Chapter 3. Performing Additional Configuration on Satellite Server

Procedure

1. Log on to the Red Hat Customer Portal at https://access.redhat.com.
2. In the upper left of the window, click Downloads and select Red Hat Satellite.
3. Click the Content ISOs tab. This page lists all the products that are available in your subscription.
4. Click the link for the product name, such as Red Hat Enterprise Linux 7 Server (x86_64) to download the ISO image.

5. Copy all of Satellite Content ISO images to a system that you want to use as a local CDN server. For example, the /root/isos directory on Satellite Server.

   Note that storing the content on the same system where Satellite is installed is not a requirement. The CDN can be hosted on a different system inside the same disconnected network as long as it is accessible to Satellite Server over HTTP.

6. On the system that you want to use as your local CDN server, create a local directory that is accessible over httpd. For example, /var/www/html/pub/sat-import/:

   # mkdir -p /var/www/html/pub/sat-import/

7. Create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop /root/isos/first_iso /mnt/iso

8. Recursively copy content of the first ISO image to the local directory:

   # cp -ruv /mnt/iso/* /var/www/html/pub/sat-import/

9. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the mount point:

   # umount /mnt/iso
   # rmdir /mnt/iso

10. Repeat the above step for each ISO image until you have copied all the data from the Content ISO images into /var/www/html/pub/sat-import/.

11. Ensure that the SELinux context for the directory is correct:

    # restorecon -rv /var/www/html/pub/sat-import/

12. In the Satellite web UI, navigate to Content > Subscriptions.
13. Click Manage Manifest.

14. Edit the Red Hat CDN URL field to point to the host name of the system that you use as a local CDN server with the newly created directory, for example:

    http://server.example.com/pub/sat-import/

15. Click Update and then upload your manifest into Satellite.

Procedure

1. Navigate to the Red Hat Customer Portal at https://access.redhat.com/ and log in.
2. In the upper left of the window, click Downloads.
3. Locate and click the version of Red Hat Enterprise Linux that you want to use, for example Red Hat Enterprise Linux 8.
4. In the Download Red Hat Enterprise Linux window, locate the binary DVD version of the ISO image, for example, Red Hat Enterprise Linux 8.1 Binary DVD, and click Download Now.
5. When the download completes, copy the ISO image to Satellite Server.

6. On Satellite Server, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop rhel-8.1-x86_64-dvd.iso /mnt/iso

7. Create Kickstart directories for AppStream and BaseOS:

   # mkdir /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart
   
   # mkdir /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

   Note that if you use Red Hat Enterprise Linux 7, you must create and complete all the following steps in only one directory /var/www/html/pub/sat-import/content/dist/rhel/server/7/7.7/x86_64/kickstart/.

8. To the listing files /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/listing and /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/listing, append kickstart with a new line:

   kickstart

9. To the listing file /var/www/html/pub/sat-import/content/dist/rhel8/listing, append the version number of the operating system ISO that you use with a new line. For example, for the RHEL 8.1 binary ISO, add 8.1 with a new line:

   8.1

10. Copy the kickstart files from the ISO image:

    # cp -a /mnt/iso/AppStream/* \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart
    
    # cp -a /mnt/iso/BaseOS/* /mnt/iso/images/ \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

    Note that for BaseOS, you must also copy the contents of the /mnt/iso/images/ directory.

11. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo
    
    # cp /mnt/iso/.treeinfo \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo

12. Open the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file for editing.

13. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variant = AppStream to variant = BaseOS
    • Change variants = AppStream,BaseOS to variants = BaseOS
14. In the [tree] section, change variants = AppStream,BaseOS to variants = BaseOS.

15. In the [variant-BaseOS] section, make the following changes:

    • Change packages = BaseOS/Packages to packages = Packages
    • Change repository = BaseOS to repository = .
16. Delete the [media] and [variant-AppStream] sections.
17. Save and close the file.

18. Verify that the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file has the following format:

    [checksums]
    images/efiboot.img = sha256:9ad9beee4c906cd05d227a1be7a499c8d2f20b3891c79831325844c845262bb6
    images/install.img = sha256:e246bf4aedfff3bb54ae9012f959597cdab7387aadb3a504f841bdc2c35fe75e
    images/pxeboot/initrd.img = sha256:a66e3c158f02840b19c372136a522177a2ab4bd91cb7269fb5bfdaaf7452efef
    images/pxeboot/vmlinuz = sha256:789028335b64ddad343f61f2abfdc9819ed8e9dfad4df43a2694c0a0ba780d16
    
    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 8.1.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = BaseOS
    variants = BaseOS
    version = 8.1.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [images-x86_64]
    efiboot.img = images/efiboot.img
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [images-xen]
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 8.1.0
    
    [stage2]
    mainimage = images/install.img
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = BaseOS
    
    [variant-BaseOS]
    id = BaseOS
    name = BaseOS
    packages = Packages
    repository = .
    type = variant
    uid = BaseOS

19. Open the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file for editing.

20. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variants = AppStream,BaseOS to variants = AppStream
21. In the [tree] section, change variants = AppStream,BaseOS to variants = AppStream.

22. In the [variant-AppStream] section, make the following changes:

    • Change packages = AppStream/Packages to packages = Packages
    • Change repository = AppStream to repository = .
23. Delete the following sections from the file: [checksums], [images-x86_64], [images-xen], [media], [stage2], [variant-BaseOS].
24. Save and close the file.

25. Verify that the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file has the following format:

    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 8.1.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = AppStream
    variants = AppStream
    version = 8.1.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 8.1.0
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = AppStream
    
    [variant-AppStream]
    id = AppStream
    name = AppStream
    packages = Packages
    repository = .
    type = variant
    uid = AppStream

26. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso
    # rmdir /mnt/iso

27. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. In the Satellite web UI, navigate to Content > Subscriptions.
2. Click Manage Manifest.

3. Edit the Red Hat CDN URL field to point to the Red Hat CDN URL:

   https://cdn.redhat.com

4. Click Save.

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. Use the Search field to enter the following repository name: Red Hat Satellite Tools 6.6 (for RHEL 7 Server) (RPMs).

3. In the Available Repositories pane, click on Red Hat Satellite Tools 6.6 (for RHEL 7 Server) (RPMs) to expand the repository set.

   If the Red Hat Satellite Tools 6.6 items are not visible, it may be because they are not included in the Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Subscription Manifest and import it into Satellite.

4. For the x86_64 entry, click the Enable icon to enable the repository.

1. In the Satellite web UI, navigate to Content > Sync Status.

   A list of product repositories available for synchronization is displayed.

2. Click the arrow next to the Red Hat Enterprise Linux Server product to view available content.
3. Select Red Hat Satellite Tools 6.6 (for RHEL 7 Server) RPMs x86_64.
4. Click Synchronize Now.

1. On Satellite Server, enter the following command:

   # satellite-installer --foreman-proxy-dhcp false \
   --foreman-proxy-dns false \
   --foreman-proxy-tftp false

2. In the Satellite web UI, navigate to Infrastructure > Subnets and select a subnet.
3. Click the Capsules tab and clear the DHCP Capsule, TFTP Capsule, and Reverse DNS Capsule fields.
4. Navigate to Infrastructure > Domains and select a domain.
5. Clear the DNS Capsule field.

6. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP_address_of_Satellite_or_Capsule
   Option 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

To Configure Satellite Server for Outgoing Emails:

1. In the Satellite web UI, navigate to Administer → Settings.

2. Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect.

   1. The following example shows the configuration options for using an SMTP server:

      Table 3.1. Using an SMTP server as a delivery method

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.example.com
      SMTP authentication	login
      SMTP HELO/EHLO domain	example.com
      SMTP password	password
      SMTP port	25
      SMTP username	satellite@example.com

      The SMTP username and SMTP password specify the login credentials for the SMTP server.

   2. The following example uses gmail.com as an SMTP server:

      Table 3.2. Using gmail.com as an SMTP server

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.gmail.com
      SMTP authentication	plain
      SMTP HELO/EHLO domain	smtp.gmail.com
      SMTP enable StartTLS auto	Yes
      SMTP password	password
      SMTP port	587
      SMTP username	user@gmail.com

   3. The following example uses the sendmail command as a delivery method:

      Table 3.3. Using sendmail as a delivery method

      Name	Example value
      Delivery method	Sendmail
      Sendmail arguments	-i -t -G

      The Sendmail arguments specify the options passed to the sendmail command. The default value is -i -t. For more information see the sendmail 1 man page.

3. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust enable
     # update-ca-trust

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, in the web UI, set the SMTP enable StartTLS auto option to No.
4. Click Test email to send a test message to the user’s email address to confirm the configuration is working. If a message fails to send, the web UI displays an error. See the log at /var/log/foreman/production.log for further details.

1. Section 3.10.1, “Creating a Custom SSL Certificate for Satellite Server”
2. Section 3.10.2, “Deploying a Custom SSL Certificate to Satellite Server”
3. Section 3.10.3, “Deploying a Custom SSL Certificate to Hosts”
4. If you have external Capsule Servers registered to Satellite Server, you must configure them with custom SSL certificates. For more information, see Configuring Capsule Server with a Custom SSL Certificate in Installing Capsule Server.

Procedure

1. Update the firewall configuration by entering the following command:

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

1. On Satellite Server, back up the /etc/foreman-installer/custom-hiera.yaml file to custom-hiera.original:

   # mv /etc/foreman-installer/custom-hiera.yaml \
   /etc/foreman-installer/custom-hiera.original

2. In your browser, navigate to tuning profiles in the satellite-support GitHub repository and click the profile that matches your Satellite deployment.
3. Click the Raw button and preserve the URL to download the profile in the next step.

4. Download the tuning profile, for example, using curl with the URL of the profile in the raw format:

   # curl -O https://raw.githubusercontent.com/RedHatSatellite/satellite-support/master/tuning-profiles/custom-hiera-large-64G.yaml

5. Copy the tuning profile that matches your Satellite deployment to /etc/foreman-installer/custom-hiera.yaml:

   # cp custom-hiera-large-64G.yaml /etc/foreman-installer/custom-hiera.yaml

6. Optional: If you added custom settings to custom-hiera.yaml, copy them from the backed up to the new custom-hiera.yaml file:

7. Optional: If you upgrade your Satellite, search the backed up /etc/foreman-installer/custom-hiera.original file for the strings in the following format and copy them to the new /etc/foreman-installer/custom-hiera.yaml file:

   # Added by foreman-installer during upgrade, run the installer with --upgrade-mongo-storage to upgrade to WiredTiger.
   mongodb::server::storage_engine: 'mmapv1'

8. Enter the satellite-installer command with no arguments to apply settings:

   # satellite-installer