Chapter 3. Performing Additional Configuration on Satellite Server

Procedure

1. To install Red Hat Insights on Satellite Server, enter the following command:

   # satellite-maintain packages install insights-client

2. To register Satellite Server with Red Hat Insights, enter the following command:

   # insights-client --register

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. Use the Search field to enter the following repository name: Red Hat Satellite Tools 6.5 (for RHEL 7 Server) (RPMs).

3. In the Available Repositories pane, click on Red Hat Satellite Tools 6.5 (for RHEL 7 Server) (RPMs) to expand the repository set.

   If the Red Hat Satellite Tools 6.5 items are not visible, it may be because they are not included in the Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Subscription Manifest and import it into Satellite.

4. For the x86_64 entry, click the Enable icon to enable the repository.

1. In the Satellite web UI, navigate to Content > Sync Status.

   A list of product repositories available for synchronization is displayed.

2. Click the arrow next to the Red Hat Enterprise Linux Server product to view available content.
3. Select Red Hat Satellite Tools 6.5 (for RHEL 7 Server) RPMs x86_64.
4. Click Synchronize Now.

To Configure Satellite with an HTTP Proxy

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # unset http_proxy
   # unset https_proxy
   # unset no_proxy

2. Run satellite-installer with the HTTP proxy options.

   # satellite-installer --scenario satellite \
   --katello-proxy-url=http://myproxy.example.com \
   --katello-proxy-port=8080 \
   --katello-proxy-username=proxy_username \
   --katello-proxy-password='proxy_password'

3. Verify that Satellite Server can connect to the Red Hat CDN and can synchronize its repositories.

   1. On the network gateway and the HTTP Proxy, enable TCP for the following host names:

      Host name	Port	Protocol
      subscription.rhsm.redhat.com	443	HTTPS
      cdn.redhat.com	443	HTTPS
      *.akamaiedge.net	443	HTTPS
      cert-api.access.redhat.com (if using Red Hat Insights)	443	HTTPS
      api.access.redhat.com (if using Red Hat Insights)	443	HTTPS

      Satellite Server communicates with the Red Hat CDN securely over SSL. Use of an SSL interception proxy interferes with this communication. These hosts must be whitelisted on the proxy.

      For a list of IP addresses used by the Red Hat CDN (cdn.redhat.com), see the Knowledgebase article Public CIDR Lists for Red Hat on the Red Hat Customer Portal.

   2. On Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file:

      # an http proxy server to use (enter server FQDN)
      proxy_hostname = myproxy.example.com
      
      # port for http proxy server
      proxy_port = 8080
      
      # user name for authenticating to an http proxy, if needed
      proxy_user =
      
      # password for basic http proxy auth, if needed
      proxy_password =

1. To verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy row, select the adjacent Value column and enter the proxy URL.
3. Click the tick icon to save your changes.

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy except hosts row, select the adjacent Value column and enter the names of one or more hosts that you want to exclude from proxy requests.
3. Click the tick icon to save your changes.

Enable Power Management on Managed Hosts

1. Run the installer with the options to enable BMC.

   # satellite-installer --foreman-proxy-bmc "true" \
   --foreman-proxy-bmc-default-provider "freeipmi"

Configure DNS, DHCP, and TFTP on Satellite Server

1. Run satellite-installer with the options appropriate for your environment.

   # satellite-installer --scenario satellite \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-managed true \
   --foreman-proxy-dns-interface eth0 \
   --foreman-proxy-dns-zone example.com \
   --foreman-proxy-dns-forwarders 172.17.13.1 \
   --foreman-proxy-dns-reverse 13.17.172.in-addr.arpa \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-managed true \
   --foreman-proxy-dhcp-interface eth0 \
   --foreman-proxy-dhcp-range "172.17.13.100 172.17.13.150" \
   --foreman-proxy-dhcp-gateway 172.17.13.1 \
   --foreman-proxy-dhcp-nameservers 172.17.13.2 \
   --foreman-proxy-tftp true \
   --foreman-proxy-tftp-managed true \
   --foreman-proxy-tftp-servername $(hostname)

   For more information about configuring DHCP, DNS, and TFTP services, see the Configuring Network Services section in the Provisioning Guide.

   The script displays its progress and writes logs to /var/log/foreman-installer/satellite.log. You can view the settings used, including the admin_password parameter, in the /etc/foreman-installer/scenarios.d/satellite-answers.yaml file.

1. On Satellite Server, enter the following command:

   # satellite-installer --foreman-proxy-dhcp false \
   --foreman-proxy-dns false \
   --foreman-proxy-tftp false

2. In the Satellite web UI, navigate to Infrastructure > Subnets and select a subnet.
3. Click the Capsules tab and clear the DHCP Capsule, TFTP Capsule, and Reverse DNS Capsule fields.
4. Navigate to Infrastructure > Domains and select a domain.
5. Clear the DNS Capsule field.

6. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP_address_of_Satellite_or_Capsule
   Option 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

To Configure Satellite Server for Outgoing Emails:

1. In the Satellite web UI, navigate to Administer → Settings.

2. Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect.

   1. The following example shows the configuration options for using an SMTP server:

      Table 3.1. Using an SMTP server as a delivery method

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.example.com
      SMTP authentication	login
      SMTP HELO/EHLO domain	example.com
      SMTP password	password
      SMTP port	25
      SMTP username	satellite@example.com

      The SMTP username and SMTP password specify the login credentials for the SMTP server.

   2. The following example uses gmail.com as an SMTP server:

      Table 3.2. Using gmail.com as an SMTP server

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.gmail.com
      SMTP authentication	plain
      SMTP HELO/EHLO domain	smtp.gmail.com
      SMTP enable StartTLS auto	Yes
      SMTP password	password
      SMTP port	587
      SMTP username	user@gmail.com

   3. The following example uses the sendmail command as a delivery method:

      Table 3.3. Using sendmail as a delivery method

      Name	Example value
      Delivery method	Sendmail
      Sendmail arguments	-i -t -G

      The Sendmail arguments specify the options passed to the sendmail command. The default value is -i -t. For more information see the sendmail 1 man page.

3. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust enable
     # update-ca-trust

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, in the web UI, set the SMTP enable StartTLS auto option to No.
4. Click Test email to send a test message to the user’s email address to confirm the configuration is working. If a message fails to send, the web UI displays an error. See the log at /var/log/foreman/production.log for further details.

1. Section 3.11.1, “Obtain an SSL Certificate for Satellite Server”
2. Section 3.11.2, “Validate the Satellite Server’s SSL Certificate”
3. Section 3.11.3, “Run the Satellite Installer with Custom Certificate Parameters”
4. Section 3.11.4, “Install the New Certificate on all Hosts Connected to the Satellite Server”
5. If you have external Capsule Servers registered to the Satellite Server, proceed to Configuring Capsule Server with a Custom Server Certificate in the Installing Capsule Server guide to configure the Capsule Servers to use a custom certificate.

1. Configure the Firewall.

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent