10.3. Post-installation Tasks

After Satellite has been upgraded, optionally configure the installation to be compliant with FIPS 140-2 standard, and remove unused versions of Java runtime. You can choose to complete either, or both tasks, depending on your requirements.

10.3.1. Configuring for FIPS 140-2 Compliance

Red Hat Satellite 5.7 introduced support for Federal Information Processing Standard (FIPS) 140-2, which is a US Government standard for accrediting cryptographic modules. This support includes the following changes:
  • User passwords, previously encrypted with MD5 method, will be encrypted with SHA-256 algorithm
  • Client certificates (/etc/sysconfig/rhn/systemid), which the registered systems use to authenticate with the parent server, are changed from MD5 to SHA-256 encryption
New Red Hat Satellite installations on FIPS 140-2 enabled systems do not require any manual changes. Satellite will use FIPS 140-2 standards automatically.
However, if upgrading a system and you intend to enable FIPS 140-2, you must first update existing user passwords and client certificates using MD5 encryption.

Procedure 10.7. Updating User Passwords

  1. Export a list of users with MD5-encrypted passwords:
    # spacewalk-report users-md5 > users-md5.csv
  2. Change the password of each user using the following for loop:
    # for i in $(cat users-md5.csv | awk -F, 'NR>1 { print $4 }'); do
          echo "Changing password for user $i";
          satpasswd $i;
    Alternatively, instruct all users in the file users-md5.csv to log into Satellite's Web UI. Satellite will automatically change their passwords in the database to use SHA-256.

Procedure 10.8. Updating Client Certificates

  1. Export a list of client systems using certificates using MD5-encryption:
    # spacewalk-report system-md5-certificates > system-md5-certificates.csv
  2. Use the spacewalk-fips-tool to schedule an update of systems in an organization. You need to repeat this process for each organization in your Satellite environment. First use the following commands for organization with ID 1:
    # ORG_ID=1
    # for system in $(awk -F, "NR>1 { if (\$3 == $ORG_ID) print \$1 }" system-md5-certificates.csv); do systems="$systems $system"; done
    # spacewalk-fips-tool -i -u admin -d "2014-12-01 14:00:00" -o /tmp/scheduled-installations.csv $systems
    This schedules the installation of packages requires for the certificate update on December 1, 2014 at 2pm.
    Next, Either run rhn_check -v on each client or wait until osad picks up the event.
    Finally, use the spacewalk-fips-tool again to schedule an update of certificates:
    # ORG_ID=1
    # for system in $(awk -F, "NR>1 { if (\$3 == $ORG_ID) print \$1 }" system-md5-certificates.csv); do systems="$systems $system"; done
    # spacewalk-fips-tool -c -u admin -d "2014-12-01 14:00:00" -o /tmp/scheduled-installations.csv $systems
  3. Repeat this process for each organization ID.
Once the passwords and client certificates are updated, enable FIPS 140-2 on your Satellite server's operating system.

10.3.2. Removing Redundant Java Versions

The Satellite upgrade process includes upgrades to several prerequisites, including the Java runtime. The previous versions of Java runtime remain installed, but are redundant. If you would prefer to reclaim the disk space occupied by these versions, remove the packages.
For example, on a Satellite 5.8 installation which had been upgraded from Satellite 5.6, the following Java runtime packages could be removed.
# yum remove java-1.6.0-ibm java-1.7.1-ibm