Configuring the Firewall on Red Hat Enterprise Linux 6

1. Open the ports required for Client to Satellite Communications

   # iptables -I INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p udp --dport 67 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p udp --dport 69 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 5000 \
   -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 5647 \
   -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 8140 \
   -j ACCEPT \
   && iptables -A INPUT -m state --state NEW -p tcp --dport 9090 \
   -j ACCEPT \
   && service iptables save

2. Verify that the iptables service is started and enabled.

   # service iptables start
   # chkconfig iptables on

Configuring the Firewall on Red Hat Enterprise Linux 7

1. Open the ports required for Client to Satellite Communications.

   # firewall-cmd \
   --add-port="53/udp" --add-port="53/tcp" \
   --add-port="67/udp" --add-port="69/udp" \
   --add-port="80/tcp"  --add-port="443/tcp" \
   --add-port="5000/tcp" --add-port="5647/tcp" \
   --add-port="8000/tcp" --add-port="8140/tcp" \
   --add-port="9090/tcp"

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent \
   --add-port="53/udp" --add-port="53/tcp" \
   --add-port="67/udp" --add-port="69/udp" \
   --add-port="80/tcp"  --add-port="443/tcp" \
   --add-port="5000/tcp" --add-port="5647/tcp" \
   --add-port="8000/tcp" --add-port="8140/tcp" \
   --add-port="9090/tcp"

Configuring the Firewall on Red Hat Enterprise Linux 6

1. Configure iptables service.

   # iptables -I INPUT -m state --state NEW -p tcp --dport 5000 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 5646 -j ACCEPT \
   && service iptables save

2. Start iptables service.

   # service iptables restart
   # chkconfig iptables on

Configuring the Firewall on Red Hat Enterprise Linux 7

1. Configure the firewall on Satellite Server.

   # firewall-cmd --add-port="5000/tcp" --add-port="5646/tcp"

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent --add-port="5000/tcp" --add-port="5646/tcp"

Configuring the Firewall on Red Hat Enterprise Linux 6

1. Configure iptables service.

   # iptables -I INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p udp --dport 67 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p udp --dport 69 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 5000 -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 5647 \
   -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 8000 \
   -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 8140 \
   -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 8443 \
   -j ACCEPT \
   && iptables -I INPUT -m state --state NEW -p tcp --dport 9090 \
   -j ACCEPT \
   && service iptables save

2. Start iptables service.

   # service iptables restart
   # chkconfig iptables on

Configuring the Firewall on Red Hat Enterprise Linux 7

1. Configure the firewall on Capsule Server.

   # firewall-cmd --add-port="53/udp" --add-port="53/tcp" \
   --add-port="67/udp" --add-port="69/udp" \
   --add-port="80/tcp" --add-port="443/tcp" \
   --add-port="5000/tcp" --add-port="5647/tcp" \
   --add-port="8000/tcp" --add-port="8140/tcp" \
   --add-port="8443/tcp" --add-port="9090/tcp"

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent --add-port="53/udp" --add-port="53/tcp" \
   --add-port="67/udp" --add-port="69/udp" \
   --add-port="80/tcp" --add-port="443/tcp" \
   --add-port="5000/tcp" --add-port="5647/tcp" \
   --add-port="8000/tcp" --add-port="8140/tcp" \
   --add-port="8443/tcp" --add-port="9090/tcp"

Changing default ports to user-specified ports

1. To change the port from the default port to a user-specified port, execute the commands using values that are relevant to your environment. These examples use port 99999 for demonstration purposes.

   Default Port	SELinux Command
   80, 443, 8443	semanage port -a -t http_port_t -p tcp 99999
   8080	semanage port -a -t http_cache_port_t -p tcp 99999
   8140	semanage port -a -t puppet_port_t -p tcp 99999
   9090	semanage port -a -t websm_port_t -p tcp 99999
   69	semanage port -a -t tftp_port_t -p udp 99999
   53 (TCP)	semanage port -a -t dns_port_t -p tcp 99999
   53 (UDP)	semanage port -a -t dns_port_t -p udp 99999
   67, 68	semanage port -a -t dhcpd_port_t -p udp 99999
   5671	semanage port -a -t amqp_port_t -p tcp 99999
   8000	semanage port -a -t soundd_port_t -p tcp 99999
   7911	semanage port -a -t dhcpd_port_t -p tcp 99999
   5000 on Red Hat Enterprise Linux 6	semanage port -a -t commplex_port_t -p tcp 99999
   5000 on Red Hat Enterprise Linux 7	semanage port -a -t commplex_main_port_t -p tcp 99999
   22	semanage port -a -t ssh_port_t -p tcp 99999
   16514 (libvirt)	semanage port -a -t virt_port_t -p tcp 99999
   389, 636	semanage port -a -t ldap_port_t -p tcp 99999
   5910 to 5930	semanage port -a -t vnc_port_t -p tcp 99999

2. Disassociate the previously used port number and port type.

1. Navigate to the Red Hat Customer Portal and log in.
2. Click Subscriptions.

3. In the Red Hat Subscription Management section, click Satellite Organizations.

   Note

   You cannot create a new Subscription Manifest if you have no active subscriptions. This can be a Red Hat Enterprise Linux subscription. If you do not have the correct subscription the Create a Satellite button will be greyed out.

4. On the Subscription Management Applications page, select the Satellite tab.
5. Click Create a Satellite.
6. In the Name field, type the host name of the Satellite Server.
7. Select Satellite 6.2 as the version and click Create.
8. Click Attach a subscription.
9. Select the check box for each subscription that you want to attach and specify the number of subscriptions.

10. Click Attach Selected.

    It can take several minutes for all the subscriptions to attach.

11. Click Download Manifest and save the manifest file to a known location.

Uploading a Manifest Using the Web UI

1. Verify that you are in the correct Organization.
2. Click Content > Red Hat Subscriptions.
3. Click Manage Manifest to open the Subscriptions page.
4. Click Choose File, select the manifest file you created, and click Open.
5. Click Upload to upload the manifest to the Satellite Server.

Uploading a Manifest Using Hammer CLI

1. Upload a manifest to Satellite Server.

   # hammer subscription upload --organization-label org_label \
   --file path_to_manifest

Register Capsule Server to Satellite Server

1. Install the Satellite Server’s CA certificate in the Capsule Server.

   # rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

2. Register the Capsule Server with your organization.

   # subscription-manager register --org organization_name

1. Identify your Capsule Server subscription.

   # subscription-manager list --all --available

   The command displays output similar to the following:

   +-------------------------------------------+
       Available Subscriptions
   +-------------------------------------------+
   
   Subscription Name: Red Hat Satellite Capsule Server
   Provides:          Red Hat Satellite Proxy
                      Red Hat Satellite Capsule
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux Server
                      Red Hat Enterprise Linux High Availability (for RHEL Server)
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Enterprise Linux Load Balancer (for RHEL Server)
   SKU:               MCT0369
   Pool ID:           9e4cc4e9b9fb407583035861bb6be501
   Available:         3
   Suggested:         1
   Service Level:     Premium
   Service Type:      L1-L3
   Multi-Entitlement: No
   Ends:              10/07/2022
   System Type:       Physical

2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID will be different than the example provided.

3. Attach your subscription to your Capsule Server, using your Pool ID:

   # subscription-manager attach --pool=Red_Hat_Satellite_Capsule_Pool_Id

   The outputs displays something similar to the following:

   Successfully attached a subscription for: Red Hat Capsule Server

4. To verify that the subscriptions are successfully attached, run the following command:

   # subscription-manager list --consumed

1. Disable all existing repositories.

   # subscription-manager repos --disable "*"

2. Enable the Red Hat Satellite, Red Hat Enterprise Linux, and Red Hat Software Collections repositories.

   The Red Hat Software Collections repository provides a later version of Ruby required by some Red Hat Satellite features, including the Remote Execution feature.

   Ensure the Red Hat Enterprise Linux repository matches the specific version you are using.

   1. If you are using Red Hat Enterprise Linux 6, run this command.

      # subscription-manager repos --enable rhel-6-server-rpms \
      --enable rhel-6-server-satellite-capsule-6.2-rpms \
      --enable rhel-server-rhscl-6-rpms

   2. If you are using Red Hat Enterprise Linux 7, run this command.

      # subscription-manager repos --enable rhel-7-server-rpms \
      --enable rhel-7-server-satellite-capsule-6.2-rpms \
      --enable rhel-server-rhscl-7-rpms

3. Clear out any metadata left from any non-Red Hat yum repositories.

   # yum clean all

4. Verify that the repositories have been enabled.

   # yum repolist enabled

   The following output displays:

   Loaded plugins: langpacks, product-id, subscription-manager
   repo id                                                 repo name                                                    status
   !rhel-7-server-rpms/7Server/x86_64                      Red Hat Enterprise Linux 7 Server (RPMs)                      7,617
   !rhel-7-server-satellite-capsule-6.2-rpms/x86_64     Red Hat Satellite Capsule 6.2(for RHEL 7 Server) (RPMs)    176
   repolist: 7,793

Synchronizing Time by Using NTP

1. Install ntp.

   # yum install ntp

2. Verify that your NTP server is available.

   # ntpdate -q ntp_server_address

3. Set the system time.

   # ntpdate ntp_server_address

4. Start and enable the ntpd service.

   # chkconfig ntpd on

Synchronizing Time by Using chronyd

1. Install chronyd.

   # yum install chrony

2. Start and enable the chrony service.

   # systemctl start chronyd
   # systemctl enable chronyd

1. Install the installation package.

   # yum install satellite-capsule

1. Deploy a Red Hat Enterprise Linux Server and install the ISC DNS Service.

   # yum install bind bind-utils

2. Create the configuration for the domain.

   The following example configures a domain virtual.lan as one subnet 192.168.38.0/24, a security key named foreman, and sets forwarders to Google’s public DNS addresses (8.8.8.8 and 8.8.4.4).

   # cat /etc/named.conf
   include "/etc/rndc.key";
   
   controls  {
       inet 192.168.38.2 port 953 allow { 192.168.38.1; 192.168.38.2; } keys { "capsule"; };
   };
   
   options  {
       directory "/var/named";
       forwarders { 8.8.8.8; 8.8.4.4; };
   };
   
   include "/etc/named.rfc1912.zones";
   
   zone "38.168.192.in-addr.arpa" IN {
       type master;
       file "dynamic/38.168.192-rev";
       update-policy {
           grant "capsule" zonesub ANY;
       };
   };
   
   zone "virtual.lan" IN {
       type master;
       file "dynamic/virtual.lan";
       update-policy {
           grant "capsule" zonesub ANY;
       };
   };

   The inet line must be entered as one line in the configuration file.

3. Create a key file.

   # ddns-confgen -k capsule

   This command can take a long time to complete.

4. Copy and paste the output from the key section into a separate file called /etc/rndc.key.

   # cat /etc/rndc.key
   key "capsule" {
           algorithm hmac-sha256;
           secret "GeBbgGoLedEAAwNQPtPh3zP56MJbkwM84UJDtaUS9mw=";
   };

   Important

   This is the key used to change DNS server configuration. Only the root user should read and write to it.

5. Create zone files.

   # cat /var/named/dynamic/virtual.lan
   $ORIGIN .
   $TTL 10800      ; 3 hours
   virtual.lan             IN SOA  service.virtual.lan. root.virtual.lan. (
                                   9          ; serial
                                   86400      ; refresh (1 day)
                                   3600       ; retry (1 hour)
                                   604800     ; expire (1 week)
                                   3600       ; minimum (1 hour)
                                   )
                           NS      service.virtual.lan.
   $ORIGIN virtual.lan.
   $TTL 86400      ; 1 day
   capsule                 A       192.168.38.1
   service                 A       192.168.38.2

6. Create the reverse zone file.

   # cat /var/named/dynamic/38.168.192-rev
   $ORIGIN .
   $TTL 10800      ; 3 hours
   38.168.192.in-addr.arpa IN SOA  service.virtual.lan. root.38.168.192.in-addr.arpa. (
                                   4          ; serial
                                   86400      ; refresh (1 day)
                                   3600       ; retry (1 hour)
                                   604800     ; expire (1 week)
                                   3600       ; minimum (1 hour)
                                   )
                           NS      service.virtual.lan.
   $ORIGIN 38.168.192.in-addr.arpa.
   $TTL 86400      ; 1 day
   1                PTR     capsule.virtual.lan.
   2                PTR     service.virtual.lan.

   There should be no extra non-ASCII characters.

1. Validate the syntax.

   # named-checkconf -z /etc/named.conf

2. Start the server.

   1. If you are using Red Hat Enterprise Linux 6, run this command.

      # service named restart

   2. If you are using Red Hat Enterprise Linux 7, run this command.

      # systemctl restart named

3. Add a new host.

   The following uses the example host 192.168.38.2. You should change this to suit your environment.

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

4. Test that the DNS service can resolve the new host.

   # nslookup aaa.virtual.lan 192.168.38.2

5. If necessary, delete the new entry.

   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

6. Configure the firewall for external access to the DNS service (UDP and TCP on port 53).

   • For Satellite Server running Red Hat Enterprise Linux 7:

     # firewall-cmd --add-port="53/udp" --add-port="53/tcp" \
     && firewall-cmd --permanent --add-port="53/udp" --add-port="53/tcp"

   • For Satellite Server running Red Hat Enterprise Linux 6:

     # iptables -I INPUT -m state --state NEW -p udp \
     --dport 53 -j ACCEPT \
     && iptables -I INPUT -m state --state NEW -p tcp \
     --dport 53 -j ACCEPT \
     && service iptables save

     Verify that the iptables service is started and enabled.

     # service iptables start
     # chkconfig iptables on

1. On the Red Hat Enterprise Linux Server, install the ISC DNS Service.

   # yum install bind bind-utils

   Ensure that the nsupdate utility was installed. The Capsule uses the nsupdate utility to update DNS records on the remote server.

2. Copy the /etc/rndc.key file from the services server to the Capsule Server.

   # scp localfile username@hostname:remotefile

3. Verify that the key file has the correct owner, permissions, and SELinux label.

   # ls /etc/rndc.key -Zla
   -rw-r-----. root named system_u:object_r:dnssec_t:s0    /etc/rndc.key

4. Test the nsupdate utility by adding a host remotely.

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key
   # nslookup aaa.virtual.lan 192.168.38.2
   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

5. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file.

   # satellite-installer --foreman-proxy-dns=true \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="192.168.38.2" \
   --foreman-proxy-keyfile=/etc/rndc.key \
   --foreman-proxy-dns-ttl=86400

6. Restart the foreman-proxy service.

   1. If you are using Red Hat Enterprise Linux 6, run this command.

      # service foreman-proxy restart

   2. If you are using Red Hat Enterprise Linux 7, run this command.

      # systemctl restart foreman-proxy

7. Log in to the Satellite Server web UI.
8. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DNS feature should appear.
9. Associate the DNS service with the appropriate subnets and domain.

1. Deploy a Red Hat Enterprise Linux Server and install the ISC DHCP Service.

   # yum install dhcp

2. Generate a security token in an empty directory.

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   The above command can take a long time, for less-secure proof-of-concept deployments you can use a non-blocking random number generator.

   # dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key

   This will create the key pair in two files in the current directory.

3. Copy the secret hash from the key.

   # cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2

4. Edit the dhcpd configuration file for all of the subnets and add the key.

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm HMAC-MD5;
   	secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw==";
   };
   omapi-key omapi_key;

5. Delete the two key files from the directory where you created them.

6. Define each subnet on the Satellite Server.

   It is recommended to set up a lease range and reservation range separately to prevent conflicts. For example, the lease range is 192.168.38.10 to 192.168.38.100 so the reservation range (defined in the Satellite web UI) is 192.168.38.101 to 192.168.38.250. Do not set DHCP Capsule for the defined Subnet yet.

   ISC DHCP listens only on interfaces that match defined subnets. In this example, the server has an interface that routes to 192.168.38.0 subnet directly.

7. Configure the firewall for external access to the DHCP server.

   • For Satellite Server running Red Hat Enterprise Linux 7:

     # firewall-cmd --add-service dhcp \
     && firewall-cmd --permanent --add-service dhcp

   • For Satellite Server running Red Hat Enterprise Linux 6:

     # iptables -I INPUT -m state --state NEW -p tcp \
     --dport 67 -j ACCEPT \
     && service iptables save

     Verify that the iptables service is started and enabled.

     # service iptables start
     # chkconfig iptables on

8. Determine the UID and GID numbers of the foreman-proxy user on the Capsule Server. Create the same user and group with the same IDs on the DHCP server.

   # groupadd -g 990 foreman-proxy
   # useradd -u 992 -g 990 -s /sbin/nologin foreman-proxy

9. To make the configuration files readable, restore the read and execute flags.

   # chmod o+rx /etc/dhcp/
   # chmod o+r /etc/dhcp/dhcpd.conf
   # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

10. Start the DHCP service.

    1. If you are using Red Hat Enterprise Linux 6, run this command.

       # service dhcpd start

    2. If you are using Red Hat Enterprise Linux 7, run this command.

       # systemctl start dhcpd

11. Export the DHCP configuration and leases files using NFS.

    # yum install nfs-utils
    # systemctl enable rpcbind nfs-server
    # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd

12. Create the DHCP configuration and leases files to be exported using NFS.

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

13. Add the newly created mount point to /etc/fstab file.

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

14. Mount the file systems in /etc/fstab.

    # mount -a

15. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)

    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

    /exports/var/lib/dhcpd
    192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

16. Reload the NFS server.

    # exportfs -rva

17. Configure the firewall for the DHCP omapi port 7911 for the Capsule Server.

    • On Red Hat Enterprise Linux 7, run the following command:

      # firewall-cmd --add-port="7911/tcp" \
      && firewall-cmd --permanent --add-port="7911/tcp"

    • On Red Hat Enterprise Linux 6, run the following commands:

      # iptables -I INPUT -m state --state NEW -p tcp \
      --dport 7911 -j ACCEPT \
      && service iptables save

      Ensure that the iptables service is started and enabled.

      # service iptables start
      # chkconfig iptables on

18. If required, configure the firewall for external access to NFS.

    Clients are configured using NFSv3.

    • On Red Hat Enterprise Linux 7, use the firewalld daemon’s NFS service to configure the firewall.

      # firewall-cmd --zone public --add-service mountd \
      && firewall-cmd --zone public --add-service rpc-bind \
      && firewall-cmd --zone public --add-service nfs \
      && firewall-cmd --permanent --zone public --add-service mountd \
      && firewall-cmd --permanent --zone public --add-service rpc-bind \
      && firewall-cmd --permanent --zone public --add-service nfs

    • On Red Hat Enterprise Linux 6, configure the ports for NFSv3 in the /etc/sysconfig/nfs file.

      LOCKD_TCPPORT=32803
      LOCKD_UDPPORT=32769
      MOUNTD_PORT=892
      RQUOTAD_PORT=875
      STATD_PORT=662
      STATD_OUTGOING_PORT=2020

      Restart the service.

      # service nfs restart

      Add rules to the /etc/sysconfig/iptables file.

      # iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p udp \
      --dport 111 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp \
      --dport 111 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p udp \
      --dport 2049 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp \
      --dport 2049 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp \
      --dport 32803 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p udp \
      --dport 32769 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p udp \
      --dport 892 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp \
      --dport 892 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p udp \
      --dport 875 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp \
      --dport 875 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p udp \
      --dport 662 -j ACCEPT \
      && iptables -I INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp \
      --dport 662 -j ACCEPT \
      && service iptables save

      Restart the firewall.

      # service iptables restart

1. Install the NFS client.

   # yum install nfs-utils

2. Create the DHCP directories for NFS.

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner.

   # chown -R foreman-proxy /mnt/nfs

4. Verify communication with the NFS server and RPC communication paths.

   # showmount -e 192.168.38.2
   # rpcinfo -p 192.168.38.2

5. Add the following lines to the /etc/fstab file:

   192.168.38.2:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0

   192.168.38.2:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems on /etc/fstab.

   # mount -a

7. Read the relevant files.

   # su foreman-proxy -s /bin/bash
   bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   bash-4.2$ exit

8. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file.

   # satellite-installer --foreman-proxy-dhcp=true \
   --foreman-proxy-dhcp-provider=isc \
   --foreman-proxy-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-dhcp-key-name=omapi_key \
   --foreman-proxy-dhcp-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== \
   --foreman-proxy-dhcp-server dhcp.example.com

9. Restart the foreman-proxy service.

   1. If you are using Red Hat Enterprise Linux 6, run this command.

      # service foreman-proxy restart

   2. If you are using Red Hat Enterprise Linux 7, run this command.

      # systemctl restart foreman-proxy

10. Log in to the Satellite Server web UI.
11. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DHCP feature should appear.
12. Associate the DHCP service with the appropriate subnets and domain.

Configure Satellite Server with External TFTP

1. Install and enable the TFTP server.

   # yum install tftp-server syslinux

   1. On Red Hat Enterprise 7, enable and activate the tftp.socket unit.

      # systemctl enable tftp.socket
      # systemctl start tftp.socket

   2. On Red Hat Enterprise Linux 6, enable and start the xinetd service.

      # service xinetd enable
      # service xinetd start

2. Configure the PXELinux environment.

   # mkdir -p /var/lib/tftpboot/{boot,pxelinux.cfg}
   # cp /usr/share/syslinux/{pxelinux.0,menu.c32,chain.c32} \
   /var/lib/tftpboot/

3. Restore SELinux file contexts.

   # restorecon -RvF /var/lib/tftpboot/

4. Create the TFTP directory to be exported using NFS.

   # mkdir -p /exports/var/lib/tftpboot

5. Add the newly created mount point to the /etc/fstab file.

   /var/lib/tftpboot /exports/var/lib/tftpboot none bind,auto 0 0

6. Mount the file systems in /etc/fstab.

   # mount -a

7. Ensure the following lines are present in /etc/exports:

   /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)

   /exports/var/lib/tftpboot 192.168.38.1(rw,async,no_root_squash,no_subtree_check,nohide)

   The first line is common to the DHCP configuration and therefore should already be present if the previous procedure was completed on this system.

8. Reload the NFS server.

   # exportfs -rva

1. Create the TFTP directory to prepare for NFS.

   # mkdir -p /mnt/nfs/var/lib/tftpboot

2. Add the following line in the /etc/fstab file:

   192.168.38.2:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0

3. Mount the file systems in /etc/fstab.

   # mount -a

4. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file.

   # satellite-installer --foreman-proxy-tftp=true \
   --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot

5. If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of that server.

   # satellite-installer --foreman-proxy-tftp-servername=new_FQDN

   This updates all configuration files with the new value.

6. Log in to the Satellite Server web UI.
7. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The TFTP feature should appear.
8. Associate the TFTP service with the appropriate subnets and domain.

Upgrade Satellite Server

1. Create a backup.

   • On a virtual machine, take a snapshot.
   • On a physical machine, create a backup.

2. A pre-upgrade script is available to detect conflicts and list hosts which have duplicate entries in Satellite Server that can be unregistered and deleted after upgrade. In addition, it will detect hosts which are not assigned to an organization. If a host is listed under Hosts > All hosts without an organization association and if a content host with same name has an organization already associated with it then the content host will automatically be unregistered. This can be avoided by associating such hosts to an organization before upgrading.

   Run the pre-upgrade check script to get a list of hosts that can be deleted after upgrading. If any unassociated hosts are found, associating them to an organization before upgrading is recommended.

   1. To use the pre-upgrade script, ensure you have ruby193-rubygem-katello-2.2.0.90-1-sat or later.

      # yum update ruby193-rubygem-katello

   2. Run the pre-upgrade check script to get a list of hosts that can be deleted after upgrading. If any unassociated hosts are found, associating them to an organization before upgrading is recommended.

      # foreman-rake katello:upgrade_check

      If the upgrade check reports a failure due to running tasks, then it is recommended that you wait for the tasks to complete. It is possible to cancel some tasks, but you should follow the guidance in the Red Hat Knowledgebase solution How to manage paused tasks on Red Hat Satellite 6 to understand which tasks are safe to cancel and which are not safe to cancel.

3. Backup the DNS and DHCP configuration files /etc/zones.conf and /etc/dhcp/dhcpd.conf as the installer only supports one domain or subnet, and therefore restoring changes from these backups might be required.

4. If you have made manual edits to DNS or DHCP configuration files and do not want the changes overwritten, run the following command.

   # katello-installer --capsule-dns-managed=false \
   --capsule-dhcp-managed=false

5. Disable the repository for Red Hat Satellite 6.1.

   • On Red Hat Enterprise Linux 6, run the following command:

     # subscription-manager repos \
     --disable rhel-6-server-satellite-6.1-rpms

   • On Red Hat Enterprise Linux 7, run the following command:

     # subscription-manager repos \
     --disable rhel-7-server-satellite-6.1-rpms

6. If required, to verify that the Satellite 6.1 repositories are now disabled, enter a command as follows:

   # subscription-manager repos --list-enabled

7. Enable the repositories for Red Hat Satellite 6.2.

   • On Red Hat Enterprise Linux 6, run the following command:

     # subscription-manager repos --enable=rhel-6-server-rpms \
     --enable=rhel-server-rhscl-6-rpms \
     --enable=rhel-6-server-satellite-6.2-rpms

   • On Red Hat Enterprise Linux 7, run the following command:

     # subscription-manager repos --enable=rhel-7-server-rpms \
     --enable=rhel-server-rhscl-7-rpms \
     --enable=rhel-7-server-satellite-6.2-rpms

8. Clear out any metadata left from any non-Red Hat yum repositories.

   # yum clean all

9. Verify that the repositories have been enabled.

   # yum repolist enabled

   Output similar to the following displays:

   Loaded plugins: product-id, subscription-manager
   repo id                                        repo name                                                                   status
   !rhel-7-server-rpms/x86_64                     Red Hat Enterprise Linux 7 Server (RPMs)                                    9,889
   !rhel-7-server-satellite-6.2-rpms/x86_64       Red Hat Satellite 6.2 (for RHEL 7 Server) (RPMs)                            545
   !rhel-server-rhscl-7-rpms/x86_64               Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server     4,279
   repolist: 14,713

10. In the Satellite web UI, go to Hosts > Discovered hosts. If there are discovered hosts available, turn them off and then delete all entries under the Discovered hosts page. Select all other organizations in turn using the organization setting menu and repeat this action as required. Reboot these hosts after the upgrade has completed.
11. Make sure all external Capsule Servers are assigned to an organization, otherwise they might get unregistered due to host-unification changes.

12. Configure the repositories in the Satellite web UI.

    1. In the Satellite web UI, go to Content > Red Hat Repositories and select the RPM tab.
    2. Find and expand the Red Hat Enterprise Linux Server Product.
    3. Find and expand Red Hat Satellite Tools 6.2 (for Red Hat Enterprise Linux X Server) (RPMs).
    4. Select Red Hat Satellite Tools 6.2 for Red Hat Enterprise Linux X Server RPMs x86_64.

13. Synchronize the newly enabled repositories.

    1. In the Satellite web UI, go to Content > Sync Status.
    2. Click the arrow next to the product to view available repositories.
    3. Select the repositories for 6.2.

    4. Click Synchronize Now.

       If you get an error when trying to update the Satellite Tools repository, make sure you DO NOT delete the manifest from the Customer Portal or in the Satellite Web UI as this will unregister all of your content hosts. See the Red Hat Knowledgebase solution Cannot enable Red Hat Satellite Tools Repo on Satellite 6.2 for more information.

14. Update any pre-existing Content Views that utilize 6.1 version repositories with the new version for 6.2. Publish and promote updated versions of any Content Views that now have the new 6.2 version repositories.

15. Clear the repository cache.

    # yum clean all

16. Run the upgrade check again to ensure that the steps that we have already undertaken have not resulted in a situation in which tasks might get stuck during the upgrade:

    # foreman-rake katello:upgrade_check

17. Stop Katello services.

    # katello-service stop

18. Update all packages.

    # yum update

19. If you have custom Apache server configurations, they will be reverted to the installation defaults in the next step. If you want to see what will be changed when you perform the upgrade, you can enter the upgrade command with the --noop (no operation) option and review the changes that will be applied when you enter the upgrade command in the following step. If you choose not to do this test, skip to the next step now. Alternatively, proceed as follows:

    1. Add the following line to the /etc/httpd/conf/httpd.conf configuration file.

       Include /etc/httpd/conf.modules.d/*.conf

    2. Restart the httpd service.

       • On Red Hat Enterprise Linux 6, enter the following command:

         # service httpd restart

       • On Red Hat Enterprise Linux 7, enter the following command:

         # systemctl restart httpd

    3. Start the postgresql and mongod database services.

       • On Red Hat Enterprise Linux 6, enter the following command:

         # service postgresql start
         # service mongod start

       • On Red Hat Enterprise Linux 7, enter the following command:

         # systemctl start postgresql
         # systemctl start mongod

    4. Enter the command with the --noop option as follows.

       # satellite-installer --scenario satellite --upgrade --verbose --noop

       Review the /var/log/foreman-installer/satellite.log to see what changes would be applied if the --noop option was omitted. Look for the +++ and --- symbols indicating changes to configurations files. Because the above "no operation" command does not actually create the files, and some Puppet resources in the module expect them to be there, some failure messages are to be expected.

    5. Stop Katello services.

       # katello-service stop

20. Perform the upgrade by running the installer script with the --upgrade option.

    # satellite-installer --scenario satellite --upgrade

    Warning

    If you run the command from a directory containing a config subdirectory, you will encounter the following error:

    ERROR: Scenario (config/satellite.yaml) was not found, can not continue.

    In such a case, change directory, for example to the root user’s home directory, and run the command again.

21. Check and restore any changes required to the DNS and DHCP configuration files using the backups made earlier.

22. If you made changes in the previous step, restart Katello services.

    # katello-service restart

23. Update the Discovery template in the Satellite web UI.

    1. Go to Hosts > Provisioning templates.
    2. Select PXELinux global default.

    3. In the Template editor dialog box, edit the PXELinux global default template discovery menu entry, updating the stanza that begins with LABEL discovery to match the following text:

       LABEL discovery
       MENU LABEL Satellite 6 Discovery
       MENU DEFAULT
       KERNEL boot/fdi-image-rhel_7-vmlinuz
       APPEND initrd=boot/fdi-image-rhel_7-img rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=https://SATELLITE_CAPSULE_URL:9090 proxy.type=proxy
       IPAPPEND 2

       • The proxy.type option can be either proxy or foreman. For proxy, all communication goes through the Capsule. For foreman, the communication goes directly to Satellite Server.
       • The proxy.url specifies the URL of the Satellite Capsule or Server. Both HTTP and HTTPS protocols are supported.

24. If you have the OpenSCAP plug-in installed, but do not have the default OpenSCAP content available, run the following command.

    # foreman-rake foreman_openscap:bulk_upload:default

25. In the Satellite web UI, go to Configure > Discovery Rules and associate selected organizations and locations with discovery rules.

26. After upgrading, add the --assumeyes parameter to katello-backup commands in your backup script.

    From Satellite 6.2.13, you must add the --assumeyes parameter because the katello-backup command prompts for confirmation that the backup is to proceed. For more information about backing up Satellite Server, see Backup and Disaster Recovery in the Server Administration Guide.

Upgrade Disconnected Satellite Server

1. Create a backup.

   • On a virtual machine, take a snapshot.
   • On a physical machine, create a backup.

2. A pre-upgrade script is available to detect conflicts and list hosts which have duplicate entries in Satellite Server that can be unregistered and deleted after upgrade. In addition, it will detect hosts which are not assigned to an organization. If a host is listed under Hosts > All hosts without an organization association and if a content host with same name has an organization already associated with it then the content host will automatically be unregistered. This can be avoided by associating such hosts to an organization before upgrading.

   Run the pre-upgrade check script to get a list of hosts that can be deleted after upgrading. If any unassociated hosts are found, associating them to an organization before upgrading is recommended.

   1. To use the pre-upgrade script, ensure you have ruby193-rubygem-katello-2.2.0.90-1-sat or later.

      # yum update ruby193-rubygem-katello

   2. Run the pre-upgrade check script to get a list of hosts that can be deleted after upgrading. If any unassociated hosts are found, associating them to an organization before upgrading is recommended.

      # foreman-rake katello:upgrade_check

      If the upgrade check reports a failure due to running tasks, then it is recommended that you wait for the tasks to complete. It is possible to cancel some tasks, but you should follow the guidance in the Red Hat Knowledgebase solution How to manage paused tasks on Red Hat Satellite 6 to understand which tasks are safe to cancel and which are not safe to cancel.

3. Backup the DNS and DHCP configuration files /etc/zones.conf and /etc/dhcp/dhcpd.conf as the installer only supports one domain or subnet, and therefore restoring changes from these backups might be required.

4. If you have made manual edits to DNS or DHCP configuration files and do not want the changes overwritten, run the following command.

   # katello-installer --capsule-dns-managed=false \
   --capsule-dhcp-managed=false

5. In the Satellite web UI, go to Hosts > Discovered hosts. If there are discovered hosts available, turn them off and then delete all entries under the Discovered hosts page. Select all other organizations in turn using the organization setting menu and repeat this action as required. Reboot these hosts after the upgrade has completed.
6. Make sure all external Capsule Servers are assigned to an organization, otherwise they might get unregistered due to host-unification changes.

7. Stop Katello services.

   # katello-service stop

8. Obtain the ISO file, mount it, and install the packages. For more information, see Section 3.2, “Downloading and Installing from a Disconnected Network”.

9. If you have custom Apache server configurations, they will be reverted to the installation defaults in the next step. If you want to see what will be changed when you perform the upgrade, you can enter the upgrade command with the --noop (no operation) option and review the changes that will be applied when you enter the upgrade command in the following step. If you choose not to do this test, skip to the next step now. Alternatively, proceed as follows:

   1. Add the following line to the /etc/httpd/conf/httpd.conf configuration file.

      Include /etc/httpd/conf.modules.d/*.conf

   2. Restart the httpd service.

      • On Red Hat Enterprise Linux 6, enter the following command:

        # service httpd restart

      • On Red Hat Enterprise Linux 7, enter the following command:

        # systemctl restart httpd

   3. Start the postgresql and mongod database services.

      • On Red Hat Enterprise Linux 6, enter the following command:

        # service postgresql start
        # service mongod start

      • On Red Hat Enterprise Linux 7, enter the following command:

        # systemctl start postgresql
        # systemctl start mongod

   4. Enter the command with the --noop option as follows.

      # satellite-installer --scenario satellite --upgrade --verbose --noop

      Review the /var/log/foreman-installer/satellite.log to see what changes would be applied if the --noop option was omitted. Look for the +++ and --- symbols indicating changes to configurations files. Because the above "no operation" command does not actually create the files, and some Puppet resources in the module expect them to be there, some failure messages are to be expected.

   5. Stop Katello services.

      # katello-service stop

10. Perform the upgrade by running the installer script with the --upgrade option.

    # satellite-installer --scenario satellite --upgrade

    Warning

    If you run the command from a directory containing a config subdirectory, you will encounter the following error:

    ERROR: Scenario (config/satellite.yaml) was not found, can not continue.

    In such a case, change directory, for example to the root user’s home directory, and run the command again.

11. Check and restore any changes required to the DNS and DHCP configuration files using the backups made earlier.

12. If you made changes in the previous step, restart Katello services.

    # katello-service restart

13. Update the Discovery template in the Satellite web UI.

    1. Go to Hosts > Provisioning templates.
    2. Select PXELinux global default.

    3. In the Template editor dialog box, edit the PXELinux global default template discovery menu entry, updating the stanza that begins with LABEL discovery to match the following text:

       LABEL discovery
       MENU LABEL Satellite 6 Discovery
       MENU DEFAULT
       KERNEL boot/fdi-image-rhel_7-vmlinuz
       APPEND initrd=boot/fdi-image-rhel_7-img rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=https://SATELLITE_CAPSULE_URL:9090 proxy.type=proxy
       IPAPPEND 2

       • The proxy.type option can be either proxy or foreman. For proxy, all communication goes through the Capsule. For foreman, the communication goes directly to Satellite Server.
       • The proxy.url specifies the URL of the Satellite Capsule or Server. Both HTTP and HTTPS protocols are supported.

14. If you have the OpenSCAP plug-in installed, but do not have the default OpenSCAP content available, run the following command.

    # foreman-rake foreman_openscap:bulk_upload:default

15. In the Satellite web UI, go to Configure > Discovery Rules and associate selected organizations and locations with discovery rules.

16. After upgrading, add the --assumeyes parameter to katello-backup commands in your backup script.

    From Satellite 6.2.13, you must add the --assumeyes parameter because the katello-backup command prompts for confirmation that the backup is to proceed. For more information about backing up Satellite Server, see Backup and Disaster Recovery in the Server Administration Guide.

Upgrading Capsule Servers

1. Create a backup.

   • On a virtual machine, take a snapshot.
   • On a physical machine, create a backup.
2. Backup the DNS and DHCP configuration files /etc/zones.conf and /etc/dhcp/dhcpd.conf as the installer only supports one domain or subnet, and therefore restoring changes from these backups might be required.

3. If you have made manual edits to DNS or DHCP configuration files and do not want the changes overwritten, enter the following command.

   # capsule-installer --foreman-proxy-dns-managed=false \
   --foreman-proxy-dhcp-managed=false

4. Disable the repository for Red Hat Satellite 6.1.

   • On Red Hat Enterprise Linux 6, run the following command:

     # subscription-manager repos \
     --disable rhel-6-server-satellite-capsule-6.1-rpms

   • On Red Hat Enterprise Linux 7, run the following command:

     # subscription-manager repos \
     --disable rhel-7-server-satellite-capsule-6.1-rpms

5. Enable the new repositories.

   The Red Hat Software Collections repository provides a later version of Ruby required by some Red Hat Satellite features, including the Remote Execution feature.

   • On Red Hat Enterprise Linux 7, run the following command:

     # subscription-manager repos \
     --enable rhel-7-server-satellite-capsule-6.2-rpms \
     --enable rhel-server-rhscl-7-rpms

   • On Red Hat Enterprise Linux 6, run the following command:

     # subscription-manager repos \
     --enable rhel-6-server-satellite-capsule-6.2-rpms \
     --enable rhel-server-rhscl-6-rpms

6. In the Satellite web UI, go to Hosts > Discovered hosts. If there are discovered hosts available, turn them off and then delete all entries under the Discovered hosts page. Select all other organizations in turn using the organization setting menu and repeat this action as required. Reboot these hosts after the upgrade has completed.

7. Clear the repository cache.

   # yum clean all

8. Stop Katello services:

   # katello-service stop

9. Update all packages.

   # yum update

10. On the Satellite Server, generate an archive with new certificates.

    # capsule-certs-generate --capsule-fqdn "mycapsule.example.com" \
    --certs-tar "mycapsule.example.com-certs.tar"

    You should replace mycapsule.example.com with the fully qualified domain name of the Capsule Server.

11. Copy the archive file to the Capsule Server.

    # scp mycapsule.example.com-certs.tar mycapsule.example.com:~/

    Warning

    Do not remove the certificate archive file after the upgrade, it is required for future updates.

12. If you plan to use Capsule Server as a proxy for discovered hosts, install the Discovery plug-in.

    # yum install rubygem-smart_proxy_discovery.noarch

13. On the Capsule Server, verify that the foreman_url setting is correct.

    # grep foreman_url /etc/foreman-proxy/settings.yml

    The fully qualified domain name of the Satellite Server should display.

14. If you have custom Apache server configurations, they will be reverted to the installation defaults in the next step. If you want to see what will be changed when you perform the upgrade, you can enter the upgrade command with the --noop (no operation) option and review the changes that will be applied when you enter the upgrade command in the following step. If you choose not to do this test, skip to the next step now. Alternatively, proceed as follows:

    1. Add the following line to the /etc/httpd/conf/httpd.conf configuration file.

       Include /etc/httpd/conf.modules.d/*.conf

    2. Restart the httpd service.

       • On Red Hat Enterprise Linux 6, enter the following command:

         # service httpd restart

       • On Red Hat Enterprise Linux 7, enter the following command:

         # systemctl restart httpd

    3. Start the mongod database service.

       • On Red Hat Enterprise Linux 6, enter the following command:

         # service mongod start

       • On Red Hat Enterprise Linux 7, enter the following command:

         # systemctl start mongod

    4. Enter the command with the --noop option as follows.

       # satellite-installer --scenario capsule --upgrade --verbose --noop

       Review the /var/log/foreman-installer/capsule.log to see what changes would be applied if the --noop option was omitted. Look for the +++ and --- symbols indicating changes to configurations files. Because the above "no operation" command does not actually create the files, and some Puppet resources in the module expect them to be there, some failure messages are to be expected.

    5. Stop Katello services.

       # katello-service stop

15. Perform the upgrade by running the installer script with the --upgrade option, and specify the path to the certificate archive previously created on the Satellite Server.

    # satellite-installer --scenario capsule --upgrade \
    --capsule-certs-tar mycapsule.example.com-certs.tar

    Warning

    If you run the command from a directory containing a config subdirectory, you will encounter the following error:

    ERROR: Scenario (config/capsule.yaml) was not found, can not continue.

    In such a case, change directory, for example to the root user’s home directory, and run the command again.

16. Check and restore any changes required to the DNS and DHCP configuration files using the backups made earlier.
17. Upgrade the foreman-discovery package on Satellite Server and turn on the hosts that were shut down prior to the upgrade.

18. After upgrading, add the --assumeyes parameter to katello-backup commands in your backup script.

    From Satellite 6.2.13, you must add the --assumeyes parameter because the katello-backup command prompts for confirmation that the backup is to proceed. For more information about backing up Satellite Server, see Backup and Disaster Recovery in the Server Administration Guide.

1. Verify that all relevant packages are current on the Satellite Server.

   # yum upgrade tfm-rubygem-foreman_discovery

2. Restart Katello services, if applicable.

   # katello-service restart

3. Upgrade the Discovery image on the Satellite Capsule that is either connected to the provisioning network with discovered hosts or provides TFTP services for discovered hosts.

   # yum upgrade foreman-discovery-image

4. On the same instance, install the package which provides the Proxy service, and then restart foreman-proxy service.

   # yum install rubygem-smart_proxy_discovery
   # service foreman-proxy restart

5. In the Satellite web UI, go to Infrastructure > Capsules and verify that the relevant proxy lists the Discovery feature. Click Refresh features if necessary.
6. Go to Infrastructure > Subnets and select the required Smart Proxy for each subnet on which you want to use discovery, and verify that it is connected to the Discovery Proxy.

1. Go to Hosts > Provisioning Templates.
2. Select PXELinux global default.

3. In the Template editor dialog box, edit the PXELinux global default template discovery menu entry, updating the stanza that begins with LABEL discovery to match the following text:

   LABEL discovery
   MENU LABEL Satellite 6 Discovery
   MENU DEFAULT
   KERNEL boot/fdi-image-rhel_7-vmlinuz
   APPEND initrd=boot/fdi-image-rhel_7-img rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=https://SATELLITE_CAPSULE_URL:9090 proxy.type=proxy
   IPAPPEND 2

   • The proxy.type option can be either proxy or foreman. For proxy, all communication goes through the Capsule. For foreman, the communication goes directly to Satellite Server.
   • The proxy.url specifies the URL of the Satellite Capsule or Server. Both HTTP and HTTPS protocols are supported.
   • You can omit the proxy.url option and determine the Capsule DNS name from its SRV record. This is useful if there are multiple discovery subnets. For more information, see Configuring PXE-booting in the Red Hat Satellite Host Configuration Guide.

Upgrade Satellite Clients Using the satellite-tools-upgrade Package

1. In the Satellite web UI, go to Hosts > Content Hosts or Host Collections and select the Content Hosts to be upgraded.

2. On the Packages tab, enter the package name satellite-tools-upgrade in the search field.

   1. If upgrading a single host using the Content Host view, select Perform to install the package.
   2. If upgrading a collection of hosts using the Bulk Actions view, select Install to install the package.

3. On the Packages tab, enter the package name katello-agent in the search field.

   1. If upgrading a single host using the Content Host view, select Package Update and then Perform to update the package.
   2. If upgrading a collection of hosts using the Bulk Actions view, select Update to update the package.

Upgrade Satellite Clients Manually

1. Log into the client system.

2. Disable the repositories for the previous version of Satellite.

   • On Red Hat Enterprise Linux 7, run the following command:

     # subscription-manager repos \
     --disable rhel-7-server-satellite-tools-6.1-rpms

   • On Red Hat Enterprise Linux 6, run the following command:

     # subscription-manager repos \
     --disable rhel-6-server-satellite-tools-6.1-rpms

3. Enable the Satellite tools repository for this version of Satellite.

   • On Red Hat Enterprise Linux 7, run the following command:

     # subscription-manager repos \
     --enable=rhel-7-server-satellite-tools-6.2-rpms

   • On Red Hat Enterprise Linux 6, run the following command:

     # subscription-manager repos \
     --enable=rhel-6-server-satellite-tools-6.2-rpms

4. Upgrade the Katello Agent package.

   # yum upgrade katello-agent

Upgrade Self-Registered Satellite Server

1. Create a backup.

   • On a virtual machine, take a snapshot.
   • On a physical machine, create a backup.

2. A pre-upgrade script is available to detect conflicts and list hosts which have duplicate entries in Satellite Server that can be unregistered and deleted after upgrade. In addition, it will detect hosts which are not assigned to an organization. If a host is listed under Hosts > All hosts without an organization association and if a content host with same name has an organization already associated with it then the content host will automatically be unregistered. This can be avoided by associating such hosts to an organization before upgrading.

   Run the pre-upgrade check script to get a list of hosts that can be deleted after upgrading. If any unassociated hosts are found, associating them to an organization before upgrading is recommended.

   1. To use the pre-upgrade script, ensure you have ruby193-rubygem-katello-2.2.0.90-1-sat or later.

      # yum update ruby193-rubygem-katello

   2. Run the pre-upgrade check script to get a list of hosts that can be deleted after upgrading. If any unassociated hosts are found, associating them to an organization before upgrading is recommended.

      # foreman-rake katello:upgrade_check

      If the upgrade check reports a failure due to running tasks, then it is recommended that you wait for the tasks to complete. It is possible to cancel some tasks, but you should follow the guidance in the Red Hat Knowledgebase solution How to manage paused tasks on Red Hat Satellite 6 to understand which tasks are safe to cancel and which are not safe to cancel.

3. Backup the DNS and DHCP configuration files /etc/zones.conf and /etc/dhcp/dhcpd.conf as the installer only supports one domain or subnet, and therefore restoring changes from these backups might be required.

4. If you have made manual edits to DNS or DHCP configuration files and do not want the changes overwritten, run the following command.

   # katello-installer --capsule-dns-managed=false \
   --capsule-dhcp-managed=false

5. List the enabled repositories:

   # subscription-manager repos --list-enabled

6. Ensure you have the following repositories enabled and no others:

   rhel-X-server-satellite-tools-6.1-rpms
   rhel-server-rhscl-X-rpms
   rhel-X-server-satellite-6.1-rpms
   rhel-X-server-rpms

   Where X is the major version of the base system. If other repositories are found, follow the Section 3.1.3, “Configuring Repositories” procedure to remove them.

7. Disable the repositories for the previous version of Satellite on the base system.

   • On Red Hat Enterprise Linux 6, enter the following commands:

     # subscription-manager repos \
     --disable rhel-6-server-satellite-6.1-rpms
     # subscription-manager repos \
     --disable rhel-6-server-satellite-tools-6.1-rpms

   • On Red Hat Enterprise Linux 7, enter the following commands:

     # subscription-manager repos \
     --disable rhel-7-server-satellite-6.1-rpms
     # subscription-manager repos \
     --disable rhel-7-server-satellite-tools-6.1-rpms

8. If required, to verify that the Satellite 6.1 repositories are now disabled, enter a command as follows:

   # subscription-manager repos --list-enabled

9. Configure the repositories in the Satellite web UI.

   1. In the Satellite web UI, go to Content > Red Hat Repositories and select the RPM tab.
   2. Find and expand the Red Hat Satellite Product.
   3. Find and expand the Repository Set Red Hat Satellite 6.1 (for Red Hat Enterprise Linux X Server) (RPMs).
   4. Unselect Red Hat Satellite 6.1 for Red Hat Enterprise Linux X Server RPMs x86_64.
   5. Find and expand the Repository Set Red Hat Satellite 6.2 (for Red Hat Enterprise Linux X Server) (RPMs).
   6. Select Red Hat Satellite 6.2 for Red Hat Enterprise Linux X Server RPMs x86_64.
   7. Find and expand the Red Hat Enterprise Linux Server Product.
   8. Find and expand Red Hat Satellite Tools 6.2 (for Red Hat Enterprise Linux X Server) (RPMs).
   9. Select Red Hat Satellite Tools 6.2 for Red Hat Enterprise Linux X Server RPMs x86_64.
   10. In the Other tab, find and expand Red Hat Software Collections for RHEL Server.
   11. Find and expand Red Hat Software Collections RPMs (for Red Hat Enterprise Linux X Server).
   12. Select Red Hat Software Collections RPMs for Red Hat Enterprise Linux X Server x86_64.

10. Synchronize the newly enabled repositories.

    1. In the Satellite web UI, go to Content > Sync Status.
    2. Click the arrow next to the product to view available repositories.
    3. Select the repositories for 6.2.

    4. Click Synchronize Now.

       If you get an error when trying to update the Satellite Tools repository, make sure you DO NOT delete the manifest from the Customer Portal or in the Satellite Web UI as this will unregister all of your content hosts. See the Red Hat Knowledgebase solution Cannot enable Red Hat Satellite Tools Repo on Satellite 6.2 for more information.

11. Update any pre-existing Content Views that utilize 6.1 version repositories with the new version for 6.2. Publish and promote updated versions of any Content Views that now have the new 6.2 version repositories.

12. Enable the new repositories on the base system when the repositories have finished synchronizing.

    • On Red Hat Enterprise Linux 6, enter the following commands:

      # subscription-manager repos \
      --enable rhel-6-server-satellite-6.2-rpms \
      --enable rhel-6-server-satellite-tools-6.2-rpms \
      --enable rhel-6-server-rpms \
      --enable rhel-server-rhscl-6-rpms

    • On Red Hat Enterprise Linux 7, enter the following commands:

      # subscription-manager repos \
      --enable rhel-7-server-satellite-6.2-rpms \
      --enable rhel-7-server-satellite-tools-6.2-rpms \
      --enable rhel-7-server-rpms \
      --enable rhel-server-rhscl-7-rpms

13. In the Satellite web UI, go to Hosts > Discovered hosts. If there are discovered hosts available, turn them off and then delete all entries under the Discovered hosts page. Select all other organizations in turn using the organization setting menu and repeat this action as required. Reboot these hosts after the upgrade has completed.
14. Make sure all external Capsule Servers are assigned to an organization, otherwise they might get unregistered due to host-unification changes.

15. Clear the repository cache.

    # yum clean all

16. Download the following packages.

    # yum install --downloadonly rubygem-smart_proxy_remote_execution_ssh \
    rubygem-smart_proxy_openscap rubygem-smart_proxy_dynflow \
    tfm-rubygem-smart_proxy_dynflow_core \
    tfm-rubygem-foreman_remote_execution katello-client-bootstrap

17. Download all updated packages.

    # yum update --downloadonly

18. Stop Katello services.

    # katello-service stop

19. Install the previously downloaded packages.

    # yum install rubygem-smart_proxy_remote_execution_ssh \
    rubygem-smart_proxy_openscap rubygem-smart_proxy_dynflow \
    tfm-rubygem-smart_proxy_dynflow_core \
    tfm-rubygem-foreman_remote_execution katello-client-bootstrap

20. Install all updated packages from the yum cache.

    # yum update --cacheonly

21. If you have custom Apache server configurations, they will be reverted to the installation defaults in the next step. If you want to see what will be changed when you perform the upgrade, you can enter the upgrade command with the --noop (no operation) option and review the changes that will be applied when you enter the upgrade command in the following step. If you choose not to do this test, skip to the next step now. Alternatively, proceed as follows:

    1. Add the following line to the /etc/httpd/conf/httpd.conf configuration file.

       Include /etc/httpd/conf.modules.d/*.conf

    2. Restart the httpd service.

       • On Red Hat Enterprise Linux 6, enter the following command:

         # service httpd restart

       • On Red Hat Enterprise Linux 7, enter the following command:

         # systemctl restart httpd

    3. Start the postgresql and mongod database services.

       • On Red Hat Enterprise Linux 6, enter the following command:

         # service postgresql start
         # service mongod start

       • On Red Hat Enterprise Linux 7, enter the following command:

         # systemctl start postgresql
         # systemctl start mongod

    4. Enter the command with the --noop option as follows.

       # satellite-installer --scenario satellite --upgrade --verbose --noop

       Review the /var/log/foreman-installer/satellite.log to see what changes would be applied if the --noop option was omitted. Look for the +++ and --- symbols indicating changes to configurations files. Because the above "no operation" command does not actually create the files, and some Puppet resources in the module expect them to be there, some failure messages are to be expected.

    5. Stop Katello services.

       # katello-service stop

22. Perform the upgrade by running the installer script with the --upgrade option.

    # satellite-installer --scenario satellite --upgrade

    Warning

    If you run the command from a directory containing a config subdirectory, you will encounter the following error:

    ERROR: Scenario (config/satellite.yaml) was not found, can not continue.

    In such a case, change directory, for example to the root user’s home directory, and run the command again.

23. Check and restore any changes required to the DNS and DHCP configuration files using the backups made earlier.

24. If you made changes in the previous step, restart Katello services.

    # katello-service restart

25. Update the Discovery template in the Satellite web UI.

    1. Go to Hosts > Provisioning templates.
    2. Select PXELinux global default.

    3. In the Template editor dialog box, edit the PXELinux global default template discovery menu entry, updating the stanza that begins with LABEL discovery to match the following text:

       LABEL discovery
       MENU LABEL Satellite 6 Discovery
       MENU DEFAULT
       KERNEL boot/fdi-image-rhel_7-vmlinuz
       APPEND initrd=boot/fdi-image-rhel_7-img rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=https://SATELLITE_CAPSULE_URL:9090 proxy.type=proxy
       IPAPPEND 2

       • The proxy.type option can be either proxy or foreman. For proxy, all communication goes through the Capsule. For foreman, the communication goes directly to Satellite Server.
       • The proxy.url specifies the URL of the Satellite Capsule or Server. Both HTTP and HTTPS protocols are supported.

26. If you have the OpenSCAP plug-in installed, but do not have the default OpenSCAP content available, run the following command.

    # foreman-rake foreman_openscap:bulk_upload:default

27. In the Satellite web UI, go to Configure > Discovery Rules and associate selected organizations and locations with discovery rules.

28. Synchronize the Satellite Server with the Red Hat Customer Portal.

    1. Go to Content > Sync Status.

       A list of product repositories available for synchronization is displayed.

    2. Click the arrow next to the product content to view available content.
    3. Select the content you want to synchronize.

    4. Click Synchronize Now.

       Content synchronization can take a long time and it depends on the speed of disk drives, network connection speed, and the amount of content selected for synchronization.

29. (Optional) Publish the required Content Views.

    You must publish the Content View so that it is visible and usable by hosts. Before publishing, you should ensure that the Content View definition has the necessary products, repositories, and filters.

    1. From the Main Menu, select Content > Content Views.
    2. From the Name column, select the Satellite Server Content View.
    3. Click Publish New Version.
    4. Enter a comment and click Save.

30. (Optional) Promote the Content View.

    1. From the Main Menu, select Content > Content Views.
    2. In the Name column, select the Satellite Server Content View.
    3. On the Versions tab, select the latest version and click Promote.

    4. Identify the promotion path, select the appropriate life-cycle environment, and click Promote Version.

       When the operation completes, you can see the updated Content View status on the Versions tab.

31. After upgrading, add the --assumeyes parameter to katello-backup commands in your backup script.

    From Satellite 6.2.13, you must add the --assumeyes parameter because the katello-backup command prompts for confirmation that the backup is to proceed. For more information about backing up Satellite Server, see Backup and Disaster Recovery in the Server Administration Guide.

To Update Satellite Server:

1. Check that only the correct repositories are enabled:

   1. List the enabled repositories:

      # subscription-manager repos --list-enabled

   2. Ensure you only have the following repositories enabled:

      rhel-X-server-rpms
      rhel-X-server-satellite-6.2-rpms
      rhel-server-rhscl-X-rpms

      Where X is the major version of Red Hat Enterprise Linux you are using. If required, see Section 3.1.3, “Configuring Repositories” for more information on disabling and enabling repositories. If you have a self-registered Satellite, the rhel-X-server-satellite-tools-6.2-rpms repository, which provides Katello Agent, can also be present. If required, see Section 4.7.1, “Installing the katello Agent” for more information.

2. If you are on a self-registered Satellite, download all packages before stopping Satellite Server:

   # yum update --downloadonly

   This step is optional for Satellites which are not self-registered.

3. Stop Katello services:

   # katello-service stop

4. Update all packages:

   # yum update

   For a self-registered Satellite, enter the following command:

   # yum update --cache --disableplugin=enabled_repos_upload \
   --disableplugin=package_upload \
   --disableplugin=subscription-manager

   If a kernel update occurs, make a note to reboot after the upgrade is complete. Do not reboot at this point.

5. If you have custom Apache server configurations, they will be reverted to the installation defaults in the next step. If you want to see what will be changed when you perform the upgrade, you can enter the upgrade command with the --noop (no operation) option and review the changes that will be applied when you enter the upgrade command in the following step. If you choose not to do this test, skip to the next step now. Alternatively, proceed as follows:

   1. Add the following line to the /etc/httpd/conf/httpd.conf configuration file.

      Include /etc/httpd/conf.modules.d/*.conf

   2. Restart the httpd service.

      • On Red Hat Enterprise Linux 6, enter the following command:

        # service httpd restart

      • On Red Hat Enterprise Linux 7, enter the following command:

        # systemctl restart httpd

   3. Start the postgresql and mongod database services.

      • On Red Hat Enterprise Linux 6, enter the following command:

        # service postgresql start
        # service mongod start

      • On Red Hat Enterprise Linux 7, enter the following command:

        # systemctl start postgresql
        # systemctl start mongod

6. Enter the command with the --noop option as follows.

   # satellite-installer --scenario satellite --upgrade --verbose --noop

   Review the /var/log/foreman-installer/satellite.log to see what changes would be applied if the --noop option was omitted. Look for the +++ and --- symbols indicating changes to configurations files. Because the above "no operation" command does not actually create the files, and some Puppet resources in the module expect them to be there, some failure messages are to be expected.

7. Stop Katello services.

   # katello-service stop

8. Perform the update by running the installer script with the --upgrade option.

   # satellite-installer --scenario satellite --upgrade

9. If a kernel update occurred during the yum update step, reboot the system:

   # reboot

10. If you are on a self-registered Satellite, and did not reboot the system in the previous step, restart goferd:

    • On Red Hat Enterprise Linux 6, run the following command:

      # service goferd restart

    • On Red Hat Enterprise Linux 7, run the following command:

      # systemctl restart goferd

11. If you have updated from Satellite 6.2.12 or lower, add the --assumeyes parameter to katello-backup commands in your backup script if it is not there yet.

    From Satellite 6.2.13, you must add the --assumeyes parameter because the katello-backup command prompts for confirmation that the backup is to proceed. For more information about backing up Satellite Server, see Backup and Disaster Recovery in the Server Administration Guide.

To Update a Capsule Server:

1. Check that only the correct repositories are enabled:

   1. List the enabled repositories:

      # subscription-manager repos --list-enabled

   2. Ensure you only have the following repositories enabled:

      rhel-X-server-rpms
      rhel-X-server-satellite-capsule-6.2-rpms
      rhel-server-rhscl-X-rpms
      rhel-X-server-satellite-tools-6.2-rpms

      Where X is the major version of Red Hat Enterprise Linux you are using. If required, see Section 4.3, “Configuring Repositories” for more information on disabling and enabling repositories. The rhel-X-server-satellite-tools-6.2-rpms repository provides Katello Agent. If required, see Section 4.7.1, “Installing the katello Agent” for more information. The Red Hat Software Collections repository is optional, it is required for the Remote Execution feature.

2. Stop Katello services:

   # katello-service stop

3. Update all packages:

   # yum update

   If a kernel update occurs, make a note to reboot after the upgrade is complete. Do not reboot at this point.

4. If you have custom Apache server configurations, they will be reverted to the installation defaults in the next step. If you want to see what will be changed when you perform the upgrade, you can enter the upgrade command with the --noop (no operation) option and review the changes that will be applied when you enter the upgrade command in the following step. If you choose not to do this test, skip to the next step now. Alternatively, proceed as follows:

   1. Add the following line to the /etc/httpd/conf/httpd.conf configuration file.

      Include /etc/httpd/conf.modules.d/*.conf

   2. Restart the httpd service.

      • On Red Hat Enterprise Linux 6, enter the following command:

        # service httpd restart

      • On Red Hat Enterprise Linux 7, enter the following command:

        # systemctl restart httpd

   3. Start the mongod database service.

      • On Red Hat Enterprise Linux 6, enter the following command:

        # service mongod start

      • On Red Hat Enterprise Linux 7, enter the following command:

        # systemctl start mongod

   4. Enter the command with the --noop option as follows.

      # satellite-installer --scenario capsule --upgrade --verbose --noop

      Review the /var/log/foreman-installer/capsule.log to see what changes would be applied if the --noop option was omitted. Look for the +++ and --- symbols indicating changes to configurations files. Because the above "no operation" command does not actually create the files, and some Puppet resources in the module expect them to be there, some failure messages are to be expected.

   5. Stop Katello services.

      # katello-service stop

      • Perform the update by running the installer script with the --upgrade option.

        # satellite-installer --scenario capsule --upgrade

5. If a kernel update occurred during the yum update step, reboot the system:

   # reboot

6. If you did not reboot the system in the previous step, restart goferd:

   • On Red Hat Enterprise Linux 6, run the following command:

     # service goferd restart

   • On Red Hat Enterprise Linux 7, run the following command:

     # systemctl restart goferd

7. If you have updated from Satellite 6.2.12 or lower, add the --assumeyes parameter to katello-backup commands in your backup script if it is not there yet.

   From Satellite 6.2.13, you must add the --assumeyes parameter because the katello-backup command prompts for confirmation that the backup is to proceed. For more information about backing up Satellite Server, see Backup and Disaster Recovery in the Server Administration Guide.

To Update a Content Host, enter the following commands:

1. Update all packages:

   # yum update

2. If a kernel update occurs, reboot the system:

   # reboot

3. If you did not reboot the system in the previous step, restart goferd:

   • On Red Hat Enterprise Linux 6, run the following command:

     # service goferd restart

   • On Red Hat Enterprise Linux 7, run the following command:

     # systemctl restart goferd

Uninstall Satellite Server

1. Uninstall Satellite Server.

   # katello-remove

   Once these packages and configuration files are removed there is no going back.
   If you use this system for anything other than Katello and Foreman you probably
   do not want to execute this script.
   Read the source for a list of what is removed.  Are you sure(Y/N)? y
   ARE YOU SURE?: This script permanently deletes data and configuration.
   Read the source for a list of what is removed.  Type [remove] to continue? remove
   Shutting down Katello services...

Uninstall Capsule Server

1. Uninstall Capsule Server.

   $ capsule-remove

   The following message displays.

   Once these packages and configuration files are removed there is no going back.
   If you use this system for anything other than Katello and Foreman you probably
   do not want to execute this script.
   Read the source for a list of what is removed.  Are you sure(Y/N)? y
   ARE YOU SURE?: This script permanently deletes data and configuration.
   Read the source for a list of what is removed.  Type [remove] to continue? remove
   Shutting down Katello services...