Chapter 4. Configuring External Services

1. Deploy a Red Hat Enterprise Linux Server and install the ISC DNS Service.

   # yum install bind bind-utils

2. Create the configuration file for a domain.

   The following example configures a domain virtual.lan as one subnet 192.168.38.0/24, a security key named capsule, and sets forwarders to Google’s public DNS addresses (8.8.8.8 and 8.8.4.4). 192.168.38.2 is the IP address of a DNS server and 192.168.38.1 is the IP address of a Satellite Server or a Capsule Server.

   # cat /etc/named.conf
   include "/etc/rndc.key";
   
   controls  {
       inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "capsule"; };
       inet 192.168.38.2 port 953 allow { 192.168.38.1; 192.168.38.2; } keys { "capsule"; };
   };
   
   options  {
       directory "/var/named";
       forwarders { 8.8.8.8; 8.8.4.4; };
   };
   
   include "/etc/named.rfc1912.zones";
   
   zone "38.168.192.in-addr.arpa" IN {
       type master;
       file "dynamic/38.168.192-rev";
       update-policy {
           grant "capsule" zonesub ANY;
       };
   };
   
   zone "virtual.lan" IN {
       type master;
       file "dynamic/virtual.lan";
       update-policy {
           grant "capsule" zonesub ANY;
       };
   };

   The inet line must be entered as one line in the configuration file.

3. Create a key file.

   # ddns-confgen -k capsule

   This command can take a long time to complete.

4. Copy and paste the output from the key section into a separate file called /etc/rndc.key.

   # cat /etc/rndc.key
   key "capsule" {
           algorithm hmac-sha256;
           secret "GeBbgGoLedEAAwNQPtPh3zP56MJbkwM84UJDtaUS9mw=";
   };

   Important

   This is the key used to change DNS server configuration. Only the root user should read and write to it.

5. Create zone files.

   # cat /var/named/dynamic/virtual.lan
   $ORIGIN .
   $TTL 10800      ; 3 hours
   virtual.lan             IN SOA  service.virtual.lan. root.virtual.lan. (
                                   9          ; serial
                                   86400      ; refresh (1 day)
                                   3600       ; retry (1 hour)
                                   604800     ; expire (1 week)
                                   3600       ; minimum (1 hour)
                                   )
                           NS      service.virtual.lan.
   $ORIGIN virtual.lan.
   $TTL 86400      ; 1 day
   capsule                 A       192.168.38.1
   service                 A       192.168.38.2

6. Create the reverse zone file.

   # cat /var/named/dynamic/38.168.192-rev
   $ORIGIN .
   $TTL 10800      ; 3 hours
   38.168.192.in-addr.arpa IN SOA  service.virtual.lan. root.38.168.192.in-addr.arpa. (
                                   4          ; serial
                                   86400      ; refresh (1 day)
                                   3600       ; retry (1 hour)
                                   604800     ; expire (1 week)
                                   3600       ; minimum (1 hour)
                                   )
                           NS      service.virtual.lan.
   $ORIGIN 38.168.192.in-addr.arpa.
   $TTL 86400      ; 1 day
   1                PTR     capsule.virtual.lan.
   2                PTR     service.virtual.lan.

   There should be no extra non-ASCII characters.

1. Validate the syntax.

   # named-checkconf -z /etc/named.conf

2. Start the server.

   # systemctl restart named

3. Add a new host.

   The following uses the example host 192.168.38.2. You should change this to suit your environment.

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

4. Test that the DNS service can resolve the new host.

   # nslookup aaa.virtual.lan 192.168.38.2

5. If necessary, delete the new entry.

   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

6. Configure the firewall for external access to the DNS service (UDP and TCP on port 53).

   # firewall-cmd --add-port="53/udp" --add-port="53/tcp" \
   && firewall-cmd --runtime-to-permanent

To configure the DHCP server and share the DHCP configuration and lease files

1. Deploy a Red Hat Enterprise Linux Server and install the ISC DHCP Service and Berkeley Internet Name Domain (BIND).

   # yum install dhcp bind

2. Generate a security token in an empty directory.

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   The above command can take a long time, for less-secure proof-of-concept deployments you can use a non-blocking random number generator.

   # dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key

   This creates the key pair in two files in the current directory.

3. Copy the secret hash from the key.

   # cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2

4. Edit the dhcpd configuration file for all of the subnets and add the key as in the example:

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm HMAC-MD5;
   	secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw==";
   };
   omapi-key omapi_key;

5. Delete the two key files from the directory where you created them.

6. Define each subnet on the Satellite Server.

   It is recommended to set up a lease range and reservation range separately to prevent conflicts. For example, the lease range is 192.168.38.10 to 192.168.38.100 so the reservation range (defined in the Satellite web UI) is 192.168.38.101 to 192.168.38.250. Do not set DHCP Capsule for the defined Subnet yet.

7. Configure the firewall for external access to the DHCP server.

   # firewall-cmd --add-service dhcp \
   && firewall-cmd --runtime-to-permanent

8. Determine the UID and GID numbers of the foreman user on the Satellite Server.

   # id -u foreman
   993
   # id -g foreman
   990

9. Create the same user and group with the same IDs on the DHCP server.

   # groupadd -g 990 foreman
   # useradd -u 993 -g 990 -s /sbin/nologin foreman

10. To make the configuration files readable, restore the read and execute flags.

    # chmod o+rx /etc/dhcp/
    # chmod o+r /etc/dhcp/dhcpd.conf
    # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

11. Start the DHCP service.

    # systemctl start dhcpd

12. Export the DHCP configuration and leases files using NFS.

    # yum install nfs-utils
    # systemctl enable rpcbind nfs-server
    # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd

13. Create the DHCP configuration and leases files to be exported using NFS.

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

14. Add the following line to the /etc/fstab file to create mount points for the newly created directories.

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

15. Mount the file systems in /etc/fstab.

    # mount -a

16. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)
    
    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)
    
    /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

17. Reload the NFS server.

    # exportfs -rva

18. Configure the firewall for the DHCP omapi port 7911 for the Satellite Server.

    # firewall-cmd --add-port="7911/tcp" \
    && firewall-cmd --runtime-to-permanent

19. If required, configure the firewall for external access to NFS.

    Clients are configured using NFSv3.

    • Use the firewalld daemon’s NFS service to configure the firewall.

      # firewall-cmd --zone public --add-service mountd \
      && firewall-cmd --zone public --add-service rpc-bind \
      && firewall-cmd --zone public --add-service nfs \
      && firewall-cmd --runtime-to-permanent

To configure the Satellite Server

1. Install the NFS client.

   # yum install nfs-utils

2. Create the DHCP directories for NFS.

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner.

   # chown -R foreman-proxy /mnt/nfs

4. Verify communication with the NFS server and RPC communication paths.

   # showmount -e your_DHCP_server_FQDN
   # rpcinfo -p your_DHCP_server_FQDN

5. Add the following lines to the /etc/fstab file:

   your_DHCP_server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0
   
   your_DHCP_server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems on /etc/fstab.

   # mount -a

7. Read the relevant files.

   # su foreman-proxy -s /bin/bash
   bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   bash-4.2$ exit

8. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file.

   # satellite-installer --foreman-proxy-dhcp=true \
   --foreman-proxy-dhcp-provider=remote_isc \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911 \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-server=your_DHCP_server_FQDN

9. Restart the foreman-proxy service.

   # systemctl restart foreman-proxy

10. Log in to the Satellite Server web UI.
11. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DHCP feature should appear.
12. Associate the DHCP service with the appropriate subnets and domain.

Configure Satellite Server with External TFTP

1. Install and enable the TFTP server.

   # yum install tftp-server syslinux

2. Enable and activate the tftp.socket unit.

   # systemctl enable tftp.socket
   # systemctl start tftp.socket

3. Configure the PXELinux environment.

   # mkdir -p /var/lib/tftpboot/{boot,pxelinux.cfg,grub2}
   # cp /usr/share/syslinux/{pxelinux.0,menu.c32,chain.c32} \
   /var/lib/tftpboot/

4. Restore SELinux file contexts.

   # restorecon -RvF /var/lib/tftpboot/

5. Create the TFTP directory to be exported using NFS.

   # mkdir -p /exports/var/lib/tftpboot

6. Add the newly created mount point to the /etc/fstab file.

   /var/lib/tftpboot /exports/var/lib/tftpboot none bind,auto 0 0

7. Mount the file systems in /etc/fstab.

   # mount -a

8. Ensure the following lines are present in /etc/exports:

   /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)

   /exports/var/lib/tftpboot 192.168.38.1(rw,async,no_root_squash,no_subtree_check,nohide)

   The first line is common to the DHCP configuration and therefore should already be present if the previous procedure was completed on this system.

9. Reload the NFS server.

   # exportfs -rva