Red Hat Training
A Red Hat training course is available for Red Hat Satellite
User Guide
Use and administration of Red Hat Network Satellite
Edition 2
Red Hat Engineering Content Services
Abstract
Preface
Chapter 1. User Administration
1.1. Adding, Deactivating, and Deleting User Accounts
Procedure 1.1. Adding Users
- In the Users tab, click Create new user to open the Create User page.
Figure 1.1. The Create User page
- In the Desired Login field, enter a name for the user. The login name must be at least five characters long.
- In the Desired Password field, enter a password for the user. Re-enter the same password to confirm.
- In the First, Last Name field, enter a first and last name for the user. Select a suitable prefix (for example: Mr, Miss, Mrs) from the drop-down menu.
- In the Email field, enter an email address for the user.
- In the Time Zone section, select an appropriate time zone.
- In the Interface Language section, select an appropriate language to be used in the RHN Satellite Server interface.
- Click Create Login to create the new user. An email will be sent to the user (using the address specified during creation) to inform them of the new account details.
- Once the account has been successfully created, you will be redirected to the User List page. To change permissions and set options for the new user, select their name from the displayed list to display the User Details page, and navigate to the appropriate tabs to make your changes.
Procedure 1.2. Deactivating Users
- Select the user's name from the list in the Users tab, to display the User Details page.
- Check to see if the user is a Satellite administrator.If the user is a Satellite administrator, uncheck the box next to that role, and click Submit.If the user is not a Satellite administrator, continue to the next step.
- Click Deactivate User.
Figure 1.2. Deactivating users
You will be asked to confirm this action, by clicking it again. Check the details, and then click Deactivate User again to confirm. - Once the account has been successfully deactivated, the user's name will not appear in the Active Users list. Click the Deactivated link from the User List menu to view deactivated user accounts.
- To reactivate the user account, view the Deactivated list, check the box next to the user to be reactivate, and click Reactivate.
Procedure 1.3. Deleting Users
Warning
- Select the user's name from the list in the Users tab, to display the User Details page.
- Check to see if the user is a Satellite administrator.If the user is a Satellite administrator, uncheck the box next to that role, and click Submit.If the user is not a Satellite administrator, continue to the next step.
- Click Delete User.
Figure 1.3. Deleting users
You will be asked to confirm this action, by clicking it again. Check the details, and then click Delete User again to confirm. - Once the account has been successfully deleted, the user's name will not appear in the Active Users list. This step is not reversible.
1.2. User Management
User Roles
- RHN Satellite Administrator
- A special role for Satellite administrative tasks such as creating organizations, managing subscriptions, and configuring global RHN Satellite Server settings.This role cannot be assigned on the User Details page. A user that already has the RHN Satellite Server administrator role can assign the role to another user by going to Admin → Users.
- Organization Administrator
- Performs management functions such as managing users, systems, and channels within the context of their organization. Organization administrators are automatically granted administration access to all other roles, which are signified as grayed-out checkboxes.
- Activation Key Administrator
- Performs activation key functions for such as creating, modifying, and deleting keys within the account.
- Channel Administrator
- Provides complete access to the software channels and related associations within the organization. Performs functions such as making channels globally subscribable, and creating new channels, and managing the packages within channels.
- Configuration Administrator
- Has complete access to the configuration channels and related associates within the organization. Performs channel and file management configuration functions in the organization.
- Monitoring Administrator
- Performs scheduling of probes and oversight of other monitoring infrastructure. This role is available only on RHN Satellite Servers with monitoring enabled.
- System Group Administrator
- This role has complete authority over the systems and system groups to which it is granted access. Performs administrative functions such as creating new system groups, deleting assigned system groups, adding systems to groups, and managing user access to groups.
Chapter 2. Automatic Synchronization
cron
.
Procedure 2.1. Automating Synchronization
- Switch to the root user, and open the
crontab
in a text editor:crontab -e
Note
Thecrontab
will open in vi by default. To change this behavior, change theEDITOR
variable to the name of the text editor you prefer. - In the
crontab
, use the first five fields (minute, hour, day, month, and weekday) to schedule the synchronization. To create a random synchronization time, use the following entry:0 1 * * * perl -le 'sleep rand 9000' && satellite-sync --email >/dev/null 2>1
Thiscrontab
entry will run the synchronization job randomly between 01:00 and 03:30. It will discardstdout
andstderr
fromcron
to prevent duplicating the messages fromsatellite-sync
. Other options can be included as needed. - To save the
crontab
, simply exit from the text editor. The newcron
rules will be put in to place immediately.
Chapter 3. Backup and Restore
3.1. Backups
Procedure 3.1. Backing up the Embedded Database
- Stop the RHN Satellite Server server using the
stop
command:rhn-satellite stop
- Switch to the Oracle user, and create the backup using the
db-control
utility:su - oracle db-control backup [directory]
Replace directory with the absolute path to the location where you want to store your database backup. The process will take several minutes. - Switch back to the root user, and start the Satellite:
exit rhn-satellite start
- Switch to the Oracle user, and use the
examine
option ofdb-control
to check the backup time stamp and to determine if there are any missing files:su - oracle db-control examine [directory]
You can also use theverify
option ofdb-control
to conduct a thorough review, which includes checking the md5sum of each of the files in the backup:db-control verify [directory]
If the verification is successful, the contents of directory are safe to be used to restore the database.
Note
Backing up System Files
/etc/sysconfig/rhn/
/etc/rhn/
/etc/sudoers
/etc/tnsnames.ora
/var/www/html/pub/
/var/satellite/redhat/[0-9]*/
(This is the location for any custom RPMs)/root/.gnupg/
/root/ssl-build/
/etc/dhcpd.conf
/etc/httpd/
/tftpboot/
/var/lib/cobbler/
/var/lib/nocpulse/
/var/lib/rhn/kickstarts/
/var/www/cobbler/
/var/satellite/
as well. This is a duplicate of the Red Hat RPM repository, and it will save a large download when recovering from a failure. It can be regenerated with the satellite-sync
tool. In the case of a disconnected satellite, /var/satellite/
must be backed up in order to be able to recover from failure.
satellite-sync
tool, and the /root/ssl-build/rhn-org-httpd-ssl-key-pair-MACHINE_NAME-VER-REL.noarch.rpm
package would need to be installed. Alternatively, you could reinstall the RHN Satellite Server without re-registering it. This can be achieved by canceling or skipping the Red Hat Network registration and SSL certificate generation sections.
3.2. Restore from Backup
Procedure 3.2. Restoring the Embedded Database from Backup
- Stop the RHN Satellite Server server using the
stop
command:rhn-satellite stop
- Switch to the Oracle user, and restore the backup using the
db-control
utility:su - oracle db-control restore [directory]
Replace directory with the absolute path to the location that contains the backup. This process will verify the contents of the backup before restoring the database. The process will take several minutes. - Switch back to the root user, and start the Satellite:
exit rhn-satellite start
- Regardless of whether you are backing up an external or embedded database, when the satellite is restored from a backup, the following command should be run to schedule the restoration of search indexes the next time the
rhn-search
service is started:/etc/init.d/rhn-search cleanindex
3.3. Automated Backups
cron
.
Procedure 3.3. Automating Backups
backup-db.sh
containing the following script. This script will stop the satellite, perform a database backup, and restart the satellite:
#!/bin/bash { /usr/sbin/rhn-satellite stop su - oracle -c' d=db-backup-$(date "+%F"); mkdir -p /tmp/$d; db-control backup /tmp/$d '; /usr/sbin/rhn-satellite start } &> /dev/null
- Create a new file called
move-files.sh
containing the following script. This script will usersync
to move the backup files to a directory to be stored:#!/bin/bash rsync -avz /tmp/db-backup-$(date "+%F") [destination] &> /dev/null
Replace [destination] with the path to the backup directory.Alternatively, the following script usesscp
to achieve the same goal:#!/bin/bash scp -r /tmp/db-backup-$(date "+%F") [destination] &> /dev/null
- Switch to the root user, and open the
crontab
in a text editor:crontab -e
Note
Thecrontab
will open in vi by default. To change this behavior, change theEDITOR
variable to the name of the text editor you prefer. - In the
crontab
, use the first five fields (minute, hour, day, month, and weekday) to schedule the backup scripts to run:0 3 * * * backup-db.sh 0 6 * * * move-files.sh
Thiscrontab
entry will run the backup at 03:00, and transfer the backup files at 06:00. Other options can be included as needed. You can also include a clean up script to remove older backup directories and prevent the backup storage from filling up. - To save the
crontab
, simply exit from the text editor. The newcron
rules will be put in to place immediately.
Chapter 4. Cloning a Machine
spacewalk-clone-by-date
allows RHN Satellite customers to create custom cloned Red Hat Enterprise Linux channels based on the date Errata was made available to the Red Hat Enterprise Linux system.
4.1. Features
spacewalk-clone-by-date
:
- Cloning the state of the channel as it was on a specific date
- Automating the cloning by scripts and template files
- Removing or blocking packages from channels
- Resolving package dependencies within the parent and child channels
- Filtering and acting on specific errata while ignoring others. For example, acting only on security errata and ignoring bugfixes and enhancements.
Note
spacewalk-clone-by-date
needs to be run as the root user and the username
needs to be either an Organizational Administrator or Channel Administrator.
4.2. Command Line Options
Table 4.1. Command Line Options Available
Option | Definition |
---|---|
-h, --help | Shows the help file. |
-c CONFIG, --config=CONFIG | Allows the user to supply a config file that has all the options specified. Any options that can be run on the command line can be specified in this config file. The config file allows users to set up a complex list of channels that they want cloned and save the exact commands for later use. |
-u USERNAME, --username=USERNAME | Specify the username to use to log in to the Satellite. |
-p PASSWORD, --password=PASSWORD | Specify the password for the username |
-s SERVER, --server=SERVER | Server URL to use for api connections. This defaults to https://localhost/rpc/api |
-l CHANNELS, --channels=CHANNELS | Specifies which channels to clone. Channel labels must be specified in original clone pairs. When specifying clone pairs, remember to separate them with spaces. Additional channels may be specified by using the --channels option more than once. |
-b BLACKLIST, --blacklist=BLACKLIST | Comma separated list of package names (or regular expressions) to exclude from cloned errata (Only added packages will be considered). |
-r REMOVELIST, --removelist=REMOVELIST | Comma separated list of package names (or regular expressions) to remove from destination channel (All packages are available for removal). |
-d TO_DATE, --to_date=TO_DATE | Clone errata to the specified date (YYYY-MM-DD). Allows the user to clone the original packages and any specific errata released from the creation of the original channel until the specified TO_DATE parameter. A time-based snapshot of the channel during the specified TO_DATE can be obtained. |
-y, --assumeyes | Assume yes for any prompts that come up. This is used for unattended cloning. |
-m, --sample-config | Print a sample full configuration file and exit. |
-k, --skip_depsolve | Skip all dependency solving (Not recommended). |
-v, --validate | Run repoclosure on the set of specified repositories. |
-g, --background | Clone the errata in the background. Prompt will return quicker; before cloning is finished. |
-o, --security_only | Only clone security errata (and their dependencies).This command can be used in conjunction with the --to_date command to only clone security errata released before or on the specified date. |
4.3. Example Usage
rhel-i386-server-5
channel as it is on January 1st, 2012, into the channel named my-clone-RHEL-5.
# spacewalk-clone-by-date --username=your_username --password=your_password --server=satellite_server_url --channels=rhel-i386-server-5 my-clone-RHEL-5 --to_date=2012-01-01
# spacewalk-clone-by-date --username=your_username --password=your_password --server=satellite_server_url --channels=rhel-i386-server-5 my-clone-RHEL-5 --to_date=2012-01-01 --security_only --background --blacklist=kernel,vim-extended --assumeyes
Chapter 5. Monitoring
Procedure 5.1. Monitoring Tablespace
- In Oracle databases, it is important to regularly check that the tablespaces have sufficient free space. Do this by switching user to the
Oracle
user, and issuing thedb-control report
command:su - oracle db-control report Tablespace Size Used Avail Use% DATA_TBS 4.8G 3.9G 996M 80% SYSTEM 250M 116M 133M 46% TOOLS 128M 3M 124M 2% UNDO_TBS 1000M 61M 938M 6% USERS 128M 64K 127M 0%
- If a tablespace is becoming full, it can be extended using the
db-control extend
command with the name of the tablespace to be extended:db-control extend tablespace
Procedure 5.2. Monitoring RHN Satellite Server Processes
- Verify that the Satellite processes are working using the
rhn-satellite status
command:rhn-satellite status
Chapter 6. OpenSCAP
6.1. OpenSCAP Features
- A tool to verify a system confirms to a standardRHN Satellite Server has integrated OpenSCAP as an auditing feature from version 5.5. It allows you to schedule and view compliance scans for the system through the web interface.
- SCAP contentSCAP content can be created from scratch if you have an understanding of at least XCCDF or OVAL. Alternatively, another option exists. XCCDF content is frequently published online under open source licenses and this content may be customized to suit your needs instead.
Note
Red Hat supports the use of templates to evaluate your systems. However, custom content authoring of these templates is not supported.Some examples of these groups are:- The United States Government Configuration Baseline (USGCB) for RHEL5 Desktop — Official SCAP content for desktops within federal agencies that has been developed at NIST in collaboration with Red Hat, Inc. and the United States Department of Defense (DoD) using OVAL.
- Community-provided content
- SCAP Security Guide for RHEL6 — Active community-run content that sources from the USGCB requirements and widely-accepted policies and contains profiles for desktop, server, and ftp server.
- OpenSCAP Content for RHEL6 — The openscap-content package from the Red Hat Enterprise Linux 6 Optional Channel also provides default content guidance for Red Hat Enterprise Linux 6 systems via a template.
6.2. OpenSCAP in RHN Satellite
6.2.1. Prerequisites
SCAP requires these packages:
- For the Server: RHN Satellite 5.5
- For the Client: spacewalk-oscap package (available from the RHN Tools Child Channel)
A Management entitlement is required for scheduling scans.
For the Client: Distributing the XCCDF content to client machines
- Traditional Methods (CD, USB, nfs, scp, ftp)
- Satellite Scripts
- RPMsCustom RPMs are the recommended way to distribute SCAP content to other machines. RPM packages can be signed and verified to ensure their integrity. Installation, removal, and verification of RPM packages can be managed from the user interface.
6.2.2. Performing Audit Scans
Procedure 6.1. Scans via the Web Interface
- Log in to the Satellite web interface.
- Click on Systems → Target System.
- Click on Audit → Schedule
- Fill in the
Schedule New XCCDF Scan
form:- Command-line Arguments: Additional arguments for the oscap tool can be added into this field. There are only two command line arguments that are permitted. These are:
--profile PROFILE
— Selects a particular profile from the XCCDF document. Profiles are determined by the XCCDF xml file and can be checked using theProfile id
tag. For example:Profile id="RHEL6-Default"
Note
Certain versions of OpenSCAP need the --profile command-line argument or the scan will fail.--skip-valid
— Do not validate input/output files. Users without a well-formed XCCDF content may choose to use this to bypass the file validation process.If no command-line argument is passed, it will use the default profile. - Path to XCCDF Document: This is a required field. The
path
parameter points to the content location on the client system. For example:/usr/local/scap/dist_rhel6_scap-rhel6-oval.xml
Warning
The xccdf content is validated before it is run on the remote system. Specifying invalid arguments can make spacewalk-oscap fail to validate or run. Due to security concerns the 'osccap xccdf eval' command only accepts a limited set of parameters.
- Run the
rhn_check
to ensure that the action is being picked up by the client system.rhn_check -vv
Note
Alternatively, ifrhnsd
orosad
are running on the client system, the action will be picked up by these services. To check if they are running:service rhnsd start
orservice osad start

Figure 6.1. Scheduling a Scan via Web UI
Procedure 6.2. Scans via API
- Choose an existing script or create a script for scheduling a system scan through
system.scap.scheduleXccdfScan
, the front end API.Example Script:#!/usr/bin/python client = xmlrpclib.Server('https://spacewalk.example.com/rpc/api') key = client.auth.login('username', 'password') client.system.scap.scheduleXccdfScan(key, 1000010001, '/usr/local/share/scap/usgcb-rhel5desktop-xccdf.xml', '--profile united_states_government_configuration_baseline')
Where:- 1000010001 is the
system ID (sid)
. /usr/local/share/scap/usgcb-rhel5desktop-xccdf.xml
is the path parameter that points to the content location on the client system. In this case, it assumes USGSB content in the/usr/local/share/scap
directory.--profile united_states_government_configuration_baseline
represents the additional argument for the oscap tool. In this case, it is using the USCFGB.
- Run the script on the command-line interface of any system. The system needs the appropriate python and xmlrpc libraries installed.
- Run the
rhn_check
to ensure that the action is being picked up by the client system.rhn_check -vv
Note
Alternatively, ifrhnsd
orosad
are running on the client system, the action will be picked up by these services. To check if they are running:service rhnsd start
orservice osad start
6.2.3. How to View SCAP Results
- Via the web interface. Once the action has been executed, the results should show up on the system's Audit Tab. This page is discussed in Section 6.2.4, “OpenSCAP Satellite Pages”.
- Via the API functions in handler
system.scap
. - Via the Satellite's
spacewalk-reports
tool by running these commands:# /usr/bin/spacewalk-reports system-history-scap # /usr/bin/spacewalk-reports scap-scan # /usr/bin/spacewalk-reports scap-scan-results
6.2.4. OpenSCAP Satellite Pages
6.2.4.1. Audit
- Audit → All Scans
- All Scans is the default page that appears when the Audit tab is chosen. This page displays all completed OpenSCAP scans which the viewer has permission to see. Permissions for scans derive from system permissions.
Figure 6.2. Audit ⇒ All Scans
For each scan, the following information is displayed:- System
- the scan's targeted system
- XCCDF Profile
- the evaluated profile
- Completed
- time of completion
- Satisfied
- number of rules satisfied/passed. A rule is considered to be satisfied if the result is the evaluation is either Pass or Fixed.
- Dissatisfied
- number of rules dissatisfied/failed. A rule is considered to be dissatisfied if the result of the evaluation is a Fail.
- Unknown
- number of rules which failed to evaluate. A rule is considered to be Unknown if the result of the evaluation is an Error, Unknown or Not Checked.
The evaluation of XCCDF rules may also return statuses like Informational, Not Applicable, or not Selected. In such cases, the given rule is not included in the statistics on this page. See System Details → Audit for information on those. - Audit → XCCDF Diff
- XCCDF Diff is an application which visualizes the comparison of two XCCDF scans. It shows metadata for two scans as well as the lists of results.
Figure 6.3. Audit ⇒ XCCDF Diff
You can access thediff
of similar scans directly by clicking on icon at the List Scans page or you candiff
arbitrary scans by specifying their id.Items that show up in only one of the compared scans are considered to be "varying". Varying items are always highlighted in beige. There are three possible comparison modes: Full Comparison which shows all the scan items, Only Changed Items which shows items that have changed, and finally Only Invariant Items which shows unchanged or similar items. - Audit → Advanced Search
- The Search page allows you to search through your scans according to specified criteria, including:
- rule results
- targeted machine
- time frame of the scan
Figure 6.4. Audit ⇒ Advanced Search
The search either returns a list of results or list of scans which are included in the results.
6.2.4.2. Systems → System Details → Audit
- Systems → System Details → Audit → List Scans
Figure 6.5. Systems ⇒ System Details ⇒ Audit ⇒ List Scans Scan Results
This subtab lists a summary of all scans completed on the system. The columns are as follows:Table 6.1. OpenSCAP Scan Labels
Column Label Definition XCCDF Test Result The scanned test result name which provides a link to the detailed results of the scan. Completed The exact time the scan finished Compliance The unweighted pass/fail ratio of compliance based on the Standard used P Number of Checks that Passed F Number of Checks that Failed E Errors experienced in the Scan U Unknown N Not applicable to the machine K Not checked S Not Selected I Informational X Fixed Total Total number of checks Each line starts with an icon indicating the results of a comparison to a previous similar scan. The icons indicate that in the newer scan there is either:— no difference compared to the previous scan
— arbitrary differences
— major differences, either there are more failures than the previous scan or less passes
— no comparable scan was found, therefore, no comparison was made.
- Systems → System Details → Audit → Scan Details
- This page contains the results of a single scanning. It can be divided into two parts:
- Details of the XCCDF ScanThe details of the scan gives you:
- the general information of the file path
- what command-line arguments were used
- who scheduled it
- what is the benchmark identifier and version
- the Profile Identifier
- the Profile Title
- when it was started and completed
- any error output.
- XCCDF Rule ResultsThe rule results provide the full list of XCCDF rule identifiers, identifying tags and the result for each of these rule results. This list can be filtered by a specific result.
- Systems → System Details → Audit → Schedule
- This subtab is where new scans can be scheduled. Additional command line arguments can be provided, along with the path to the XCCDF document on the system which is being scanned. Based on the "
Schedule no sooner than
" parameter, the scan will be performed at the system's next scheduled check-in with the Satellite Server. For more information about how to schedule via the Satellite web interface, refer to Procedure 6.1, “Scans via the Web Interface” in this chapter.
Chapter 7. PAM Authentication
Procedure 7.1. Setting up PAM authentication
- Ensure you have the latest version of the
selinux-policy-targeted
package:# yum update selinux-policy-targeted
- Set the
allow_httpd_mod_auth_pam
SELinux boolean to on:# setsebool -P allow_httpd_mod_auth_pam 1
- Open the
/etc/rhn/rhn.conf
file in your preferred text editor, and add the following line. This will create a PAM service file at/etc/pam.d/rhn-satellite
:pam_auth_service = rhn-satellite
- To set up authentication, open the
/etc/pam.d/rhn-satellite
service file in your preferred text editor, and add the appropriate rules. For more detail about configuring PAM, refer to the Pluggable Authentication Modules (PAM) in the Red Hat Enterprise Linux Deployment Guide.
Note
Example 7.1. Using PAM with Kerberos on a Red Hat Enterprise Linux 5 i386 system
/etc/pam.d/rhn-satellite
service file in your preferred text editor, and add the following rules:
#%PAM-1.0 auth required pam_env.so auth sufficient pam_krb5.so no_user_check auth required pam_deny.so account required pam_krb5.so no_user_check
kpasswd
. Do not change the password on the RHN website as this method will only change the local password on the Satellite server. Local passwords are not in use if PAM is enabled for that user.
Example 7.2. Using PAM with LDAP
/etc/pam.d/rhn-satellite
service file in your preferred text editor, and add the following rules:
#%PAM-1.0 auth required pam_env.so auth sufficient pam_ldap.so no_user_check auth required pam_deny.so account required pam_ldap.so no_user_check
Chapter 8. RPMs
rpm-build
package must be installed on the build system as a minimum requirement. Additional packages such as compilers and libraries may also be needed.
Procedure 8.1. Creating a GPG Key
Important
- Make a directory for creating the key:
mkdir -p ~/.gnupg
- Generate the key pair:
gpg --gen-key
You will need to select the kind of key, the keysize, and how long the key should be valid for (press enter to accept the default values). You will also need to specify a name, comment, and email address:Real name: rpmbuild Email address: rpmbuild@example.com Comment: this is a comment You selected this USER-ID: "rpmbuild (this is a comment) <rpmbuild@example.com>" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?
Press O to accept the details and continue. - List all keys with their fingerprints:
gpg --list-keys --fingerprint
- Export the keys:
gpg --export --armor "rpmbuild <rpmbuild@example.com>" > EXAMPLE-RPM-GPG-KEY
- Import the key to the RPM database to allow RPM origin and integrity verification by running the
gpg --import
as root on all target systems:rpm --import EXAMPLE-RPM-GPG-KEY
This will occur automatically during client installations, and should not need to be run manually. - Once an RPM has been created it can be signed with the GPG key and uploaded to the correct channel:
rpm --resign package.rpm rhnpush --server=http[s]://satellite.server/APP package.rpm --channel=custom-channel-name
- To verify an RPM package, navigate to the directory that contains the package, and run the following commands:
rpm –qip package.rpm rpm -K package.rpm
Procedure 8.2. Building RPMs
- Create a non-privileged user account called
rpmbuild
for building packages. This will allow several administrators to share the build environment and the GPG key. - In the home directory for the
rpmbuild
user,/home/rpmbuild
, create a file called.rpmmacros
:touch /home/rpmbuild/.rpmmacros
- Open the
.rpmmacros
file in your preferred text editor, and add the following lines. The_gpg_name
must match the name for the GPG key used for signing RPMs:%_topdir %(echo $HOME)/rpmbuild %_signature %gpg %_gpg_name rpmbuild <rpmbuild@example.com>
The directory listing for the defined top level directory (/home/rpmbuild/rpmbuild
in the example above) must have the same directory layout that is present under/usr/src/redhat
.
Example 8.1. RPM Specification File
SPECS
directory under the _topdir
as defined in user's .rpmmacros
file. The corresponding source and patch files should be located in the SOURCES
directory.
Name: foo Summary: The foo package does foo Version: 1.0 Release: 1 License: GPL Group: Applications/Internet URL: http://www.example.org/ Source0 : foo-1.0.tar.gz Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root Requires: pam BuildPrereq: coreutils %description This package performs the foo operation. %prep %setup -q %build %install mkdir -p %{buildroot}/%{_datadir}/%{name} cp -p foo.spec %{buildroot}/%{_datadir}/%{name} %clean rm -fr %{buildroot} %pre # Add user/group here if needed %post /sbin/chkconfig --add food %preun if [ $1 = 0 ]; then # package is being erased, not upgraded /sbin/service food stop > /dev/null 2>&1 /sbin/chkconfig --del food fi %postun if [ $1 = 0 ]; then # package is being erased # Any needed actions here on uninstalls else # Upgrade /sbin/service food condrestart > /dev/null 2>&1 fi %files %defattr(-,root,root) %{_datadir}/%{name} %changelog * Mon Jun 16 2003 Some One <one@example.com> - fixed the broken frobber (#86434)
Chapter 9. Boot Devices
boot.iso
is a required prerequisite for creating boot devices. Make sure that this is available somewhere on the system and take note of its location.
Procedure 9.1. CD Boot Media
Note
\
" is used below to represent a continuation of one line at the shell prompt.
- Create a working directory for the boot image:
mkdir -p temp cd/isolinux
- Mount the boot image to the
temp
directory:mount -o loop boot.iso temp
- Copy the required files for a CD Boot Media device to the previously created directory:
cp -aP temp/isolinux/* cd/isolinux/
- Unmount the
temp
directory and change the permissions on thecd
directory to be readable and writable to the user:umount temp chmod -R u+rw cd
- Change to the
./cd
directory:cd ./cd
- Copy the
/usr/lib/syslinux/menu.c32
file to the CD:cp -p /usr/lib/syslinux/menu.c32 isolinux
- Open the
isolinux/isolinux.cfg
file in your preferred text editor, and add the following line:mkisofs -o ./custom-boot.iso -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot \ -boot-load-size 4 -boot-info-table -J -l -r -T -v -V "Custom RHEL Boot" .
- Customize any boot parameters and targets in
isolinux.cfg
as needed for CD booting. - Burn the details to the CD to complete the procedure.
Procedure 9.2. PXE Boot
- Create a working directory for the boot image:
mkdir -p temp pxe/pxelinux.cfg
- Mount the boot image to the
temp
directory:mount -o loop boot.iso temp
- Copy the required files for a PXE Boot device to the previously created directory:
cp -aP temp/isolinux/* pxe/
- Unmount the
temp
directory and change the permissions on thecd
directory to be readable and writable to the user:umount temp chmod -R u+rw pxe
- Change to the
/pxe
directory:cd ./pxe
- Copy the
/usr/lib/syslinux/menu.c32
file to the/pxe
directory:cp -p /usr/lib/syslinux/menu.c32 .
- Move the
isolinux.cfg
file topxelinux.cfg/default
:mv isolinux.cfg pxelinux.cfg/default
- Remove the temporary files:
rm -f isolinux.bin TRANS.TBL
- Copy the
/usr/lib/syslinux/pxelinux.0
file to the/pxe
directory:cp -p /usr/lib/syslinux/pxelinux.0 .
- Open the
pxelinux.cfg/default
file in your preferred text editor, and customize any boot parameters and targets as needed for PXE booting.
Procedure 9.3. USB Boot Media
Warning
/dev/loop0
for mounting, make sure you use the correct device for your system. You can check which is the correct device using the losetup -f
command.
- Create a working directory for the boot image:
mkdir -p temp usb/extlinux
- Mount the boot image to the
temp
directory:mount -o loop boot.iso temp
- Copy the required files for a USB Media Boot device to the previously created directory:
cp -aP temp/isolinux/* usb/extlinux/
- Unmount the
temp
directory and change the permissions on thecd
directory to be readable and writable to the user:umount temp chmod -R u+rw usb
- Change to the
/usb
directory:cd ./usb
- Copy the
/usr/lib/syslinux/menu.c32
file to theextlinux/
directory:cp -p /usr/lib/syslinux/menu.c32 extlinux/
- Move the
extlinux/isolinux.cfg
file toextlinux/extlinux.conf
:mv extlinux/isolinux.cfg extlinux/extlinux.conf
- Remove the temporary files:
rm -f extlinux/isolinux.bin extlinux/TRANS.TBL
- Convert the
custom-boot.img
file and copy it:dd if=/dev/zero of=./custom-boot.img bs=1024 count=30000
- Discover the correct mounting location for the loopback device:
losetup -f /dev/loop0
Set up the loopback device with the boot image:losetup /dev/loop0 ./custom-boot.img
- Open the
fdisk
utility:fdisk /dev/loop0
Create one primary bootable partition on the device. This can be done by using the following key press combination: n p 1 Enter Enter a 1 p w - Copy the master boot record (MBR) to the loopback device:
dd if=/usr/lib/syslinux/mbr.bin of=/dev/loop0
- Add partition maps to the loopback device:
kpartx -av /dev/loop0
- Create the file system:
mkfs.ext2 -m 0 -L "Custom RHEL Boot" /dev/mapper/loop0p1
- Mount the device:
mount /dev/mapper/loop0p1 temp
- Delete temporary files:
rm -rf temp/lost+found
- Copy the
extlinux/
directory to a temporary location:cp -a extlinux/* temp/
- Install the bootloader in the temporary location:
extlinux temp
- Unmount the temporary location:
umount temp
- Delete the partition maps on the loopback device:
kpartx -dv /dev/loop0
- Delete the loopback device:
losetup -d /dev/loop0
Synchronize the file system changes:sync
- Open the
extlinux.conf
file in your preferred text editor, and customize any boot parameters and targets as needed for USB booting. - Transfer the image to a USB device to complete the procedure. Insert the device, and run the
dmesg
command to check the mounting location. In this example, it is/dev/sdb
.Unmount the USB device:umount /dev/sdb
Copy the image to the USB device:dd if=./custom-boot.img of=/dev/sdb
Chapter 10. Organizations

Figure 10.1. Admin
10.1. Creating Organizations
Procedure 10.1. Creating an Organization
- To create a new organization, open the Admin menu, and select Organizations => Create New Organization.
Figure 10.2. Create New Organization
- Type the organization name into the appropriate text box. The name should be between 3 and 128 characters.
- Create an administrator for the organization, by providing the following information:
- Enter a Desired Login for the organization administrator, which should be between 3 and 128 characters long. Consider creating a descriptive login name for the Organization Administrator account that matches administrative login names with the organization.
- Create a Desired Password and Confirm the password.
- Type in the Email address for the organization administrator.
- Enter the First Name and Last Name of the organization administrator.
- Click the Create Organization button to complete the process.
organization 1
Organization Administrator account for themselves. This will give them the ability to log in to the organization if required.
Important
10.2. Managing Entitlements
rhel-server
or rhn-tools
, for systems that use channels other than custom channels. Management system entitlements are a base requirement for an organization to function correctly. The number of management entitlements allocated to an organization is equivalent to the maximum number of systems that can register to that organization on the RHN Satellite, regardless of the number of software entitlements available. For example, if there are 100 Red Hat Enterprise Linux Client entitlements available in total, but only 50 management system entitlements are available to the organization, only 50 systems are able to register to that organization.
rhn-virtualization
package, which is necessary for the entitlements of Xen and KVM virtual guests to be counted correctly.
Note
- Total: The total number of channel entitlements for the Satellite.
- Available: The number of entitlements currently available for allocation.
- Usage: The number of entitlements currently in use by all organizations, compared to the total number of entitlements allocated.
organization 1
) out of the 30 that have been allocated.
- Active Users: The number of users in the organization
- Systems: The number of systems subscribed to the organization.
- System Groups: The number of groups subscribed to the organization.
- Activation Keys: The number of activation keys available to the organization.
- Kickstart Profiles: The number of kickstart profiles available to the organization.
- Configuration Channels: The number of Configuration Channels available to the organization.
10.3. Configuring Systems in an Organization
- Registering with username and password
- If you provide a username and password created for a specified organization, the system will be registered to that organization. For example, if
user-123
is a member of the Central IT organization on the Satellite, the following command on any system would register that system to the Central IT organization on your Satellite:rhnreg_ks --username=user-123 --password=foobar
Note
The--orgid
parameters inrhnreg_ks
are not related to Satellite registration or RHN Satellite's multiple organizations support. - Registering with an activation key
- You can also register a system using an activation key from the organization. Activation keys will register systems to the organization in which the activation key was created. Activation keys are a good registration method to use if you want to allow users to register systems into an organization without providing them login access to that organization:
rhnreg_ks --activationkey=21-myactivationkey
To move systems between organizations, the move can also be automated with scripts using the activation keys.Note
The first few characters of the activation key are used to indicate the ID number of the organization that owns the key.
10.4. Users of an Organization
Note
10.5. Organizational Trusts

Figure 10.3. Organizational Trusts
Procedure 10.2. Establishing an Organizational Trust
- Select Organizations link on the menu on the Admin main page.
- Click the name of one of the organizations and within the Details page, click the Trusts tab.
- On the Trusts tab, there is a listing of all the other trusts on the RHN Satellite. If you have a long list of organizations, use the Filter by Organization text box to sort them.
- Click the checkbox next to the names of the organizations you want to be in the organizational trust with the current organization.
- Click the Modify Trusts button to create the trust.
- Private
- Make the channel private so that it cannot be accessed by any organizations except the owning organization.
- Protected
- Allow the channel to be accessed by specific trusted organizations of your choice.
- Public
- Allow all organizations within the trust to access the custom channel.
- The Satellite Administrator removes the trust relationship
- The Organization Administrator changes channel access to private
- The Organization Administrator changes channel access to private and does not include the subscribed system's organization in the protected list
- The Organization Administrator deletes the shared channel directly
- The Organization Administrator deletes the parent channel of a shared child channel
Note
Procedure 10.3. Migrating Systems
migrate-system-profile
utility. The utility is executed from the command line, and uses systemID
and orgID
to specify the system migration and its destination organization. The Satellite Administrator can migrate a system from any trusted organization to any other in the trust. However, Organization Administrators can only migrate a system from their own organization to another in the trust.
migrate-system-profile
command requires the spacewalk-utils
package to be installed, which is usually installed by default with RHN Satellite. When an organization migrates a system with the migrate-system-profile
command, the system does not carry over any of the previous entitlements or channel subscriptions from the source organization. However, the system's history is preserved, and can be accessed by the new Organization Administrator in order to simplify the rest of the migration process, which includes subscribing to a base channel and granting entitlements.
- Execute the command using the following format:
migrate-system-profile --satellite SATELLITE HOSTNAME OR IP --systemId=SYSTEM ID --to-org-id=DESTINATION ORGANIZATION ID
For example, the Finance department (created as an organization in RHN Satellite withOrgID 2
) wants to migrate a workstation (withSystemID 10001020
) from the Engineering department, but the Finance Organization Administrator does not have shell access to the RHN Satellite server. The RHN Satellite hostname is satserver.example.com. The Finance Organization Administrator would type the following from a shell prompt:migrate-system-profile --satellite satserver.example.com --systemId=10001020 --to-org-id=2
The utility then prompts for a username and password. - The system can then be viewed from the Systems page when logged into the RHN Satellite web interface. The migration process is completed by assigning a base channel and granting entitlements to the client for any other system registered to the organization, available from the system's History page in the Events tab.
Figure 10.4. System History
- Satellite Administrators that need to migrate several systems at once can use the
--csv
option ofmigrate-system-profile
to automate the process using a simple comma-separated list of systems to migrate.A line in the CSV file should contain the ID of the system to be migrated as well as destination organization's ID in the following format:systemId,to-org-id
ThesystemId
, for example could be1000010000
, while theto-org-id
could be3
. An example CSV would look like the following:1000010000,3 1000010020,1 1000010010,4
Appendix A. Revision History
Revision History | |||||||||
---|---|---|---|---|---|---|---|---|---|
Revision 3-5.401 | Thu Aug 20 2015 | Dan Macpherson | |||||||
| |||||||||
Revision 3-5.400 | 2013-10-31 | Rüdiger Landmann | |||||||
| |||||||||
Revision 3-5 | Wed Sept 19 2012 | Dan Macpherson | |||||||
| |||||||||
Revision 3-4 | Fri Aug 31 2012 | Athene Chan | |||||||
| |||||||||
Revision 3-3 | Fri Aug 24 2012 | Athene Chan | |||||||
| |||||||||
Revision 3-3 | Fri Aug 24 2012 | Athene Chan | |||||||
| |||||||||
Revision 3-2 | Fri Aug 24 2012 | Athene Chan | |||||||
| |||||||||
Revision 3-1 | Fri Aug 17 2012 | Athene Chan | |||||||
| |||||||||
Revision 3-0 | Thu Aug 9 2012 | Athene Chan | |||||||
| |||||||||
Revision 2-5 | Wed Aug 1 2012 | Athene Chan | |||||||
| |||||||||
Revision 2-0 | Fri Jul 6 2012 | Athene Chan | |||||||
| |||||||||
Revision 1-5 | Mon Aug 15 2011 | Lana Brindley | |||||||
| |||||||||
Revision 1-4 | Mon Jun 20 2011 | Lana Brindley | |||||||
| |||||||||
Revision 1-3 | Mon Jun 20 2011 | Lana Brindley | |||||||
| |||||||||
Revision 1-2 | Wed Jun 15 2011 | Lana Brindley | |||||||
| |||||||||
Revision 1-1 | Fri May 27 2011 | Lana Brindley | |||||||
| |||||||||
Revision 1-0 | Fri May 6, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-15 | Thu May 5, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-14 | Mon May 2, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-13 | Fri Apr 29, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-12 | Mon Apr 18, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-11 | Mon Apr 18, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-10 | Mon Apr 18, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-9 | Thu Apr 14, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-8 | Wed Apr 13, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-7 | Wed Mar 23, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-6 | Mon Feb 19, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-5 | Fri Feb 18, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-4 | Mon Jan 10, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-3 | Fri Jan 7, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-2 | Wed Jan 5, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-1 | Tue Jan 4, 2011 | Lana Brindley | |||||||
| |||||||||
Revision 0-0 | Tue Dec 21, 2010 | Lana Brindley | |||||||
|
Index
A
- add
- API
- audit scans, Performing Audit Scans
- audit scans, Performing Audit Scans
- OpenSCAP, Performing Audit Scans
- auditing
- OpenSCAP, OpenSCAP
C
- Cloning a Machine
- spacewalk-clone-by-date, Cloning a Machine
D
- deactivate
- delete
- user (RHN Satellite Server only), Adding, Deactivating, and Deleting User Accounts
E
- email address
- changing, User Management
F
- features, OpenSCAP Features
O
- OpenSCAP, OpenSCAP, OpenSCAP Features, Prerequisites, Performing Audit Scans
P
- PAM authentication
- implementation, PAM Authentication
- password
- changing, User Management
- Prerequisites
- OpenSCAP, Prerequisites
S
- Satellite Administrator, User Management
- spacewalk-clone-by-date, Cloning a Machine
U
- user
- add, Adding, Deactivating, and Deleting User Accounts
- deactivate, Adding, Deactivating, and Deleting User Accounts
- delete (RHN Satellite Server only), Adding, Deactivating, and Deleting User Accounts
- user roles, User Management
- users, User Administration
- changing email address, User Management
- changing password, User Management
- roles, User Management
W
- Web UI
- audit scans, Performing Audit Scans
- website
- Users, User Administration