Procedure 2.1. To Download Satellite Server on a Certificate-managed System:

1. List all the available subscriptions to find the correct Red Hat Satellite and Red Hat Enterprise Linux product to allocate to your system:

   # subscription-manager list --available --all

   This command displays output similar to the following:

   +-------------------------------------------+
       Available Subscriptions
   +-------------------------------------------+
   
   Subscription Name: Red Hat Satellite Subscription
   Provides:          Red Hat
                      Red Hat Satellite Capsule 6
                      Red Hat Enterprise Linux 7
                      Red Hat Satellite 6
   SKU:               SKU123456
   Pool ID:           e1730d1f4eaa448397bfd30c8c7f3d334bd8b
   Available:         6
   Suggested:         1
   Service Level:     Self-Support
   Service Type:      L1-L3
   Multi-Entitlement: No
   Ends:              01/01/2022
   System Type:       Physical
   

   Note

   The SKU and Pool ID depend on the Red Hat Satellite product type that corresponds to your system version and product type. Take note of the pool IDs for Red Hat Satellite 6.1, Red Hat Enterprise Linux and Red Hat Software collections that correspond to your system version and product type.
2. Attach a subscription to the registered system:

   # subscription-manager subscribe --pool=Red_Hat_Satellite_Pool_Id \
   && subscription-manager subscribe --pool=Red_Hat_Enterprise_Linux_Pool_Id \
   && subscription-manager subscribe \
   --pool=Red_Hat_Enterprise_Linux_Software_Collections_Pool_Id

3. Disable all existing repositories:

   # subscription-manager repos --disable "*"

4. Enable the Red Hat Satellite and Red Hat Enterprise Linux and Red Hat Software Collections repositories. Ensure the Red Hat Enterprise Linux repository matches the specific version you are using.
   For Red Hat Enterprise Linux 6:

   # subscription-manager repos --enable rhel-6-server-rpms \
   --enable rhel-server-rhscl-6-rpms \
   --enable rhel-6-server-satellite-6.1-rpms
   

   For Red Hat Enterprise Linux 7:

   # subscription-manager repos --enable rhel-7-server-rpms \
   --enable rhel-server-rhscl-7-rpms \
   --enable rhel-7-server-satellite-6.1-rpms
   

   Note

   The commands above are based on Red Hat Enterprise Linux 6 and 7. If you are using a different version of Red Hat Enterprise Linux, change the repository based on your specific version.
5. If required, to verify what repositories have been enabled, use the yum repolist enabled command. For example, on Red Hat Enterprise Linux 7:

   # yum repolist enabled
   Loaded plugins: product-id, subscription-manager
   repo id                                        repo name                                                                   status
   !rhel-7-server-rpms/x86_64                     Red Hat Enterprise Linux 7 Server (RPMs)                                    9,889
   !rhel-7-server-satellite-6.1-rpms/x86_64       Red Hat Satellite 6.1 (for RHEL 7 Server) (RPMs)                              545
   !rhel-server-rhscl-7-rpms/x86_64               Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server     4,279
   repolist: 14,713

6. Install the katello package:

   # yum install katello

1. Download the ISO image from the Red Hat Customer Portal.
2. As the root user, mount the ISO image to a directory:

   # mkdir /media/iso
   # mount -o loop iso_filename /media/iso
   

3. Change to the /media/iso directory.
4. Run the installer script in the mounted directory:

   # ./install_packages

Procedure 2.2. To Run the Installer Script:

1. Run the following command as the root user to manually configure Red Hat Satellite:

   # katello-installer --foreman-initial-organization "initial_organization_name" \
   --foreman-initial-location "initial_location_name" \
   --foreman-admin-username admin-username \
   --foreman-admin-password admin-password

   This script can be run multiple times without any issues.

   Important

   If you do not specify any of these values, the default values are used. Use the katello-installer --help command to display the available options and any default values.
   When the configuration script has completed successfully, it displays output similar to the following:

   # katello-installer
   Installing             Done
      [100%] [........................................]
      Success!
      * Katello is running at https://satellite.example.com
          Default credentials are 'admin:changeme'
      * Capsule is running at https://satellite.example.com:9090
      * To install additional capsule on separate machine continue by running:
   
      capsule-certs-generate --capsule-fqdn "$CAPSULE" --certs-tar "~/$CAPSULE-certs.tar"
   
      The full log is at /var/log/katello-installer/katello-installer.log

2. After configuration, run the following commands to configure the firewall to limit elasticsearch to the foreman and root users and make these rules persistent during reboots:
   • On Red Hat Enterprise Linux 6, execute as root:

     # iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner \
     foreman -j ACCEPT \
     && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -j DROP \
     && service iptables save
     

     Make sure the iptables service is started and enabled:

     # service iptables start
     # chkconfig iptables on

   • On Red Hat Enterprise Linux 7, execute as root:

     # firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && firewall-cmd --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && firewall-cmd --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP \
     && firewall-cmd --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP \
     && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP

Procedure 2.3. To Configure and Use an Answer File for Installation:

1. Copy the default answer file located at /etc/katello-installer/answers.katello-installer.yaml to a location on your local file system:

   # cp /etc/katello-installer/answers.katello-installer.yaml /etc/katello-installer/my-answer-file.yaml

2. Open your copy of the answer file, edit the values to suit your environment, and save the file.

   Note

   The parameters for each module are specified in the module's params.pp file. Run the following command to view available modules with parameter files:

   # rpm -ql katello-installer-base | grep params.pp

3. Open the /etc/katello-installer/katello-installer.yaml file and edit the answer file entry to point to your custom answer file:

   :answer_file: /etc/katello-installer/my-answer-file.yaml

4. Run the katello-installer command.

   # katello-installer

Procedure 2.4. To Configure Satellite Server to Allow Red Hat Subscription Manager Access to the CDN:

1. On the network gateway and the HTTP Proxy, open the following hostnames, ports and protocols:

   Table 2.1. Required Hostnames, Ports and Protocols

   Hostname	Port	Protocol
   subscription.rhn.redhat.com	443	https
   cdn.redhat.com	443	https
   *.akamaiedge.net	443	https

2. In the Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file. For example:

   # an http proxy server to use (enter server FQDN)
   proxy_hostname = http_proxy.example.com
   
   # port for http proxy server
   proxy_port = 3128
   
   # user name for authenticating to an http proxy, if needed
   proxy_user =
   
   # password for basic http proxy auth, if needed
   proxy_password =
   

Procedure 2.5. To Set a Custom Server Certificate Before Running the Katello Installer:

• Run the following command on the Red Hat Satellite Server to use the custom certificate.

  # katello-installer \
    --certs-server-cert /root/sat_cert/satellite.crt \
    --certs-server-cert-req /root/sat_cert/satellite.crt.req \
    --certs-server-key /root/sat_cert/satellite.crt.key \
    --certs-server-ca-cert /root/sat_cert/ca_cert.crt

Procedure 2.6. To Set a Custom Server Certificate After Running the Katello Installer:

1. Run the following command on the Red Hat Satellite Server to regenerate the katello-ca-consumer package and the Satellite Server's certificate.

   # katello-installer \
     --certs-server-cert /root/sat_cert/satellite.crt \
     --certs-server-cert-req /root/sat_cert/satellite.crt.req \
     --certs-server-key /root/sat_cert/private.crt.key \
     --certs-server-ca-cert /root/sat_cert/ca_cert.crt \
     --certs-update-server \
     --certs-update-server-ca \
     --certs-update-all
   

2. Run the following command on the client systems to install the new client and server certificates.

   # rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

Procedure 3.1. Creating an Organization

1. Click Administer → Organizations.
2. Click New Organization.
3. Specify the name of the new organization in the Name field. Take care not to add an extra space at the end of the name as this will affect the corresponding label created.
4. In the Label field, optionally enter a text string similar to the name but without spaces. If omitted, a label to match the name of the new organization, but with underscores in place of spaces, is created automatically. The label is for use on the command line and cannot be changed once this procedure has been completed. Having a consistent name to label correspondence will reduce errors on the command line. Consider creating names without spaces.
5. Enter a description of the new organization in the Description field.
6. Click Submit.
7. Select the hosts to assign to the new organization.
   • Click Assign All to assign all hosts with no organization to the new organization.
   • Click Manually Assign to manually select and assign the hosts with no organization.
   • Click Proceed to Edit to skip assigning hosts.

Procedure 3.2. Editing an Organization

1. Click Administer → Organizations.
2. Click the name of the organization you want to edit.
3. Select the resource to edit.
4. Click the name of the desired items to add them to the Selected Items list.
5. Click Submit.

Procedure 3.3. Removing an Organization

1. Click the Administer → Organizations menu on the top right hand corner.
2. Select Delete from the drop down menu to the right of the name of the organization you want to remove.
3. An alert box appears:

   Delete Organization Name?

4. Click the OK button.

1. Download the product ISO from the Red Hat Customer Portal, as follows:
   1. Go to Downloads (at the very top of the window) and select Red Hat Satellite.
   2. Open the Content ISOs tab. All products to which the account is subscribed are listed there.
   3. Click the link for the product name, such as Red Hat Enterprise Linux 6 Server (x86_64)(2015-03-12) to download the ISO.
   4. Save to media.
2. Copy all of the Satellite content ISOs to a directory that Satellite can access. This example uses /root/isos.
3. Create a local directory that will be shared via httpd on the Satellite. This example uses /var/www/html/pub/sat-import/.

   # mkdir -p /var/www/html/pub/sat-import/

4. Recursively copy the contents of the first ISO to the local directory:

   # mkdir /mnt/iso
   # mount -o loop /root/isos/first_iso /mnt/iso
   # cp -ruv /mnt/iso/* /var/www/html/pub/sat-import/
   # umount /mnt/iso
   # rmdir /mnt/iso

5. Repeat the above step for each ISO until you have copied all the data from the series of ISOs into the local directory /var/www/html/pub/sat-import/.
6. Ensure that the SELinux contexts are correct:

   # restorecon -rv /var/www/html/pub/sat-import/

7. Modify the default provider URL the Satellite web interface:
   1. Log in to the Satellite web interface.
   2. Select the required organization from the Organization menu.
   3. Click Content → Red Hat Subscriptions and then click Manage Manifest.
   4. On the Subscription Manifest information screen select the Actions tab. Under Red Hat Provider Details click the edit icon on the Red Hat CDN URL entry and change it to the Satellite host name with the newly created directory, for example:

      http://server.example.com/pub/sat-import/
      

      Click Save.
   5. Click Browse to choose the manifest file.
   6. Click Upload to import your manifest.

   Note

   The Satellite is now acting as its own CDN with the files located in http://localhost. This is not a requirement. The CDN can be hosted on a different machine inside the same disconnected network as long as it is accessible to the Satellite server via HTTP.
8. To enable the repositories from the local CDN, click Content → Red Hat Repositories
9. Click Content → Sync Status.
10. Select the repositories you want to synchronize and click Synchronize Now.

Procedure 7.2. To Set a Custom Server Certificate When Running capsule-certs-generate for the First Time:

1. Run the following command on the Red Hat Satellite Server to create the certificates archive:

   # capsule-certs-generate \
   --capsule-fqdn "capsule.example.com" \
   --certs-tar /root/sat_cert/capsule.example.com-certs.tar \
   --server-cert /root/sat_cert/capsule.crt \
   --server-cert-req /root/sat_cert/capsule.crt.req \
   --server-key /root/sat_cert/capsule.key \
   --server-ca-cert /root/sat_cert/cacert.crt

   Where:

   • --capsule-fqdn is the Satellite Capsule Server's fully qualified domain name. Mandatory.
   • --certs-tar is the name of the tar file to be generated that contains the certificate to be used by the Satellite Capsule installer.
   • --server-cert is the path to your certificate, signed by your certificate authority (or self-signed).
   • --server-cert-req is the path to your certificate signing request file that was used to create the certificate.
   • --server-key is the private key used to sign the certificate.
   • --server-ca-cert is the path to the CA certificate on this system.
2. Copy the generated archive file, capsule.example.com-certs.tar, from the Satellite Server to the Satellite Capsule Server.
3. On the Satellite Capsule Server:
   1. Run the following commands to register your Satellite Capsule Server to the Satellite Server:

      # rpm -Uvh http://satellite.example.redhat.com/pub/katello-ca-consumer-latest.noarch.rpm
      # subscription-manager register --org "ACME_Corporation" --env [environment]/[content_view_name]
      

      Note

      The Satellite Capsule Server must be assigned to an organization, because it requires an environment to synchronize content from the Satellite Server. Only organizations have environments.

      Assigning a location is optional, but recommended, to indicate proximity to the hosts that the Satellite Capsule Server is managing.
   2. Depending on the desired Satellite Capsule Server type, choose one of the following options:

      • Satellite Capsule Server with content functionality

        Run the following command on the Satellite Capsule Server to enable the custom certificate. The significant parameter is --pulp="true", which indicates that content functionality is to be enabled.

        # capsule-installer --pulp="true" \
        --qpid-router="true" \
        --puppet="true" \
        --puppetca="true" \
        --reverse-proxy="true" \
        --certs-tar "~/capsule.example.com-certs.tar"
        

      • Satellite Capsule Server without content functionality

        Run the following command on the Satellite Capsule Server to enable the custom certificate. The significant parameter is --pulp="false", which indicates that content functionality is not to be enabled.

        # capsule-installer --pulp="false" \
        --qpid-router="false" \
        --puppet="true" \
        --puppetca="true" \
        --reverse-proxy="true" \
        --certs-tar "~/capsule.example.com-certs.tar"
        

Procedure 7.3. To Set a Custom Server Certificate After Running capsule-certs-generate:

1. Run the following command as the root user on the Satellite Server to generate a new certificate based on your custom server certificate:

   Note

   In this example the files are stored in the directory /root/sat_cert. Using an absolute path in the root users' directory provides a fixed location that is available to all users who log in to the server with root permissions. Before running this command, ensure the directory already exists.

   # capsule-certs-generate \
   --capsule-fqdn "capsule.example.com" \
   --certs-tar /root/sat_cert/capsule-certs.tar \
   --server-cert /root/sat_cert/capsule.crt \
   --server-cert-req /root/sat_cert/capsule.crt.req \
   --server-key /root/sat_cert/capsule.key \
   --server-ca-cert /root/sat_cert/cacert.crt \
   --certs-update-server
   

2. Copy the generated archive file, capsule.example.com-certs.tar, from the Satellite Server to the Satellite Capsule host system.
3. On the Satellite Capsule Server, re-run the capsule-installer command to refresh the certificates. Depending on the desired Satellite Capsule Server type, choose one of the following options:

   • Satellite Capsule Server with content functionality

     Run the following command on the Satellite Capsule Server to refresh the certificates. The significant parameter is --pulp="true", which indicates that content functionality is to be enabled.

     # capsule-installer --pulp="true" \
     --qpid-router="true" \
     --puppet="true" \
     --puppetca="true" \
     --reverse-proxy="true" \
     --certs-tar "capsule.example.com-certs.tar"
     

   • Satellite Capsule Server without content functionality

     Run the following command on the Satellite Capsule Server to refresh the certificates. The significant parameter is --pulp="false", which indicates that content functionality is not to be enabled.

     # capsule-installer --pulp="false" \
     --qpid-router="false" \
     --puppet="true" \
     --puppetca="true" \
     --reverse-proxy="true" \
     --certs-tar "capsule.example.com-certs.tar"
     

Procedure 7.7. Configuring the External DNS Server

1. Create the configuration for the domain with a configuration similar to the following:

   # cat /etc/named.conf
   include "/etc/rndc.key";
   
   controls  {
       inet 192.168.38.2 port 953 allow { 192.168.38.1; 192.168.38.2; } keys { "capsule"; };
   };
   
   options  {
       directory "/var/named";
       forwarders { 8.8.8.8; 8.8.4.4; };
   };
   
   include "/etc/named.rfc1912.zones";
   
   zone "38.168.192.in-addr.arpa" IN {
       type master;
       file "dynamic/38.168.192-rev";
       update-policy {
           grant "capsule" zonesub ANY;
       };
   };
   
   zone "virtual.lan" IN {
       type master;
       file "dynamic/virtual.lan";
       update-policy {
           grant "capsule" zonesub ANY;
       };
   };

   Note that the inet line must be entered as one line in the configuration file.
   The example above configures a domain virtual.lan as one subnet 192.168.38.0/24, a security key named foreman, and sets forwarders to Google's public DNS addresses (8.8.8.8 and 8.8.4.4).
2. Create a key file:

   # ddns-confgen -k capsule

   The above command can take a long time as the program is reading a pseudo random device. For testing or proof-of-concept deployments, an insecure non-blocking device can be used as follows:

   # ddns-confgen -k capsule -r /dev/urandom

3. The above command will print the key section with some instructions as comments. Copy and paste the key section into a separate file named /etc/rndc.key, which is included by a statement in named.conf, so that the file looks as follows:

   # cat /etc/rndc.key
   key "capsule" {
           algorithm hmac-sha256;
           secret "GeBbgGoLedEAAwNQPtPh3zP56MJbkwM84UJDtaUS9mw=";
   };

   This is the secret key that is used to change DNS server configuration, keep it safe and make sure only root can read and write it. This file will be copied over to Capsule server in a later step.
4. Create zone files as follows:

   # cat /var/named/dynamic/virtual.lan
   $ORIGIN .
   $TTL 10800      ; 3 hours
   virtual.lan             IN SOA  service.virtual.lan. root.virtual.lan. (
                                   9          ; serial
                                   86400      ; refresh (1 day)
                                   3600       ; retry (1 hour)
                                   604800     ; expire (1 week)
                                   3600       ; minimum (1 hour)
                                   )
                           NS      service.virtual.lan.
   $ORIGIN virtual.lan.
   $TTL 86400      ; 1 day
   capsule                 A       192.168.38.1
   service                 A       192.168.38.2

5. Create the reverse zone file:

   # cat /var/named/dynamic/38.168.192-rev
   $ORIGIN .
   $TTL 10800      ; 3 hours
   38.168.192.in-addr.arpa IN SOA  service.virtual.lan. root.38.168.192.in-addr.arpa. (
                                   4          ; serial
                                   86400      ; refresh (1 day)
                                   3600       ; retry (1 hour)
                                   604800     ; expire (1 week)
                                   3600       ; minimum (1 hour)
                                   )
                           NS      service.virtual.lan.
   $ORIGIN 38.168.192.in-addr.arpa.
   $TTL 86400      ; 1 day
   1                PTR     capsule.virtual.lan.
   2                PTR     service.virtual.lan.

   Important

   Make sure there are no extra non-US-ASCII characters as BIND is sensitive to this.

Procedure 7.8. Testing and Starting the DNS Service

1. Validate the syntax as follows:

   # named-checkconf -z /etc/named.conf

2. Start the server:
   • On Red Hat Enterprise Linux 7:

     # systemctl restart named

   • On Red Hat Enterprise Linux 6:

     # service named restart

3. Try to add a new host dynamically:

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

4. Test that the DNS service can resolve the new host added in the previous step:

   # nslookup aaa.virtual.lan 192.168.38.2

5. If required, delete the new entry:

   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

6. Configure the firewall for external access to the DNS service (UDP and TCP on port 53):
   • On a Red Hat Enterprise Linux 6 Satellite, execute as root:

     # iptables -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT \
     && iptables -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT \
     && service iptables save

     Make sure the iptables service is started and enabled:

     # service iptables start
     # chkconfig iptables on

   • On a Red Hat Enterprise Linux 7 Satellite, execute as root:

     # firewall-cmd --add-port="53/udp" --add-port="53/tcp" \
     && firewall-cmd --permanent --add-port="53/udp" --add-port="53/tcp"

Procedure 7.9. Configuring a Capsule Server to Use an External DNS Service

1. Ensure that the nsupdate utility, from the bind-utils package, is installed:

   # yum install bind-utils

2. Copy the /etc/rndc.key file from the services server to the Capsule Server. For example:
   • On the services server:

     scp localfile username@hostname:remotefile

   • Alternatively, on the Capsule Server:

     scp username@hostname:remotefile localfile

3. Make sure the key file has the correct owner, permissions, and SELinux label:

   # ls /etc/rndc.key -Zla
   -rw-r-----. root named system_u:object_r:dnssec_t:s0    /etc/rndc.key

4. The Capsule uses the nsupdate utility to update DNS records on the remote server. Before configuring it, test adding one additional host remotely as follows:

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key
   # nslookup aaa.virtual.lan 192.168.38.2
   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

5. Run the katello-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file. Enable the smart-proxy module setting provider to be nsupdate, add the address to the DNS server, and set the default time to live for records created by this Capsule. For example:

   # katello-installer --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server="192.168.38.2" --foreman-proxy-keyfile=/etc/rndc.key --foreman-proxy-dns-ttl=86400

6. Restart foreman-proxy service:
   • On Red Hat Enterprise Linux 7:

     # systemctl restart foreman-proxy

   • On Red Hat Enterprise Linux 6:

     # service foreman-proxy restart

7. View the Satellite Server GUI in your browser; https://satellite_host.example.com.
8. Select Infrastructure → Capsules. Locate the Capsule being configured and select Refresh features from the drop-down list. The DNS feature should appear.
9. Select Infrastructure → Capsules and associate the DNS service with the appropriate subnets and domain.

Procedure 7.10. Configuring the External DHCP Server

1. Generate a security token in an empty directory as follows:

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   The above command can take a long time, for less-secure proof-of-concept deployments you can use a non-blocking random number generator:

   # dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key

   This will create the key pair in two files in the current directory.
2. Copy the secret hash from the key:

   # cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2

3. Edit the dhcpd configuration file for all the subnets, and add the secret key from the previous step:

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm HMAC-MD5;
   	secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw==";
   };
   omapi-key omapi_key;

4. Delete the two key files from the directory where you created them.
5. For each subnet defined (192.168.38.0 in this example) define Subnet on the Satellite server. It is recommended to set up a lease range and reservation range separately to prevent conflicts. In this example, the lease range is 192.168.38.10 to 192.168.38.100 so the reservation range (defined in Satellite GUI) would be 192.168.38.101 to 192.168.38.250. Do not set DHCP Capsule for the defined Subnet yet.
   Note that ISC DHCP listens only on interfaces that match defined subnets. In this example, the server has an interface that routes to 192.168.38.0 subnet directly.
6. Configure the firewall for external access to the DHCP service:
   • On a Red Hat Enterprise Linux 7:

     # firewall-cmd --add-service dhcp \
     && firewall-cmd --permanent --add-service dhcp

   • On a Red Hat Enterprise Linux 6:

     # iptables -A INPUT -m state --state NEW -p tcp --dport 67 -j ACCEPT \
     && service iptables save

     Make sure the iptables service is started and enabled:

     # service iptables start
     # chkconfig iptables on

7. Configuration files are read by foreman-proxy user, first determine the UID and GID numbers of the foreman-proxy user on the Capsule Server, then create the same user and group with same IDs on this server:

   # groupadd -g 990 foreman-proxy
   # useradd -u 992 -g 990 -s /sbin/nologin foreman-proxy

8. Configuration files must be readable for this user. Recent dhcp package updates removed read and execute flags from the configuration directory which prevents that. To restore the required flags and prevent this change in behavior on the next package update, enter the following commands:

   # chmod o+rx /etc/dhcp/
   # chmod o+r /etc/dhcp/dhcpd.conf
   # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

9. Start the DHCP service:
   • On Red Hat Enterprise Linux 7:

     # systemctl start dhcpd

   • On Red Hat Enterprise Linux 6:

     # service dhcpd start

10. Export DHCP configuration and leases file using NFS, so that the Capsule Server can read it:

    # yum install nfs-utils
    # systemctl enable rpcbind nfs-server
    # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd

11. Create the DHCP configuration and leases files to be exported using NFS:

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

12. Add the newly created mount point to /etc/fstab file:

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

13. Mount the file systems in /etc/fstab:

    # mount -a

14. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)

    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

    /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

15. Reload the NFS server:

    # exportfs -rva

16. Configure the firewall for the DHCP omapi port 7911 for the Capsule Server:
    • On a Red Hat Enterprise Linux 7:

      # firewall-cmd --add-port="7911/tcp" \
      && firewall-cmd --permanent --add-port="7911/tcp"

    • On a Red Hat Enterprise Linux 6:

      # iptables -A INPUT -m state --state NEW -p tcp --dport 7911 -j ACCEPT \
      && service iptables save

      Make sure the iptables service is started and enabled:

      # service iptables start
      # chkconfig iptables on

17. This step is common to both the DHCP and TFTP procedures and need only be carried out once per system. If required, follow this step to configure the firewall for external access to the NFS service.

    Note

    In this guide the clients are configured to use NFSv3 and this step is therefore NFSv3 specific.
    • On Red Hat Enterprise Linux 7:
      It is recommended to use firewalld daemon's NFS service option because NFS uses multiple ports to initiate connections. To do so, enter the following commands:

      #  firewall-cmd --zone public --add-service mountd \
      && firewall-cmd --zone public --add-service rpc-bind \
      && firewall-cmd --zone public --add-service nfs \
      && firewall-cmd --permanent --zone public --add-service mountd \
      && firewall-cmd --permanent --zone public --add-service rpc-bind \
      && firewall-cmd --permanent --zone public --add-service nfs

      For additional information on using NFSv3 behind a firewall on Red Hat Enterprise Linux 7, see the “Running NFS Behind a Firewall” section in the Red Hat Enterprise Linux 7 Storage Administration Guide and the “Securing NFS” section in the Red Hat Enterprise Linux 7 Security Guide.
    • On Red Hat Enterprise Linux 6:
      Configure ports for NFSv3 in the /etc/sysconfig/nfs file as follows:

      LOCKD_TCPPORT=32803
      LOCKD_UDPPORT=32769
      MOUNTD_PORT=892
      RQUOTAD_PORT=875
      STATD_PORT=662
      STATD_OUTGOING_PORT=2020

      Restart the service for the changes to take effect:

      # service nfs restart

      Add the following rules to the /etc/sysconfig/iptables file by entering commands as follows:

      # iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 111 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 111 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 2049 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 2049 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 32803 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 32769 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 892 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 892 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 875 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 875 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 662 -j ACCEPT \
      && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 662 -j ACCEPT \
      && service iptables save

      Restart the firewall for the changes to take effect:

      # service iptables restart

      For additional information on using NFSv3 behind a firewall on Red Hat Enterprise Linux 6, see the Red Hat Enterprise Linux 6 Storage Administration Guide and the “Running NFS Behind a Firewall” section in the “Securing NFS” section in the Red Hat Enterprise Linux 6 Security Guide.

Procedure 7.11. Configuring a Capsule Server to Use an External DHCP Service

1. Install the NFS client:

   # yum install nfs-utils

2. Create the DHCP directories to prepare for NFS:

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner as follows:

   # chown -R foreman-proxy /mnt/nfs

4. Try to reach the NFS server and verify RPC communication paths:

   # showmount -e 192.168.38.2
   # rpcinfo -p 192.168.38.2

5. Add these two lines to the /etc/fstab file:

   192.168.38.2:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0

   192.168.38.2:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems in /etc/fstab:

   # mount -a

7. Try to read the relevant files:

   # su foreman-proxy -s /bin/bash
   bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   bash-4.2$ exit

   In case of problems, investigate the NFS configuration, logs, and firewall rules.
8. On the Capsule Server, run the katello-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file:

   # katello-installer --foreman-proxy-dhcp=true --foreman-proxy-dhcp-provider=isc --foreman-proxy-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf --foreman-proxy-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases --foreman-proxy-dhcp-key-name=omapi_key --foreman-proxy-dhcp-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== --foreman-proxy-dhcp-server dhcp.example.com

   Ensure the dhcp_key_secret value is correctly entered without quotes. The trailing = character is optional.
9. Restart the proxy:
   • On Red Hat Enterprise Linux 7:

     # systemctl restart foreman-proxy

   • On Red Hat Enterprise Linux 6:

     # service foreman-proxy restart

10. View the Satellite Server GUI in your browser; https://satellite_host.example.com.
11. Select Infrastructure → Capsules. Locate the Capsule and select Refresh features from the drop-down list. The DHCP feature should appear.
12. Select Infrastructure → Capsules and associate the DHCP service with the appropriate subnets and domain.

Procedure 7.12. Configuring the TFTP Server

1. Install and enable the TFTP server:

   # yum install tftp-server syslinux

   • On Red Hat Enterprise Linux 7, enable and activate the tftp.socket unit:

     # systemctl enable tftp.socket
     # systemctl start tftp.socket

   • On Red Hat Enterprise Linux 6, enable and start the xinetd service:

     # service xinetd enable
     # service xinetd start

2. Configure the PXELinux environment as follows:

   # mkdir -p /var/lib/tftpboot/{boot,pxelinux.cfg}
   # cp /usr/share/syslinux/{pxelinux.0,menu.c32,chain.c32} /var/lib/tftpboot/

3. Restore SELinux file contexts:

   # restorecon -RvF /var/lib/tftpboot/

4. Create the TFTP directory to be exported using NFS:

   # mkdir -p /exports/var/lib/tftpboot

5. Add the newly created mount point to the /etc/fstab file:

   /var/lib/tftpboot /exports/var/lib/tftpboot none bind,auto 0 0

6. Mount the file systems in /etc/fstab:

   # mount -a

7. Ensure the following lines are present in /etc/exports:

   /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)

   /exports/var/lib/tftpboot 192.168.38.1(rw,async,no_root_squash,no_subtree_check,nohide)

   The first line is common to the DHCP configuration and therefore should already be present if the previous procedure was completed on this system.
8. Reload the NFS server:

   # exportfs -rva

9. This step is common to both the DHCP and TFTP procedures and need only be carried out once per system. If required, follow this step to configure the firewall for external access to the NFS service.

   Note

   In this guide the clients are configured to use NFSv3 and this step is therefore NFSv3 specific.
   • On Red Hat Enterprise Linux 7:
     It is recommended to use firewalld daemon's NFS service option because NFS uses multiple ports to initiate connections. To do so, enter the following commands:

     #  firewall-cmd --zone public --add-service mountd \
     && firewall-cmd --zone public --add-service rpc-bind \
     && firewall-cmd --zone public --add-service nfs \
     && firewall-cmd --permanent --zone public --add-service mountd \
     && firewall-cmd --permanent --zone public --add-service rpc-bind \
     && firewall-cmd --permanent --zone public --add-service nfs

     For additional information on using NFSv3 behind a firewall on Red Hat Enterprise Linux 7, see the “Running NFS Behind a Firewall” section in the Red Hat Enterprise Linux 7 Storage Administration Guide and the “Securing NFS” section in the Red Hat Enterprise Linux 7 Security Guide.
   • On Red Hat Enterprise Linux 6:
     Configure ports for NFSv3 in the /etc/sysconfig/nfs file as follows:

     LOCKD_TCPPORT=32803
     LOCKD_UDPPORT=32769
     MOUNTD_PORT=892
     RQUOTAD_PORT=875
     STATD_PORT=662
     STATD_OUTGOING_PORT=2020

     Restart the service for the changes to take effect:

     # service nfs restart

     Add the following rules to the /etc/sysconfig/iptables file by entering commands as follows:

     # iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 111 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 111 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 2049 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 2049 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 32803 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 32769 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 892 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 892 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 875 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 875 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 662 -j ACCEPT \
     && iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 662 -j ACCEPT \
     && service iptables save

     Restart the firewall for the changes to take effect:

     # service iptables restart

     For additional information on using NFSv3 behind a firewall on Red Hat Enterprise Linux 6, see the Red Hat Enterprise Linux 6 Storage Administration Guide and the “Running NFS Behind a Firewall” section in the “Securing NFS” section in the Red Hat Enterprise Linux 6 Security Guide.

Procedure 7.13. Configure the Firewall for External access to the TFTP service

• Configure the firewall for external access to the TFTP service (UDP on port 69):
  • On a Red Hat Enterprise Linux 7:

    # firewall-cmd --add-port="69/udp" \
    && firewall-cmd --permanent --add-port="69/udp"

  • On a Red Hat Enterprise Linux 6:

    # iptables -A INPUT -m state --state NEW -p tcp --dport 69 -j ACCEPT \
    && service iptables save

    Make sure the iptables service is started and enabled:

    # service iptables start
    # chkconfig iptables on

Procedure 7.14. Configuring a Capsule Server to Use an External TFTP Service

1. Create the TFTP directory to prepare for NFS:

   # mkdir -p /mnt/nfs/var/lib/tftpboot

2. In the /etc/fstab, add a line as follows:

   192.168.38.2:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0

3. Mount the file systems in /etc/fstab:

   # mount -a

4. Run the katello-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file:

   # katello-installer --foreman-proxy-tftp=true --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot

   If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of that server.

   # katello-installer --foreman-proxy-tftp-servername=new_FQDN

5. View the Satellite Server GUI in your browser; https://satellite_host.example.com.
6. Select Infrastructure → Capsules in the user interface. Locate the Capsule and select Refresh features from the drop-down list. The TFTP feature should appear.
7. Select Infrastructure → Capsules and associate the TFTP service with the appropriate subnets and domain.

Procedure 8.4. Upgrading Disconnected Satellite

1. If there are discovered hosts available, turn them off and delete all entries under the Discovered hosts page.
2. Stop services:

   # katello-service stop
   output omitted
   Success!

   Wait for the command to complete. If required, confirm services have stopped:

   # katello-service status
   mongod is stopped
   qdrouterd is stopped
   qpidd is stopped
   celery init v10.0.
   Using configuration: /etc/default/pulp_workers, /etc/default/pulp_celerybeat
   pulp_celerybeat is stopped.
   elasticsearch is stopped
   celery init v10.0.
   Using config script: /etc/default/pulp_resource_manager
   node resource_manager is stopped...
   foreman-proxy is stopped
   tomcat6 is stopped                                     [  OK  ]
   output truncated

   Restart the Mongo database as it is required for upgrading the Pulp database:

   # service-wait mongod start

3. Obtain the ISO file, mount it, and run the install_packages script as described in Section 2.1.2, “Downloading from a Disconnected Network”. After executing successfully, the script returns the following message:

   Upgrade is complete. Please backup your data and run katello-installer.

4. Create a backup of the relevant databases. See How to generate database backup for Red Hat Satellite 6.0 for instructions on backing up your databases.
5. Run the installer with the --upgrade option:

   # katello-installer --upgrade
   

   If required, add the --noop option to the command and review the /var/log/katello-installer/katello-installer.log to see what changes would be applied if the --noop was omitted.

   Important

   If you have made manual edits to DNS and DHCP configuration files, they will be overwritten during the upgrade process. To avoid this, append the --capsule-dns-managed=false and --capsule-dhcp-managed=false options to the --upgrade installer command.
   The katello-installer utility will backup files that it changes and log this. For example:

   /Stage[main]/Dhcp/File[/etc/dhcp/dhcpd.conf]: Filebucketed /etc/dhcp/dhcpd.conf to puppet with sum 622d9820b8e764ab124367c68f5fa3a1

   The old file can be restored with this command:

   # puppet filebucket -l restore /etc/dhcp/dhcpd.conf 622d9820b8e764ab124367c68f5fa3a1

6. Restart all services:

   # katello-service restart

7. Update the Discovery template:
   1. At the Hosts tab, select Provisioning templates.
   2. Select PXELinux global default.
   3. At the Template editor dialog box, in the Provisioning Template tab, modify the PXELinux global default template discovery menu entry. Insert the following text at the end of the template:

      LABEL discovery
      MENU LABEL Satellite 6 Discovery
      MENU DEFAULT
      KERNEL boot/fdi-image-rhel_7-vmlinuz
      APPEND initrd=boot/fdi-image-rhel_7-img rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=https://SATELLITE_CAPSULE_URL:9090 proxy.type=proxy
      IPAPPEND 2
      

      The proxy.type option can be either proxy or foreman. For proxy, all communication goes through the Capsule. For foreman, the communication goes directly to Satellite Server, which was the behavior in Satellite 6.0.
      The proxy.url specifies the URL of the Satellite Capsule or Server. Both HTTP and HTTPS protocols are supported.