To Adjust Timeout Settings:

1. Navigate to Administer > Settings.
2. Enter %_timeout in the search box and click Search. The search should return four settings, including a description.
3. In the Value column, click the icon next to a number to edit it.
4. Enter the desired value in seconds, and click Save.

To Disable Checking for Services:

1. Navigate to Administer > Settings.
2. Enter check_services_before_actions in the search box and click Search.
3. In the Value column, click the icon to edit the value.
4. From the drop-down menu, select false.
5. Click Save.

To Create a Bookmark:

1. Navigate to the page where you want to create a bookmark.
2. In the Search field, enter the search query you want to save.
3. Select the arrow to the right of the Search button and then select Bookmark this search.
4. In the Name field, enter a name for the new bookmark.
5. In the Search query field, ensure your search query is correct.

6. Ensure the Public check box is set correctly:

   • Select the Public check box to set the bookmark as public and visible to all users.
   • Clear the Public check box to set the bookmark as private and only visible to the user who created it.
7. Click Submit.

To Delete a Bookmark:

1. Navigate to Administer > Bookmarks.
2. On the Bookmarks page, click Delete for the Bookmark you want to delete.
3. When the confirmation window opens, click OK to confirm the deletion.

To Create a User:

1. Navigate to Administer > Users.
2. Click Create User.
3. In the Username field, enter the user name for this user to log in to the web UI.
4. In the First name and Surname fields, enter the real first name and surname of the user.
5. In the Email address field, enter the user’s email address.
6. In the Description field, insert a description of the new user.
7. Optionally, select a specific language for the user from the Language drop-down menu. The default is to attempt to use the language settings of the user’s browser.
8. Optionally, select a specific time zone for the user from the Timezone drop-down menu. The default is to use the time zone settings of the user’s browser.

9. Set a password for the user:

   • From the Authorized by drop-down menu, select the source by which the user is authenticated. You can select INTERNAL to enable the user to be managed inside Satellite Server, or configure an external authentication, such as LDAP or IdM as described in Chapter 11, Configuring External Authentication.
   • Enter an initial password for the user in the Password field and verify it in the Verify field.
10. Click Submit to create the user.
11. Select the user name to continue configuring the user.
12. On the Email Preferences tab, select the Mail enabled check box to enable email notifications for the user. Depending on the roles assigned, notifications options can be configured here.
13. On the Locations tab, select locations to be made accessible for this user. If you assign multiple locations to the user, you can select the default location for user login from the Default on login drop-down menu. Otherwise, when the user logs in, the location selection is set to Any Location.
14. On the Organizations tab, select organizations to be made accessible to this user. If you assign multiple organizations to the user, you can select the default organization for user login from the Default on login drop-down menu. Otherwise, when the user logs in, the organization selection is set to Any Organization.
15. On the Roles tab, select the required roles for this user.
16. On the SSH Keys tab you can add SSH public keys but not until the user has been saved.
17. Click Submit to save the changes.

To Edit an Existing User:

1. Navigate to Administer > Users.
2. Click the user name of the user to be altered. General information about the user appears on the right.
3. In the User tab, you can modify the user’s user name, first name, surname, email address, default location, default organization, language, and password.
4. In the Locations tab, you can modify the user’s assigned locations.
5. In the Organizations tab, you can modify the user’s assigned organizations.
6. In the Roles tab, you can modify the user’s assigned roles.
7. Click Save to save your changes.

To Assign a Role to a User:

1. Navigate to Administer > Users. If a user account created is not listed, check that you are currently viewing the right organization. To list all users in Satellite, click Default Organization and then Any Organization. The organization view is changed to Any Context.
2. Click the user name of the user that you want to modify. General information about the user appears on the right.
3. Click the Locations tab, and select a location if none is assigned.
4. Click the Organizations tab, and check that an organization is assigned.
5. Click the Roles tab to display the list of available role assignments.
6. Select role you want to assign to the user in the Roles list. The list contains the predefined roles, as well as any custom roles, see Table 5.1, “Predefined Roles Available in Red Hat Satellite”. Alternatively, select the Administrator check box to assign all available permissions to the selected user.
7. Click Save.

To Add SSH Keys to a User:

1. Prepare the content of the public SSH key in a clipboard.
2. Navigate to Administer > Users.
3. From the Username column, click on the username.
4. Select the SSH Keys tab.
5. Click Create SSH Key.
6. In the Key field, paste the content of the public SSH key.
7. In the Name field, enter a name for the SSH key.
8. Click Submit. A confirmation notification is displayed if your key submission was successful.

To Delete SSH Keys from a User:

1. Log in to the Satellite web UI as Admin or as a user with the destroy_ssh_key permission enabled.
2. Navigate to Administer > Users.
3. Click on the username from the Username column.
4. Select the SSH Keys tab.
5. Click Delete on the row of the SSH key to be deleted.
6. Click OK in the confirmation prompt. A confirmation appears to indicate the deletion was successful.

To Configure Email Notifications:

1. Navigate to Administer > Users.
2. Click the Username of the user you want to edit.
3. On the User tab, check the Email address field. Ensure that it contains a valid email address. The address is associated with the user account, and the notifications selected in the following steps are sent there.
4. Click the Email Preferences tab and select Mail enabled to enable email notifications.

5. Select the notifications you want the user to receive.

   • Audit summary is a summary of all activity audited by the Satellite Server. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates. Enter a query in the associated query field to narrow the audit activity included.
   • Host built is a notification sent when a host is built. To enable these notifications, select Subscribe from the drop-down menu.
   • Host errata advisory is a summary of applicable and installable errata for hosts managed by the user. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • OpenSCAP policy summary is a summary of OpenSCAP policy reports and their results. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • Promote errata is a notification sent only after a Content View promotion. It contains a summary of errata applicable and installable to hosts registered to the promoted Content View. This allows you to monitor what updates have been applied to which hosts. To enable these notifications, select Subscribe from the drop-down menu.
   • Puppet error state is a notification sent after a host reports an error related to Puppet. To enable these notifications, select Subscribe from the drop-down menu.
   • Puppet summary is a summary of Puppet reports. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • Sync errata is a notification sent only after synchronizing a repository. It contains a summary of new errata introduced by the synchronization. To enable these notifications, select Subscribe from the drop-down menu.
6. Click Submit.

To Remove a User:

1. On the main menu, click Administer > Users to open the Users page.
2. Click the Delete link to the right of the user name you want to delete.
3. In the alert box, click OK to delete the user.

To Create a User Group:

1. Navigate to Administer > User groups.
2. Click Create User Group.

3. On the User group tab, specify the name of the new user group and select group members:

   • Select the previously created user groups from the User Groups list.
   • Select users from the Users list.
4. On the Roles tab, select the roles you want to assign to the user group. Alternatively, select the Administrator check box to assign all available permissions.
5. Click Submit.

To Remove a User Group:

1. Navigate to Administer > User groups.
2. Click Delete to the right of the user group you want to delete.
3. In the alert box that appears, click OK to delete a user group.

To Create a Role:

1. Navigate to Administer > Roles.
2. Click New Role.
3. Provide a Name for the role.
4. Click Submit to save your new role.

To Add Permissions to a Role:

1. Navigate to Administer > Roles.
2. Select Add Filter from the drop-down list to the right of the required role.
3. Select the Resource type from the drop-down list. The (Miscellaneous) group gathers permissions that are not associated with any resource group.
4. Click the permissions you want to select from the Permission list.
5. Depending on the Resource type selected, you can select or deselect the Unlimited and Override check box. The Unlimited checkbox is selected by default, which means that the permission is applied on all resources of the selected type. When you disable the Unlimited check box, the Search field activates. In this field you can specify further filtering with use of the Red Hat Satellite 6 search syntax. See Section 5.4, “Granular Permission Filtering” for details. When you enable the Override check box, you can add additional locations and organizations to allow the role to access the resource type in the additional locations and organizations; you can also remove an already associated location and organization from the resource type to restrict access.
6. Click Next.
7. Click Submit to save changes.

To View Permissions Associated with a Role:

1. Navigate to Administer > Roles.
2. Click Filters to the right of the required role to get to the Filters page.

To Create a Complete Permission Table:

1. Ensure that the required packages are installed. Execute the following command on the Satellite Server:

   # yum install tfm-rubygem-foreman*

2. Start the Satellite console with the following command:

   # foreman-rake console

   Insert the following code into the console:

   f = File.open('/tmp/table.html', 'w')
   
   result = Foreman::AccessControl.permissions {|a,b| a.security_block <=> b.security_block}.collect do |p|
   
         actions = p.actions.collect { |a| "<li>#{a}</li>" }
         "<tr><td>#{p.name}</td><td><ul>#{actions.join('')}</ul></td><td>#{p.resource_type}</td></tr>"
   end.join("\n")
   
   f.write(result)

   The above syntax creates a table of permissions and saves it to the /tmp/table.html file.

3. Press Ctrl + D to exit the Satellite console. Insert the following text at the first line of /tmp/table.html:

   <table border="1"><tr><td>Permission name</td><td>Actions</td><td>Resource type</td></tr>

   Append the following text at the end of /tmp/table.html:

   </table>

4. Open /tmp/table.html in a web browser to view the table.

To Remove a Role:

1. Navigate to Administer > Roles.
2. Select Delete from the drop-down list to the right of the role to be deleted.
3. In an alert box that appears, click OK to delete the role.

1. Navigate to Configure > Environments.
2. Click Import environments from satellite.example.com.

3. Select the Puppet environment check box associated with the host you want to audit.

   If no Puppet environment exists, select the production environment check box.

4. Click Update.

To Upload Extra SCAP Content:

1. Log in to the Satellite web UI.
2. Navigate to Hosts > SCAP contents and click New SCAP Content.
3. Enter a title in the Title text box. For example: RHEL 7.2 SCAP Content.
4. Click Choose file, navigate to the location containing the SCAP content file and select Open.
5. Click Submit.

To Create a Policy:

1. In the Satellite web UI, navigate to Hosts > Policies, click New Policy and follow the wizard’s steps.
2. Enter a name for this policy, a description (optional), then click Next.
3. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

4. Specify the scheduled time when the policy is to be applied, then click Next.

   Select Weekly, Monthly, or Custom from the Period drop-down list.

   • If you select Weekly, also select the desired day of the week from the Weekday drop-down list.
   • If you select Monthly, also specify the desired day of the month in the Day of month field.

   • If you select Custom, enter a valid Cron expression in the Cron line field.

     The Custom option allows for greater flexibility in the policy’s schedule than either the Weekly or Monthly options.

5. Select the locations to which the policy is to be applied, then click Next.
6. Select the organizations to which the policy is to be applied, then click Next.
7. Select the host groups to which the policy is to be applied, then click Submit.

To View a Policy:

1. In the Satellite web UI, navigate to Hosts > Policies.
2. Click Show Guide.

To Edit a Policy:

1. In the Satellite web UI, navigate to Hosts > Policies.
2. From the drop-down list to the right of the policy’s name, select Edit.
3. Edit the necessary attributes.
4. Click Submit.

1. In the Satellite web UI, navigate to Hosts > Policies.
2. From the drop-down list to the right of the policy’s name, select Delete.
3. Click OK in the confirmation message.

1. In the Satellite web UI, navigate to Hosts > All hosts.
2. Select the host or hosts to which you want to add the policy.
3. Click Select Action.
4. Select Assign Compliance Policy from the list.
5. In the new panel that opens, select the appropriate policy from the list of available policies and click Submit.

To Upload a Tailoring File:

1. Log in to the Satellite web UI.
2. Navigate to Hosts > Compliance - Tailoring Files and click New Tailoring File.
3. Enter a name in the Name text box.
4. Click Choose File, navigate to the location containing the SCAP DataStream Tailoring File and select Open.
5. Click Submit to upload the chosen Tailoring File.

To Assign a Tailoring File to a Policy:

1. Log in to the Satellite web UI.
2. Navigate to Hosts > Compliance - Policies.
3. Click New Policy, or New Compliance Policy if there are existing Compliance Policies.
4. Enter a name in the Name text box, and click Next.
5. Select a Scap content from the dropdown menu.
6. Select a XCCDF Profile from the dropdown menu.
7. Select a Tailoring File from the dropdown menu.

8. Select a XCCDF Profile in Tailoring File from the dropdown menu.

   It is important to select the XCCDF Profile because Tailoring Files are able to contain multiple XCCDF Profiles.

9. Click Next.
10. Select a Period from the dropdown menu.
11. Select a Weekday from the dropdown menu, and click Next.
12. Select a Location to move it to the Selected Items window, and click Next.
13. Select an Organization to move it to the Selected Items window, and click Next.
14. Select a Hostgroup to move it to the Selected Items window, and click Submit.

To Bookmark a Search:

1. Apply your search criteria.
2. From the Search list select Bookmark this search.

3. Complete the Name field.

   If you want the bookmark available to other users of this Satellite instance, select the Public check box.

4. Click Submit.

To Estimate the Size of a Backup

1. Enter the du command to estimate the space required to store uncompressed directories containing Satellite databases and configuration files, for example:

   # du -csh /var/lib/mongodb /var/lib/pgsql/data /var/lib/pulp \
   /etc /root/ssl-build /var/www/html/pub /opt/puppetlabs
   480G	/var/lib/mongodb
   100G    /var/lib/pgsql/data
   100G	/var/lib/pulp
   680G    total
   37M	/etc
   900K	/root/ssl-build
   100K	/var/www/html/pub
   2M	/opt/puppetlabs
   680GB   total

   In this example, the uncompressed backup data occupies 680 GB in total.

   Note

   The /opt/puppetlabs directory is used for Puppet 4. Use /var/lib/puppet for Puppet 3.

2. Calculate how much space is required to store the compressed data.

   Table 8.1, “Backup Data Compression Ratio” demonstrates compression ratio of all data items used in the backup.

   Table 8.1. Backup Data Compression Ratio

   Data type	Directory	Ratio	Example results
   MongoDB database files	/var/lib/mongodb	10 - 15%	480 GB → 420 GB
   PostgreSQL database files	/var/lib/pgsql/data	15 - 20%	100 GB → 80 GB
   Pulp RPM files	/var/lib/pulp	-	(not compressed)
   Configuration files	/etc /root-ssl/build /var/www/html/pub /opt/puppetlabs	5 - 10%	50 MB → 45 MB

   In this example, the compressed backup data occupies 500 GB in total.

3. Calculate how much space is required to store a backup. Sum up the estimated values of compressed and uncompressed backup data and add extra 20% to ensure a reliable backup.

   This example requires 680 GB plus 500 GB for the uncompressed and compressed backup data, 1180 GB in total. With 240 GB of extra space, 1420 GB must be allocated for the backup location.

1. Ensure your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   # satellite-backup backup_directory

   The satellite-backup script stops all services which could impact the backup, performs the backup, then restarts the required services. The script creates the target directory when trying to create a backup file if the target directory does not exist.

   This process can take a long time to complete, due to the amount of data to copy.

1. Ensure your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   # satellite-backup --skip-pulp-content backup_directory

   The satellite-backup script stops all services which could impact the backup, performs the backup, then restarts the required services. The script creates the target directory when trying to create a backup file if the target directory does not exist.

1. Ensure your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   With Pulp content:

   # satellite-backup backup_directory --incremental backup_directory/previous_time-stamped_subdirectory

   Without Pulp content:

   # satellite-backup backup_directory --skip-pulp-content --incremental backup_directory/previous_time-stamped_subdirectory

   The satellite-backup script stops all services which could impact the backup, performs the backup, then restarts the required services. If the target directory does not exist when trying to create a backup file the script creates it. It is possible to make incremental backups using a backup older than the previous backup as a starting point, but with a corresponding increase in time to make the backup.

1. Ensure your backup location has enough disk space to store the backup. For more information, see Section 8.1.1, “Estimating the size of a Backup”.

2. Run the backup script:

   # satellite-backup --online-backup /tmp/backup_directory

Rename a Satellite Server

1. On the Satellite Server, run the satellite-change-hostname script, providing the host’s new name, and Satellite credentials.

   # satellite-change-hostname new_satellite --username admin \
   --password password

   The message ***** Hostname change complete! ***** confirms that the rename completed successfully.

2. (Optional) If you have obtained a new X.509 certificate for the Satellite Server’s new host name, run the Satellite installation script to install the certificate. For more information on installing a custom X.509 certificate, see Configuring Satellite Server with a Custom Server Certificate in the Red Hat Satellite Installation Guide.

3. On all Capsule Servers and hosts registered to the Satellite Server, reinstall the bootstrap RPM and re-register them to the Satellite Server. Substitute the example organization and environment values with those matching your environment.

   1.  

      # yum remove -y katello-ca-consumer*

   2.  

      # rpm -Uvh http://new-satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

   3.  

      # subscription-manager register --org="Default_Organization" \
      --environment="Library" \
      --force

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For more information, see Configuring and Running Remote Commands in Managing Hosts.

4. Reattach subscriptions to all Capsule Servers and hosts registered to the Satellite Server, then refresh the subscription.

   1.  

      # subscription-manager refresh

   2.  

      # yum repolist

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For more information, see Configuring and Running Remote Commands in Managing Hosts.

5. On all Capsule Servers, re-run the Satellite installation script to update references to the new host name.

   # satellite-installer --foreman-proxy-content-parent-fqdn new-satellite.example.com \
   --foreman-proxy-foreman-base-url  https://new-satellite.example.com \
   --foreman-proxy-trusted-hosts new-satellite.example.com

6. On the Satellite Server, synchronize content for each Capsule Server.

   1. List all Capsule Servers with their ID numbers:

      # hammer capsule list

   2. Enter the following command for each Capsule Server:

      # hammer capsule content synchronize --id capsule_id_number

Renaming a Capsule Server:

1. On Satellite Server, create a new certificates archive file.

   1. If you are using the default Satellite Server certificate:

      # capsule-certs-generate --capsule-fqdn new-capsule.example.com \
      --certs-tar /root/new-capsule.example.com-certs.tar

      Ensure that you enter the full path to the .tar file.

   2. If you are using a custom X.509 certificate on the Capsule Server, see Create the Capsule Server’s Certificate Archive File in the Red Hat Satellite Installation Guide.

2. On Satellite Server, copy the certificates archive file to the Capsule Server, providing the root user’s password when prompted. In this example the archive file is copied to the root user’s home directory, but you may prefer to copy it elsewhere.

   # scp /root/new-capsule.example.com-certs.tar root@capsule.example.com:

3. On the Capsule Server, run the satellite-change-hostname script, providing the host’s new name, Satellite credentials, and certificates archive filename.

   # satellite-change-hostname new_capsule --username admin \
   --password password \
   --certs-tar /root/new-capsule.example.com-certs.tar

   Ensure that you enter the full path to the .tar file.

   The message ***** Hostname change complete! ***** confirms that the rename completed successfully.

4. Optional: If you have obtained a new X.509 certificate in the Capsule Server’s new host name, run the Satellite installation script to install the certificate. For more information on installing a custom X.509 certificate, see Configuring Satellite Server with a Custom Server Certificate in the Red Hat Satellite Installation Guide.

5. On all hosts registered to the Capsule Server, reinstall the bootstrap RPM and re-register them to the Capsule Server. Substitute the example organization and environment values with those matching your environment.

   # yum remove -y katello-ca-consumer*

   # rpm -Uvh http://new-capsule.example.com/pub/katello-ca-consumer-latest.noarch.rpm

   # subscription-manager register --org="Default_Organization" \
   --environment="Library" \
   --force

   Use of the Red Hat Satellite remote execution feature is recommended for this step. For more information, see Running Jobs on Hosts in Managing Hosts.

6. Reattach subscriptions to all hosts registered to the Capsule Server, then refresh the subscription.

   # subscription-manager refresh

   # yum repolist

7. Edit the Capsule Server’s name.

   1. In the Satellite web UI, navigate to Infrastructure > Capsules.
   2. Find the Capsule Server in the list, and click Edit in that row.
   3. Edit the Name and URL fields to match the Capsule Server’s new host name, then click Submit.
8. On your DNS server, add a record for the Capsule Server’s new host name, and delete the record for the previous host name.

To Search for Solutions from the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access > Search.

2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.

3. In the Red Hat Search field, enter your search query. Search results display in the left-hand Recommendations list.
4. In the Recommendations list, click a solution. The solution article displays in the main panel.

To Use the Logs Diagnostic Tool from the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access > Logs.

2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.

3. In the left file tree, select a log file and click the file name.
4. Click Select File. A pop-up window displays the log file contents.
5. In the log file, highlight any text sections you want diagnosed. The Red Hat Diagnose button displays.
6. Click Red Hat Diagnose. The system sends the highlighted information to the Red Hat Customer Portal, and provides solutions that closely match the provided log information.

7. If a solution does the following:

   • Matches the problem, click the solution and follow the required steps to troubleshoot the issue.
   • Does not match the problem, click Open a New Support Case. The support case is populated with the highlighted text from the log file. See Section 9.8.5, “Creating Support Cases Using the Red Hat Access Plug-in”.

To View Existing Support Cases from the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access > Support > My Cases.

2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.

3. To search for a specific support case from existing cases, do any of the following:

   • In the Search field, provide a key word or phrase.
   • From the drop-down list, choose a specific Case Group. Your organization has defined Case Groups inside the Red Hat Customer Portal.
   • Choose a Case Status.
4. From the results, choose a specific support case and click the Case ID. The support case is ready to view.

To Update Support Cases from the Red Hat Satellite Server Web UI:

1. Complete the instructions from Section 9.8.3, “Viewing Existing Support Cases Using the Red Hat Access Plug-in”

2. In the support case, scroll down to the marked sections to do the following:

   • Attachments: - Attach a local file from the system. Add a file name to make it easier to identify.

     Note

     File names must be less than 80 characters and the maximum file size for attachments uploaded using the web UI is 250 MB. Use FTP for larger files.

   • Case Discussion: - Add any updated information about the case you wish to discuss with Global Support Services. After adding information, click Add Comment.

To Create a New Support Case Using the Red Hat Satellite Server:

1. In the upper right, click Red Hat Access > Support > New Case.

2. If necessary, log in to the Red Hat Customer Portal. In the main panel on the upper right, click Log In.

   Note

   To access Red Hat Customer Portal resources, you must log in with your Red Hat Customer Portal user identification and password.

3. The Product and Product Version fields are automatically populated. Complete the other relevant fields, as follows:

   • Summary — Provide a brief summary of the issue.

   • Description — Write a detailed description of the issue.

     Based on the summary provided, recommendations for possible solutions display in the main panel.

4. Click Next.

5. Choose the appropriate options, as follows:

   • Severity — Select the ticket urgency as 4 (low), 3 (normal), 2 (high), or 1 (urgent).
   • Case Group — Based on who needs to be notified, create case groups associated with the support case. Select Case Groups in Red Hat Satellite. Create Case Groups within the Customer Portal.

6. Attach the output of sosreport and any required files. Add a file description and click Attach.

   Note

   • If you have large log files or many Satellite tasks, it is recommended to also attach the output of foreman-debug.
   • File names must be less than 80 characters and the maximum file size for attachments uploaded using the web UI is 250 MB. Use FTP for larger files.
7. Click Submit. The system uploads the case to the Customer Portal, and provides a case number for your reference.

To Configure LDAP Authentication:

1. Set the allow Network Information System (NIS) service boolean to true to prevent SELinux from stopping outgoing LDAP connections:

   • For Red Hat Enterprise Linux 6:

     # setsebool -P allow_ypbind on

   • For Red Hat Enterprise Linux 7:

     # setsebool -P nis_enabled on

2. Navigate to Administer > LDAP Authentication.
3. Click New authentication source.
4. On the LDAP server tab, enter the LDAP server’s name, host name, port, and server type. The default port is 389, the default server type is POSIX (alternatively you can select FreeIPA or Active Directory depending on the type of authentication server). For TLS encrypted connections, select the LDAPS check box to enable encryption. The port should change to 636, which is the default for LDAPS.
5. On the Account tab, enter the account information and domain name details. See Section 11.1.3, “LDAP Setting Descriptions and Examples” for descriptions and examples.
6. On the Attribute mappings tab, map LDAP attributes to Satellite attributes. You can map Login name, First name, Surname, Email address, and Photo attributes. See Section 11.1.3, “LDAP Setting Descriptions and Examples” for examples.
7. On the Locations tab, select locations from the left table. Selected locations are assigned to users created from the LDAP authentication source, and available after their first login.
8. On the Organizations tab, select organizations from the left table. Selected organizations are assigned to users created from the LDAP authentication source, and available after their first login.
9. Click Submit.

To Configure IdM Authentication on the Satellite Server:

1. On the IdM server, create a host entry for the Satellite Server and generate a one-time password, for example:

   # ipa host-add --random hostname

   Note

   The generated one-time password must be used on the client to complete IdM-enrollment.

   For more information on host configuration properties, see Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy Guide^[3].

2. Create an HTTP service for the Satellite Server, for example:

   # ipa service-add servicename/hostname

   For more information on managing services, see Red Hat Enterprise Linux 7 Linux Domain Identity, Authentication, and Policy Guide^[4].

3. On the Satellite Server, execute the following command as root to configure IdM-enrollment:

   # ipa-client-install --password OTP

   Replace OTP with the one-time password provided by the IdM administrator.

4. If the Satellite Server is running on Red Hat Enterprise Linux 7, execute the following command:

   # subscription-manager repos --enable rhel-7-server-optional-rpms

   The installer is dependent on packages which, on Red Hat Enterprise Linux 7, are in the optional repository rhel-7-server-optional-rpms. On Red Hat Enterprise Linux 6 all necessary packages are in the base repository.

5. Execute the following command:

   # satellite-installer --foreman-ipa-authentication=true

   This command is not limited to a fresh Satellite installation; you can use it to modify an existing Satellite installation.

6. Restart Katello services:

   # katello-service restart

To Configure HBAC:

1. Create HBAC service and rule on the IdM server and link them together. The following examples use the PAM service name satellite-prod. Execute the following commands on the IdM server:

   $ ipa hbacsvc-add satellite-prod
   $ ipa hbacrule-add allow_satellite_prod
   $ ipa hbacrule-add-service allow_satellite_prod --hbacsvcs=satellite-prod

2. Add the user who is to have access to the service satellite-prod, and the host name of the Satellite Server:

   $ ipa hbacrule-add-user allow_satellite_prod --user=username
   $ ipa hbacrule-add-host allow_satellite_prod --hosts=the-satellite-fqdn

   Alternatively, host groups and user groups can be added to the allow_satellite_prod rule.

3. To check the status of the rule, execute:

   $ ipa hbacrule-find satellite-prod
   $ ipa hbactest --user=username --host=the-satellite-fqdn --service=satellite-prod

4. Ensure the allow_all rule is disabled on the IdM server. For instructions on how to do so without disrupting other services see the How to configure HBAC rules in IdM article on the Red Hat Customer Portal ^[6].

5. Configure the IdM integration with the Satellite Server as described in To Configure IdM Authentication on the Satellite Server:. On the Satellite Server, define the PAM service as root:

   # satellite-installer --foreman-pam-service=satellite-prod

1. To enable the HBAC feature, create an external group and add the AD group to it. Add the new external group to a POSIX group. Use this POSIX group in a HBAC rule.

2. Configure sssd to transfer additional attributes of AD users. Add these attributes to the nss and domain sections in /etc/sssd/sssd.conf. For example:

   [nss]
   user_attributes=+mail, +sn, +givenname
   
   [domain/EXAMPLE]
   ldap_user_extra_attrs=mail, sn, givenname

To Enroll Satellite Server with the AD Server:

1. Install the required packages:

   # yum install sssd adcli realmd ipa-python-compat krb5-workstation

2. Enroll Satellite Server with the AD server. You may need to have administrator permissions to perform the following command:

   # realm join -v EXAMPLE.ORG

To Configure Direct AD Integration with GSS-proxy:

1. Create the /etc/ipa/ directory and the default.conf file:

   # mkdir /etc/ipa
   # touch /etc/ipa/default.conf

2. To the default.conf file, add the following content:

   [global]
   server = unused
   realm = EXAMPLE.ORG

3. Create the /etc/net-keytab.conf file with the following content:

   [global]
   workgroup = EXAMPLE
   realm = EXAMPLE.ORG
   kerberos method = system keytab
   security = ads

4. Create the /etc/gssproxy/00-http.conf file with the following content:

   [service/HTTP]
   mechs = krb5
   cred_store = keytab:/etc/krb5.keytab
   cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
   euid = 48

5. Insert the following line at the beginning of the /etc/krb5.conf file:

   includedir /var/lib/sss/pubconf/krb5.include.d/

6. Create a keytab entry:

   # KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U administrator -d3 -s /etc/net-keytab.conf
   # chown root.apache /etc/httpd/conf/http.keytab
   # chmod 640 /etc/httpd/conf/http.keytab

7. Enable IPA authenication in Satellite:

   # satellite-installer --foreman-ipa-authentication=true

8. Start and enable the gssproxy service:

   # systemctl restart gssproxy.service
   # systemctl enable gssproxy.service

9. Configure the Apache server to use the gssproxy service:

   1. Create the /etc/systemd/system/httpd.service file with the following content:

      .include /lib/systemd/system/httpd.service
      [Service]
      Environment=GSS_USE_PROXY=1

   2. Apply changes to the service:

      # systemctl daemon-reload

10. Start and enable the httpd service:

    # systemctl restart httpd.service

    With a running Apache server, users making HTTP requests against the server are authenticated if the client has a valid Kerberos ticket.

    To confirm that SSO is working as expected, on Satellite Server, enter the following command to retrieve the Kerberos ticket of the LDAP user:

    # kinit ldapuser

    To view the Kerberos ticket, enter the following command:

    # klist

    To view output from successful SSO-based authentication, enter the following command:

    # curl -k -u : --negotiate https://satellite.example.com/users/extlogin
    <html><body>You are being <a href="https://satellite.example.com/users/4-ldapuserexample-com/edit">redirected</a>.</body></html>

To configure the Satellite Server or Capsule Server for IdM Realm Support:

1. On the Satellite Server or Capsule Server, install the following packages:

   # yum install ipa-client foreman-proxy ipa-admintools

2. Configure the Satellite Server (or Capsule Server) as an IdM client:

   # ipa-client-install

3. Create a realm-capsule user and the relevant roles in Red Hat Identity Management on the Satellite Server or Capsule Server:

   # foreman-prepare-realm admin realm-capsule

   Running foreman-prepare-realm prepares an IdM server for use with the Capsule Server. It creates a dedicated role with the permissions needed for Satellite, creates a user with that role and retrieves the keytab file. You require your Identity Management server configuration details for this step.

   If the command successfully executes, you should be able to see the following command output:

   Keytab successfully retrieved and stored in: freeipa.keytab
   Realm Proxy User:    realm-capsule
   Realm Proxy Keytab:  /root/freeipa.keytab

   Note

   To configure Satellite Server and at least one external Capsule Server for IdM Realm support with the same principal and realm, you must copy the /root/freeipa.keytab file to all the previously joined Capsule Servers after running the foreman-prepare-realm script.

   # scp /root/freeipa.keytab your_username@capsule.example.com:/etc/foreman-proxy/freeipa.keytab

4. Move the /root/freeipa.keytab to the /etc/foreman-proxy directory and set the ownership settings to the user foreman-proxy:

   # mv /root/freeipa.keytab /etc/foreman-proxy
   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab

5. Configure the realm based on whether you are using Satellite Server or Capsule Server:

   • If you are using the integrated Capsule Server in the Satellite Server, use satellite-installer to configure the realm:

     # satellite-installer --foreman-proxy-realm true \
     --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
     --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM \
     --foreman-proxy-realm-provider freeipa

     Note

     You can also run these options when you first configure the Red Hat Satellite Server.

   • If you are using an external Capsule Server, use satellite-installer --scenario capsule to configure the realm:

     # satellite-installer --scenario capsule \
     --foreman-proxy-realm true \
     --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
     --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM \
     --foreman-proxy-realm-provider freeipa

6. Make sure that the most updated versions of the ca-certificates package is installed and trust the IdM Certificate Authority:

   # cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
   # update-ca-trust enable
   # update-ca-trust

7. (Optional) If you are configuring IdM on an already existing Satellite Server or Capsule Server, the following steps should also be taken to make sure that the configuration changes take effect:

   1. Restart the foreman-proxy service:

      # service foreman-proxy restart

   2. Log in to the Satellite Server and click Infrastructure > Capsules.
   3. Click on the drop-down menu on the right-hand side of the Capsule Server you have configured for IdM and choose Refresh Features.

8. Finally, create a new realm entry in the Satellite Server user interface:

   1. Click Infrastructure > Realms and on the right-hand corner of the main page, click New Realm.

   2. Fill in the fields in the following subtabs:

      • On the Realm subtab, provide the realm name, the type of realm to use and the realm proxy.
      • On the Locations subtab, choose the locations where the new realm is intended for use.
      • On the Organizations subtab, choose the organizations where the new realm is intended for use.
   3. Click Submit.

To Add Hosts to an IdM Host Group:

1. On the IdM server, create a host group:

   # ipa hostgroup-add hostgroup_name
   Description: hostgroup_description
   ----------------------------
   Added hostgroup "hostgroup_name"
   ----------------------------
   Host-group: hostgroup_name
   Description: hostgroup_description

   Where:

   • hostgroup_name is the host group’s name.
   • hostgroup_description is the host group’s description.

2. Create an automembership rule:

   # ipa automember-add --type=hostgroup automember_rule
   ----------------------------------
   Added automember rule "automember_rule"
   ----------------------------------
   Automember Rule: automember_rule

   Where:

   • automember-add flags the group as an automember group.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • automember_rule is the name you wish to identify the automember rule by.

3. Define an automembership condition based on the userclass attribute:

   # ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex=^webserver hostgroup_name
   ----------------------------------
   Added condition(s) to "hostgroup_name"
   ----------------------------------
   Automember Rule: automember_rule
   Inclusive Regex: userclass=^webserver
   ----------------------------
   Number of conditions added 1
   ----------------------------

   Where:

   • automember-add-condition allows you to add regular expression conditions to identify group members.
   • --key=userclass specifies the key attribute as userclass.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • --inclusive-regex= ^webserver is a regular expression pattern to identify matching values.
   • hostgroup_name is the target host group’s name.