prefix>" port protocol="tcp" \
   port="8002" accept" --permanent

4. As root, on all OSD nodes, open ports 6800-7300:

   # firewall-cmd --zone=public --add-port=6800-7300/tcp
   # firewall-cmd --zone=public --add-port=6800-7300/tcp --permanent

   If you have a separate cluster network, repeat the commands with the appropriate zone.

5. As root, on all object gateway nodes, open the relevant port or ports on the public network.

   1. To open the default port 7480:

      # firewall-cmd --zone=public --add-port=7480/tcp
      # firewall-cmd --zone=public --add-port=7480/tcp --permanent

      To limit access based on the source address, run the following commands:

      # firewall-cmd --zone=public \
      --add-rich-rule="rule family="ipv4" \
      source address="<IP-address>/<prefix>" \
      port protocol="tcp" port="7480" accept"
      # firewall-cmd --zone=public \
      --add-rich-rule="rule family="ipv4" \
      source address="<IP-address>/<prefix>" \
      port protocol="tcp" port="7480" accept" --permanent

   2. Optionally, as root, if you changed the default Ceph object gateway port, for example to port 80, open this port:

      # firewall-cmd --zone=public --add-port=80/tcp
      # firewall-cmd --zone=public --add-port=80/tcp --permanent

      To limit access based on the source address, run the following commands:

      # firewall-cmd --zone=public \
      --add-rich-rule="rule family="ipv4" \
      source address="<IP-address>/<prefix>" \
      port protocol="tcp" port="80" accept"
      # firewall-cmd --zone=public \
      --add-rich-rule="rule family="ipv4" \
      source address="<IP-address>/<prefix>" \
      port protocol="tcp" port="80" accept" --permanent

   3. Optionally, as root, to use SSL/TLS, open port 443:

      # firewall-cmd --zone=public --add-port=443/tcp
      # firewall-cmd --zone=public --add-port=443/tcp --permanent

      To limit access based on the source address, run the following commands:

      # firewall-cmd --zone=public \
      --add-rich-rule="rule family="ipv4" \
      source address="<IP-address>/<prefix>" \
      port protocol="tcp" port="443" accept"
      # firewall-cmd --zone=public \
      --add-rich-rule="rule family="ipv4" \
      source address="<IP-address>/<prefix>" \
      port protocol="tcp" port="443" accept" --permanent

1. As root, install the ntp package:

   # yum install ntp

2. As root, enable the NTP service to be persistent across a reboot:

   # systemctl enable ntpd

3. As root, start the NTP service and ensure it is running:

   # systemctl start ntpd
   # systemctl status ntpd

4. Ensure that NTP is synchronizing Ceph monitor node clocks properly:

   $ ntpq -p

1. Use the ssh command to log in to a Ceph node:

   $ ssh <user_name>@<hostname>

   Replace <hostname> with the host name of the Ceph node.

2. Create a new Ansible user and set a new password for this user:

   # adduser <username>
   # passwd <username>

3. Ensure that the user you added has the root privileges:

   # cat << EOF >/etc/sudoers.d/<username>
   <username> ALL = (root) NOPASSWD:ALL
   EOF

4. Ensure the correct file permissions:

   # chmod 0440 /etc/sudoers.d/<username>

1. Generate the SSH keys, but do not use sudo or the root user. Instead, use the Ansible user you created in Creating an Ansible User with Sudo Access. Leave the passphrase empty:

   $ ssh-keygen
   
   Generating public/private key pair.
   Enter file in which to save the key (/ceph-admin/.ssh/id_rsa):
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /ceph-admin/.ssh/id_rsa.
   Your public key has been saved in /ceph-admin/.ssh/id_rsa.pub.

2. Copy the key to each Ceph Node, replacing <username> with the user name you created in Creating an Ansible User with Sudo Access and <hostname> with a host name of a Ceph node:

   $ ssh-copy-id <username>@<hostname>

3. Modify or create (using a utility such as vi) the ~/.ssh/config file of the Ansible administration node so that Ansible can log in to Ceph nodes as the user you created without requiring you to specify the -u <username> option each time you execute the ansible-playbook command. Replace <username> with the name of the user you created and <hostname> with a host name of a Ceph node:

   Host node1
      Hostname <hostname>
      User <username>
   Host node2
      Hostname <hostname>
      User <username>
   Host node3
      Hostname <hostname>
      User <username>

   After editing the ~/.ssh/config file on the Ansible administration node, ensure the permissions are correct:

   $ chmod 600 ~/.ssh/config