Chapter 3. Registering Hosts and Setting Up Host Integration

Procedure

1. In the Satellite web UI, navigate to Hosts > Register Host.
2. Optional: Select a different Organization.
3. Optional: Select a different Location.
4. Optional: From the Host Group list, select the host group to associate the hosts with. Fields that inherit value from Host group: Operating system, Activation Keys and Lifecycle environment.
5. Optional: From the Operating system list, select the operating system of hosts that you want to register.
6. Optional: From the Capsule list, select the Capsule to register hosts through.

7. Optional: Select the Insecure option, if you want to make the first call insecure. During this first call, hosts download the CA file from Satellite. Hosts will use this CA file to connect to Satellite with all future calls making them secure.

   Red Hat recommends that you avoid insecure calls.

   If an attacker, located in the network between Satellite and a host, fetches the CA file from the first insecure call, the attacker will be able to access the content of the API calls to and from the registered host and the JSON Web Tokens (JWT). Therefore, if you have chosen to deploy SSH keys during registration, the attacker will be able to access the host using the SSH key.

   Instead, you can manually copy and install the CA file on each host before registering the host.

   To do this, find where Satellite stores the CA file by navigating to Administer > Settings > Authentication and locating the value of the SSL CA file setting.

   Copy the CA file to the /etc/pki/ca-trust/source/anchors/ directory on hosts and enter the following commands:

   # update-ca-trust enable
   # update-ca-trust

   Then register the hosts with a secure curl command, such as:

   # curl -sS https://satellite.example.com/register ...

   The following is an example of the curl command with the --insecure option:

   # curl -sS --insecure https://satellite.example.com/register ...

8. Select the Advanced tab.

9. From the Setup REX list, select whether you want to deploy Satellite SSH keys to hosts or not.

   If set to Yes, public SSH keys will be installed on the registered host. The inherited value is based on the host_registration_remote_execution parameter. It can be inherited, for example from a host group, an operating system, or an organization. When overridden, the selected value will be stored on host parameter level.

10. From the Setup Insights list, select whether you want to install insights-client and register the hosts to Insights.

    The Insights tool is available for Red Hat Enterprise Linux only. It has no effect on other operating systems.

    You must enable the following repositories on a registered machine:

    • RHEL 6: rhel-6-server-rpms
    • RHEL 7: rhel-7-server-rpms

    • RHEL 8: rhel-8-for-x86_64-appstream-rpms

      The insights-client package is installed by default on RHEL 8 except in environments whereby RHEL 8 was deployed with "Minimal Install" option.

11. Optional: In the Install packages field, list the packages (separated with spaces) that you want to install on the host upon registration. This can be set by the host_packages parameter.
12. Optional: Select the Update packages option to update all packages on the host upon registration. This can be set by the host_update_packages parameter.
13. Optional: In the Repository field, enter a repository to be added before the registration is performed. For example, it can be useful to make the subscription-manager package available for the purpose of the registration. For Red Hat family distributions, enter the URL of the repository, for example http://rpm.example.com/.
14. Optional: In the Repository GPG key URL field, specify the public key to verify the signatures of GPG-signed packages. It needs to be specified in the ASCII form with the GPG public key header.

15. Optional: In the Token lifetime (hours) field, change the validity duration of the JSON Web Token (JWT) that Satellite uses for authentication. The duration of this token defines how long the generated curl command works. You can set the duration to 0 – 999 999 hours or unlimited.

    Note that Satellite applies the permissions of the user who generates the curl command to authorization of hosts. If the user loses or gains additional permissions, the permissions of the JWT change too. Therefore, do not delete, block, or change permissions of the user during the token duration.

    The scope of the JWTs is limited to the registration endpoints only and cannot be used anywhere else.

16. Optional: In the Remote Execution Interface field, enter the identifier of a network interface that hosts must use for the SSH connection. If you keep this field blank, Satellite uses the default network interface.
17. In the Activation Keys field, enter one or more activation keys to assign to hosts.
18. Optional: Select the Lifecycle environment.
19. Optional: Select the Ignore errors option if you want to ignore subscription manager errors.
20. Optional: Select the Force option if you want to remove any katello-ca-consumer rpms before registration and run subscription-manager with the --force argument.
21. Click the Generate button.
22. Copy the generated curl command.
23. On the host that you want to register, run the curl command as root.

Procedure

1. Navigate to Hosts > Templates > Provisioning Templates.
2. Search for the template you want to edit.
3. In the row of the required template, click Clone.
4. Edit the template as needed. For more information, see Appendix A, Template Writing Reference.
5. Click Submit.
6. Navigate to Administer > Settings > Provisioning.

7. Change the following settings as needed:

   • Point the Default Global registration template setting to your custom global registration template,
   • Point the Default 'Host initial configuration' template setting to your custom initial configuration template.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Select an existing user by clicking the required Username. A new pane opens with tabs to modify information about the selected user. Alternatively, create a new user specifically for the purpose of running this script.
3. Click the Roles tab.

4. Select Edit hosts and Viewer from the Roles list.

   Important

   The Edit hosts role allows the user to edit and delete hosts as well as being able to add hosts. If this is not acceptable to your security policy, create a new role with the following permissions and assign it to the user:

   • view_organizations
   • view_locations
   • view_domains
   • view_hostgroups
   • view_hosts
   • view_architectures
   • view_ptables
   • view_operatingsystems
   • create_hosts
5. Click Submit.

CLI procedure

1. Create a role with the minimum permissions required by the bootstrap script. This example creates a role with the name Bootstrap:

   # ROLE='Bootstrap'
   hammer role create --name "$ROLE"
   hammer filter create --role "$ROLE" --permissions view_organizations
   hammer filter create --role "$ROLE" --permissions view_locations
   hammer filter create --role "$ROLE" --permissions view_domains
   hammer filter create --role "$ROLE" --permissions view_hostgroups
   hammer filter create --role "$ROLE" --permissions view_hosts
   hammer filter create --role "$ROLE" --permissions view_architectures
   hammer filter create --role "$ROLE" --permissions view_ptables
   hammer filter create --role "$ROLE" --permissions view_operatingsystems
   hammer filter create --role "$ROLE" --permissions create_hosts

2. Assign the new role to an existing user:

   # hammer user add-role --id user_id --role Bootstrap

   Alternatively, you can create a new user and assign this new role to them. For more information on creating users with Hammer, see Managing Users and Roles in the Administering Red Hat Satellite guide.