1. Identify your Satellite subscription.

   # subscription-manager list --available --matches 'Red Hat Satellite'

   This command performs a case-insensitive search of all available subscriptions' fields, including Subscription Name and Provides, matching any instances of Red Hat Satellite. Subscriptions are classified as available if they are not already attached to a system. The search string may also contain the wildcards ? or * to match a single character or zero or more characters, respectively. The wildcard characters may be escaped with a backslash to represent a literal question mark or asterisk. Likewise, to represent a backslash, it must be escaped with another backslash.

   If you are unable to find an available Satellite subscription, see the Red Hat Knowledgebase solution How do I figure out which subscriptions have been consumed by clients registered under Red Hat Subscription Manager? to run a script to allow you to see if your subscription is being consumed by another system.

   If the output is too long, pipe it into a pager utility, such as less or more, so that you can look over the output one screenful at a time.

   1. Regardless of which form of the subscription-manager command is run, the output should be similar to the following:

      Subscription Name: Red Hat Satellite
      Provides:          Red Hat Satellite 6
                         Red Hat Enterprise Linux Server
                         Red Hat Satellite
                         Red Hat Enterprise Linux Load Balancer (for RHEL Server)
      SKU:               MCT0370
      Pool ID:           8a85f9874152663c0541943739717d11
      Available:         3
      Suggested:         1
      Service Level:     Premium
      Service Type:      L1-L3
      Multi-Entitlement: No
      Ends:              10/07/2014
      System Type:       Physical

2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID is different than the example provided.

3. To attach your subscription to your Satellite Server, enter the following command, using your Pool ID:

   # subscription-manager attach --pool=pool_id

   The output should be similar to the following:

   Successfully attached a subscription for: Red Hat Satellite

4. To verify that the subscriptions are successfully attached, enter the following command:

   # subscription-manager list --consumed

   The outputs displays something similar to the following:

   +-------------------------------------------+
      Consumed Subscriptions
   +-------------------------------------------+
   Subscription Name: Red Hat Satellite
   Provides:          Red Hat Satellite
                      Red Hat Enterprise Linux Server
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Satellite
                      Red Hat Satellite 6
                      Red Hat Software Collections  (for RHEL Server)
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux Load Balancer (for RHEL Server)
                      Red Hat Satellite with Embedded Oracle
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux High Availability (for RHEL Server)
   SKU:               MCT0370
   Contract:          10293569
   Account:           5361051
   Serial:            1653856191250699363
   Pool ID:           8a85f9874152663c0541943739717d11
   Active:            True
   Quantity Used:     1
   Service Level:     Premium
   Service Type:      L1-L3
   Status Details:
   Starts:            10/08/2013
   Ends:              10/07/2014
   System Type:       Physical

1. Disable all existing repositories.

   # subscription-manager repos --disable "*"

2. Enable the required repositories:

   • To enable the Red Hat Satellite, Red Hat Enterprise Linux, Red Hat Software Collections, and Puppet 4 repositories, enter the following command:

     # subscription-manager repos \
     --enable=rhel-7-server-rpms \
     --enable=rhel-server-rhscl-7-rpms \
     --enable=rhel-7-server-satellite-6.3-rpms \
     --enable=rhel-7-server-satellite-6.3-puppet4-rpms

   • Alternatively, to enable the Red Hat Satellite, Red Hat Enterprise Linux, Red Hat Software Collections, and Puppet 3 repositories, enter the following command:

     # subscription-manager repos \
     --enable=rhel-7-server-rpms \
     --enable=rhel-server-rhscl-7-rpms \
     --enable=rhel-7-server-satellite-6.3-rpms

     Note

     Satellite 6.3 is the last supported release for Puppet 3. You must upgrade from Puppet 3 to Puppet 4 while on Satellite 6.3, and before upgrading to Satellite 6.4. Satellite 6.4 only supports Puppet 5, and the upgrade to Puppet 5 will be made during the Satellite upgrade.

     Note

     If you are installing Red Hat Satellite as a virtual machine hosted on Red Hat Virtualization (RHV), you also need to enable the Red Hat Common repository, and install RHV guest agents and drivers. For more information, see Installing the Guest Agents and Drivers on Red Hat Enterprise Linux in the Virtual Machine Management Guide for more information.

3. Ensure that Red Hat Subscription Manager is not set to use a specific operating system release.

   # subscription-manager release --unset

4. Clear out any metadata left from any non-Red Hat yum repositories.

   # yum clean all

5. Verify that the repositories have been enabled.

   # yum repolist enabled

   Output similar to the following displays:

   Loaded plugins: product-id, subscription-manager
   repo id                                    repo name                                                                status
   !rhel-7-server-rpms/x86_64                 Red Hat Enterprise Linux 7 Server (RPMs)                                 9,889
   !rhel-7-server-satellite-6.3-rpms/x86_64   Red Hat Satellite 6.3 (for RHEL 7 Server) (RPMs)                           545
   !rhel-server-rhscl-7-rpms/x86_64           Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server  4,279
   repolist: 14,713

1. Update all packages.

   # yum update

2. Install the installation package.

   # yum install satellite

3. Go to Section 3.3, “Performing the Initial Configuration” to run the installation script and perform the initial configuration of your Satellite Server.

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Enterprise Linux.

4. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Enterprise Linux Server.
   • Version is set to the latest minor version of the product you plan to use as the base system.
   • Architecture is set to the 64 bit version.
5. On the Product Software tab, download the Binary DVD image for the latest Red Hat Enterprise Linux Server version.
6. Click DOWNLOADS and select Red Hat Satellite.

7. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you plan to use as the base system.
   • Architecture is set to the 64 bit version.
8. On the Product Software tab, download the Binary DVD image for the latest Red Hat Satellite version.

9. Copy the ISO files to the Satellite base system or other accessible storage device.

   # scp localfile username@hostname:remotefile

1. Create a directory to serve as the mount point for the ISO file corresponding to the base system’s version.

   # mkdir /media/rhel7-server

2. Mount the ISO image for Red Hat Enterprise Linux to the mount point.

   # mount -o loop rhel7-Server-DVD.iso /media/rhel7-server

   The following example shows mounting the ISO using Red Hat Enterprise Linux 7.2:

   # mount -o loop RHEL-7.2-20151030.0-Server-x86_64-dvd1.iso \
   /media/rhel7-server
   mount: /dev/loop0 is write-protected, mounting read-only

3. Copy the ISO file’s repository data file.

   # cp /media/rhel7-server/media.repo /etc/yum.repos.d/rhel7-server.repo

4. Edit the repository data file and add the baseurl directive.

   baseurl=file:///media/rhel7-server/

   The following example shows the repository data file using Red Hat Enterprise Linux 7.2:

   # vi /etc/yum.repos.d/rhel7-server.repo
   [InstallMedia]
   name=Red Hat Enterprise Linux 7.2
   mediaid=1446216863.790260
   metadata_expire=-1
   gpgcheck=0
   cost=500
   baseurl=file:///media/rhel7-server/
   enabled=1

5. Verify that the repository has been configured.

   # yum repolist
   Loaded plugins: product-id, search-disabled-repos, subscription-manager
   This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
   repo id          repo name                       status
   InstallMedia     Red Hat Enterprise Linux 7.2    4,620

6. Create a directory to serve as the mount point for the ISO file of the Satellite Server.

   # mkdir /media/sat6

7. Mount the ISO image for Red Hat Satellite Server to the mount point.

   # mount -o loop sat6-DVD.iso /media/sat6

   The following example shows mounting the ISO using Red Hat Satellite 6.3.0 for Red Hat Enterprise Linux 7:

   # mount -o loop satellite-6.3.0-rhel-7-x86_64-dvd.iso /media/sat6
   mount: /dev/loop1 is write-protected, mounting read-only

8. Red Hat Satellite 6.3 uses Puppet 3 by default, but you can also use Puppet 4. To use Puppet 4, create a local repository to access the required packages and add the following contents:

   # vi /etc/yum.repos.d/satellite-puppet4.repo
   [satellite-puppet4]
   name=satellite-puppet4
   baseurl=file:///media/sat6/addons/Puppet4
   enabled=1
   gpgcheck=1

1. Ensure the ISO images for Red Hat Enterprise Linux Server and Red Hat Satellite are mounted:

   # findmnt -t iso9660

2. Import the Red Hat GPG keys.

   # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

3. Ensure the base system is up to date with the Binary DVD image.

   # yum update

4. Change to the directory where the Satellite ISO is mounted.

   # cd /media/sat6/

5. Run the installation script in the mounted directory.

   # ./install_packages
   	This script will install the foreman packages on the current machine.
      - Ensuring we are in an expected directory.
      - Copying installation files.
      - Creating a Repository File
      - Creating RHSCL Repository File
      - Checking to see if Foreman is already installed.
      - Importing the gpg key.
      - Foreman is not yet installed, installing it.
      - Installation repository will remain configured for future package installs.
      - Installation media can now be safely unmounted.
   
   Install is complete. Please run satellite-installer --scenario satellite.

   If the script fails due to missing or outdated packages, you must download and install these separately. See Section 3.2.4, “Downloading Packages Manually” for instructions.

   If the script fails due to installed packages being newer than those required, enter yum distribution-synchronization to downgrade the installed packages to the versions that came from the Red Hat Enterprise Linux ISO, then run the installation script again. This should only occur if you have repositories configured whose source is not the Red Hat Enterprise Linux ISO. Use of such repositories is an unsupported configuration.

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Satellite.

4. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you are using as the base system.
   • Architecture is set to the 64 bit version.
5. On the Packages tab, enter the name of the package required in the Search box.
6. Click Download Latest next to the package required.

Synchronizing Time using chronyd

1. Install chronyd.

   # yum install chrony

2. Start and enable the chronyd service.

   # systemctl start chronyd
   # systemctl enable chronyd

1. Open https://access.redhat.com/ in your browser and log in to your Red Hat account.
2. Navigate to Subscriptions in the upper-left corner of the Customer Portal.
3. Navigate to Subscription Allocations.
4. Click Create New subscription allocation.
5. In the Name field, enter a name.
6. From the Type list, select the type and version that corresponds to your Satellite Server.
7. Click Create.

1. Navigate to Subscription Allocations.
2. Select the name of the subscription you want to change.
3. Click the Subscriptions tab.
4. Click Add Subscriptions.
5. A list of your Red Hat product subscriptions appears. Enter the Entitlement Quantity for each product.
6. Click Submit to complete the assignment.

To Install the Satellite Tools Repository:

1. In the Satellite web UI, go to Content > Red Hat Repositories and select the RPMs tab.
2. Find and expand the Red Hat Enterprise Linux Server item.

3. Find and expand the Red Hat Satellite Tools 6.3 (for Red Hat Enterprise Linux 7 Server) (RPMs) item.

   If the Red Hat Satellite Tools 6.3 items are not visible, it may be because they are not included in the Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Subscription Manifest and import it into Satellite.

4. Select the Enabled check box next to the Satellite 6.3 Tools repository’s name.

To Synchronize the Satellite Tools Repository:

1. Go to Content > Sync Status.

   A list of product repositories available for synchronization is displayed.

2. Click the arrow next to the product content to view available content.
3. Select the content you want to synchronize.
4. Click Synchronize Now.

To Configure Satellite with an HTTP Proxy

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # unset http_proxy
   # unset https_proxy
   # unset no_proxy

2. Run satellite-installer with the HTTP proxy options.

   # satellite-installer --scenario satellite \
   --katello-proxy-url=http://myproxy.example.com \
   --katello-proxy-port=8080 \
   --katello-proxy-username=proxy_username \
   --katello-proxy-password=proxy_password

3. Verify that Satellite Server can connect to the Red Hat Content Delivery Network (CDN) and can synchronize its repositories.

   1. On the network gateway and the HTTP Proxy, enable TCP for the following host names:

      Host name	Port	Protocol
      subscription.rhsm.redhat.com	443	HTTPS
      cdn.redhat.com	443	HTTPS
      *.akamaiedge.net	443	HTTPS
      cert-api.access.redhat.com (if using Red Hat Insights)	443	HTTPS
      api.access.redhat.com (if using Red Hat Insights)	443	HTTPS

      Satellite Server communicates with the Red Hat CDN securely over SSL. Use of an SSL interception proxy interferes with this communication. These hosts must be whitelisted on the proxy.

      For a list of IP addresses used by the Red Hat CDN (cdn.redhat.com), see the Knowledgebase article Public CIDR Lists for Red Hat on the Red Hat Customer Portal.

   2. On Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file:

      # an http proxy server to use (enter server FQDN)
      proxy_hostname = myproxy.example.com
      
      # port for http proxy server
      proxy_port = 8080
      
      # user name for authenticating to an http proxy, if needed
      proxy_user =
      
      # password for basic http proxy auth, if needed
      proxy_password =

1. To verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

Enable Power Management on Managed Hosts

1. Run the installer with the options to enable BMC.

   # satellite-installer --foreman-proxy-bmc "true" \
   --foreman-proxy-bmc-default-provider "freeipmi"

Configure DNS, DHCP, and TFTP on Satellite Server

1. Run satellite-installer with the options appropriate for your environment.

   # satellite-installer --scenario satellite \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-managed true \
   --foreman-proxy-dns-interface eth0 \
   --foreman-proxy-dns-zone example.com \
   --foreman-proxy-dns-forwarders 172.17.13.1 \
   --foreman-proxy-dns-reverse 13.17.172.in-addr.arpa \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-managed true \
   --foreman-proxy-dhcp-interface eth0 \
   --foreman-proxy-dhcp-range "172.17.13.100 172.17.13.150" \
   --foreman-proxy-dhcp-gateway 172.17.13.1 \
   --foreman-proxy-dhcp-nameservers 172.17.13.2 \
   --foreman-proxy-tftp true \
   --foreman-proxy-tftp-managed true \
   --foreman-proxy-tftp-servername $(hostname)

   For more information about configuring DHCP, DNS, and TFTP services, see the Configuring Network Services section in the Provisioning Guide.

   The script displays its progress and writes logs to /var/log/foreman-installer/satellite.log. You can view the settings used, including the admin_password parameter, in the /etc/foreman-installer/scenarios.d/satellite-answers.yaml file.

1. In the web UI, go to Infrastructure > Subnets and select a subnet.
2. On the Capsules tab, ensure that there is no DHCP Capsule or TFTP Capsule associated by setting the drop-down list to None.

3. Disable forward record orchestration.

   1. Go to Infrastructure > Domains and select a domain.
   2. On the Domain tab, setting the DNS Capsule drop-down list to None.

4. Disable reverse (PTR) record orchestration.

   1. Go to Infrastructure > Subnets and select a subnet.
   2. On the Capsules tab, setting the Reverse DNS Capsule drop-down list to None.

5. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP_address_of_Satellite_or_Capsule
   Option 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

To Configure Satellite Server for Outgoing Emails:

1. In the Satellite web UI, navigate to Administer → Settings.

2. Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect.

   1. The following example shows the configuration options for using an SMTP server:

      Table 3.1. Using an SMTP server as a delivery method

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.example.com
      SMTP authentication	login
      SMTP HELO/EHLO domain	example.com
      SMTP password	password
      SMTP port	25
      SMTP username	satellite@example.com

      The SMTP username and SMTP password specify the login credentials for the SMTP server.

   2. The following example uses gmail.com as an SMTP server:

      Table 3.2. Using gmail.com as an SMTP server

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.gmail.com
      SMTP authentication	plain
      SMTP HELO/EHLO domain	smtp.gmail.com
      SMTP enable StartTLS auto	Yes
      SMTP password	password
      SMTP port	587
      SMTP username	user@gmail.com

   3. The following example uses the sendmail command as a delivery method:

      Table 3.3. Using sendmail as a delivery method

      Name	Example value
      Delivery method	Sendmail
      Sendmail arguments	-i -t -G

      The Sendmail arguments specify the options passed to the sendmail command. The default value is -i -t. For more information see the sendmail 1 man page.

3. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust enable
     # update-ca-trust

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, in the web UI, set the SMTP enable StartTLS auto option to No.
4. Click Test email to send a test message to the user’s email address to confirm the configuration is working. If a message fails to send, the web UI displays an error. See the log at /var/log/foreman/production.log for further details.

1. Section 3.4.7.1, “Obtain an SSL Certificate for the Satellite Server”
2. Section 3.4.7.2, “Validate the Satellite Server’s SSL Certificate”
3. Section 3.4.7.3, “Run the Satellite Installer with Custom Certificate Parameters”
4. Section 3.4.7.4, “Install the New Certificate on all Hosts Connected to the Satellite Server”

1. Configure the Firewall.

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP

Configure Capsule Server with a Default Server Certificate

1. Create the certificates archive on Satellite Server.

   # capsule-certs-generate \
   --foreman-proxy-fqdn mycapsule.example.com \
   --certs-tar mycapsule.example.com-certs.tar

2. Ensure that the satellite-installer package is available on the Capsule Server.
3. Copy the generated archive .tar file from Satellite Server to Capsule Server.

4. Enable the certificate based on the needs of your environment. For more information, see satellite-installer --scenario capsule --help.

   # satellite-installer --scenario capsule \
   --foreman-proxy-content-parent-fqdn satellite.example.com \
   --foreman-proxy-register-in-foreman true \
   --foreman-proxy-foreman-base-url https://satellite.example.com \
   --foreman-proxy-trusted-hosts satellite.example.com \
   --foreman-proxy-trusted-hosts mycapsule.example.com \
   --foreman-proxy-oauth-consumer-key UVrAZfMaCfBiiWejoUVLYCZHT2xhzuFV \
   --foreman-proxy-oauth-consumer-secret \
   ZhH8p7M577ttNU3WmUGWASag3JeXKgUX \
   --foreman-proxy-content-pulp-oauth-secret TPk42MYZ42nAE3rZvyLBh7Lxob3nEUi8 \
   --foreman-proxy-content-certs-tar mycapsule.example.com-certs.tar

To Install katello-agent:

1. Log into the system.

2. Enable the Satellite tools repository for this version of Satellite.

   # subscription-manager repos \
   --enable=rhel-7-server-satellite-tools-6.3-rpms

3. Install the package.

   # yum install katello-agent

To add Life Cycle Environments to Capsule Servers using Hammer CLI:

1. Log in to the Satellite Server CLI as root.

2. Display a list of all Capsule Servers and note the ID:

   # hammer capsule list

3. Using the ID, verify the details of your Capsule Server:

   # hammer capsule info --id capsule_id_number

4. Verify the life cycle environments available and note the environment ID:

   # hammer capsule content available-lifecycle-environments \
   --id capsule_id_number

   Available life cycle environments are available for Capsule Server, but not currently attached.

5. Add the life cycle environment to your Capsule Server:

   # hammer capsule content add-lifecycle-environment \
   --id capsule_id_number --environment-id environment_id_number

6. Repeat for each life cycle environment you want to add to Capsule Server.

7. To synchronize all content from your Satellite Server environment to Capsule Server, enter the following command:

   # hammer capsule content synchronize --id capsule_id_number

8. To synchronize a specific life cycle environment from your Satellite Server to Capsule Server, enter the following command:

   # hammer capsule content synchronize --id external_capsule_id_number \
   --environment-id environment_id_number

To Add Life Cycle Environments to Capsule Servers using Web UI:

1. In the Satellite web UI, go to Infrastructure > Capsules, and select the Capsule.
2. Click Edit.
3. Select Env in the Life Cycle Environments tab.
4. To synchronize capsule’s content, click the Synchronize button in the Overview tab.

5. Select one of two options:

   • Optimized Sync
   • Complete Sync

Enable Power Management on Managed Hosts

1. Run the installer with the options to enable BMC.

   # satellite-installer --scenario capsule \
   --foreman-proxy-bmc "true" \
   --foreman-proxy-bmc-default-provider "freeipmi"

Configure DNS, DHCP, and TFTP on Capsule Server

1. Run capsule installer with the options applicable to your environment.

   The following example shows full provisioning services:

   # satellite-installer --scenario capsule \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-managed true \
   --foreman-proxy-dns-interface eth0 \
   --foreman-proxy-dns-zone example.com \
   --foreman-proxy-dns-forwarders 172.17.13.1 \
   --foreman-proxy-dns-reverse 13.17.172.in-addr.arpa \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-managed true \
   --foreman-proxy-dhcp-interface eth0 \
   --foreman-proxy-dhcp-range "172.17.13.100 172.17.13.150" \
   --foreman-proxy-dhcp-gateway 172.17.13.1 \
   --foreman-proxy-dhcp-nameservers 172.17.13.2 \
   --foreman-proxy-tftp true \
   --foreman-proxy-tftp-managed true \
   --foreman-proxy-tftp-servername $(hostname)

1. Section 4.7.6.1, “Obtain an SSL Certificate for the Capsule Server”
2. Section 4.7.6.2, “Validate the Capsule Server’s SSL Certificate”
3. Section 4.7.6.3, “Create the Capsule Server’s Certificate Archive File”
4. Section 4.7.6.4, “Install the Capsule Server’s Custom Certificate”
5. Section 4.7.6.5, “Install the Capsule Server’s New Certificate on All Hosts”

1. Configure the Firewall.

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP

1. Configure the firewall (UDP on port 69).

   # firewall-cmd --add-port="69/udp" \
   && firewall-cmd --permanent --add-port="69/udp"

Before you Begin.

1. Confirm the IdM server is deployed and the host-based firewall has been configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide.
2. Obtain an account on the IdM server with permissions to create zones on the IdM server.
3. Confirm if the Satellite or an external Capsule is managing DNS for a domain.
4. Confirm that the Satellite or external Capsule are currently working as expected.
5. In the case of a newly installed system, complete the installation procedures in this guide first. In particular, DNS and DHCP configuration should have been completed.
6. Make a backup of the answer file in case you have to revert the changes. See Section 3.3.3, “Specifying Installation Options” for more information.

Create a Kerberos Principal on the IdM Server.

1. Ensure you have a Kerberos ticket.

   # kinit idm_user

   Where idm_user is the account created for you by the IdM administrator.

2. Create a new Kerberos principal for the Satellite or Capsule to use to authenticate to the IdM server.

   # ipa service-add capsule/satellite.example.com

1. Install the IdM client package.

   # yum install ipa-client

2. Configure the IdM client by running the installation script and following the on-screen prompts.

   # ipa-client-install

3. Ensure you have a Kerberos ticket.

   # kinit admin

4. Remove any preexisting keytab.

   # rm /etc/foreman-proxy/dns.keytab

5. Get the keytab created for this system.

   # ipa-getkeytab -p capsule/satellite.example.com@EXAMPLE.COM \
   -s idm1.example.com -k /etc/foreman-proxy/dns.keytab

   Note

   When adding a keytab to a standby system with the same host name as the original system in service, add the r option to prevent generating new credentials and rendering the credentials on the original system invalid.

6. Set the group and owner for the keytab file to foreman-proxy as follows.

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab

7. If required, check the keytab is valid.

   # kinit -kt /etc/foreman-proxy/dns.keytab \
   capsule/satellite.example.com@EXAMPLE.COM

Configure DNS Zones in the IdM web UI.

1. Create and configure the zone to be managed:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Select Add and enter the zone name. In this example, example.com.
   3. Click Add and Edit.

   4. On the Settings tab, in the BIND update policy box, add an entry as follows to the semi-colon separated list.

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

   5. Ensure Dynamic update is set to True.
   6. Enable Allow PTR sync.
   7. Select Save to save the changes.

2. Create and Configure the reverse zone.

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Select Add.
   3. Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups.
   4. Click Add and Edit.

   5. On the Settings tab, in the BIND update policy box, add an entry as follows to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

   6. Ensure Dynamic update is set to True.
   7. Select Save to save the changes.

1. Navigate to Infrastructure > Capsules.
2. For each Capsule to be updated, from the Actions drop-down menu, select Refresh.

3. Configure the domain:

   1. Go to Infrastructure > Domains and select the domain name.
   2. On the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

4. Configure the subnet:

   1. Go to Infrastructure > Subnets and select the subnet name.
   2. On the Subnet tab, set IPAM to None.
   3. On the Domains tab, ensure the domain to be managed by the IdM server is selected.
   4. On the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.

Before you Begin

1. Confirm the IdM Server is deployed and the host-based firewall has been configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide.
2. Obtain root user privileges on the IdM server.
3. Confirm if the Satellite or an external Capsule is managing DNS for a domain.
4. Confirm that the Satellite or external Capsule are currently working as expected.
5. In the case of a newly installed system, complete the installation procedures in this guide first. In particular, DNS and DHCP configuration should have been completed.
6. Make a backup of the answer file in case you have to revert the changes. See Section 3.3.3, “Specifying Installation Options” for more information.

Enabling External Updates to the DNS Zone in the IdM Server

1. On the IdM Server, add the following to the top of the /etc/named.conf file.

   // This was added to allow Satellite Server at 192.168.25.1 to make DNS updates.
   ########################################################################
   include "/etc/rndc.key";
   controls  {
   inet 192.168.25.2 port 953 allow { 192.168.25.1; } keys { "rndc-key"; };
   };
   ########################################################################

2. Reload named to make the changes take effect.

   # systemctl reload named

3. In the IdM web UI, go to Network Services > DNS > DNS Zones. Select the name of the zone. On the Settings tab:

   1. Add the following in the BIND update policy box.

      grant "rndc-key" zonesub ANY;

   2. Ensure Dynamic update is set to True.
   3. Click Update to save the changes.

4. Copy the /etc/rndc.key file from the IdM server to Satellite’s base system as follows.

   # scp /etc/rndc.key root@satellite.example.com:/etc/rndc.key

5. Ensure that the ownership, permissions, and SELinux context are correct.

   # restorecon -v /etc/rndc.key
   # chown -v root:named /etc/rndc.key
   # chmod -v 640 /etc/rndc.key

6. On Satellite Server, run the installation script as follows to use the external DNS server.

   # satellite-installer --scenario satellite \
   --foreman-proxy-dns=true \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="192.168.25.2" \
   --foreman-proxy-keyfile=/etc/rndc.key \
   --foreman-proxy-dns-ttl=86400

Testing External Updates to the DNS Zone in the IdM Server

1. Install bind-utils for testing with nsupdate.

   # yum install bind-utils

2. Ensure the key in the /etc/rndc.key file on Satellite Server is the same one as used on the IdM server.

   key "rndc-key" {
           algorithm hmac-md5;
           secret "secret-key==";
   };

3. On Satellite Server, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1.

   # echo -e "server 192.168.25.1\n \
   update add test.example.com 3600 IN A 192.168.25.20\n \
   send\n" | nsupdate -k /etc/rndc.key

4. On Satellite Server, test the DNS entry.

   # nslookup test.example.com 192.168.25.1
   Server:		192.168.25.1
   Address:	192.168.25.1#53
   
   Name:	test.example.com
   Address: 192.168.25.20

5. To view the entry in the IdM web UI, go to Network Services > DNS > DNS Zones. Select the name of the zone and search for the host by name.

6. If resolved successfully, remove the test DNS entry.

   # echo -e "server 192.168.25.1\n \
   update delete test.example.com 3600 IN A 192.168.25.20\n \
   send\n" | nsupdate -k /etc/rndc.key

7. Confirm that the DNS entry was removed.

   # nslookup test.example.com 192.168.25.1

   The above nslookup command fails and outputs the SERVFAIL error message if the record was successfully deleted.

1. Navigate to Infrastructure > Capsules.
2. For each Capsule to be updated, from the Actions drop-down menu, select Refresh.

3. Configure the domain:

   1. Go to Infrastructure > Domains and select the domain name.
   2. On the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

4. Configure the subnet:

   1. Go to Infrastructure > Subnets and select the subnet name.
   2. On the Subnet tab, set IPAM to DHCP or Internal DB.
   3. On the Domains tab, ensure the domain to be managed by the Satellite or Capsule is selected.
   4. On the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.

1. Launch an EC2 instance of a Red Hat Enterprise Linux AMI
2. Connect to the newly created instance.