Chapter 4. Performing Additional Configuration on Satellite Server

Procedure

1. In the Satellite web UI, navigate to Infrastructure > HTTP Proxies.
2. Click New HTTP Proxy.
3. In the Name field, enter the name for the HTTP proxy.
4. In the Url field, enter the URL of the HTTP proxy in the following format: https://proxy.example.com:8080.
5. Optional: If authentication is required, in the Username field, enter the username to authenticate with.
6. Optional: If authentication is required, in the Password field, enter the password to authenticate with.
7. To test connection to the proxy, click the Test Connection button.
8. Click Submit.
9. Navigate to Administer > Settings, and click the Content tab.
10. Set the Default HTTP Proxy setting to the created HTTP proxy.

For CLI Users

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # unset http_proxy
   # unset https_proxy
   # unset no_proxy

2. Add an HTTP proxy entry to Satellite:

   # hammer http-proxy create --name=myproxy \
   --url http://myproxy.example.com:8080  \
   --username=proxy_username \
   --password=proxy_password

3. Configure Satellite to use this HTTP proxy by default:

   # hammer settings set --name=content_default_http_proxy --value=myproxy

Procedure

1. On the network gateway and the HTTP Proxy, enable TCP for the following host names:

   Host name	Port	Protocol
   subscription.rhsm.redhat.com	443	HTTPS
   cdn.redhat.com	443	HTTPS
   *.akamaiedge.net	443	HTTPS
   cert-api.access.redhat.com (if using Red Hat Insights)	443	HTTPS
   api.access.redhat.com (if using Red Hat Insights)	443	HTTPS

   Satellite Server uses SSL to communicate with the Red Hat CDN securely. Use of an SSL interception proxy interferes with this communication. These hosts must be whitelisted on the proxy.

   For a list of IP addresses used by the Red Hat CDN (cdn.redhat.com), see the Knowledgebase article Public CIDR Lists for Red Hat on the Red Hat Customer Portal.

2. On Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file:

   # an http proxy server to use (enter server FQDN)
   proxy_hostname = myproxy.example.com
   
   # port for http proxy server
   proxy_port = 8080
   
   # user name for authenticating to an http proxy, if needed
   proxy_user =
   
   # password for basic http proxy auth, if needed
   proxy_password =

Procedure

1. On Satellite, to verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy row, select the adjacent Value column and enter the proxy URL.
3. Click the tick icon to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy except hosts row, select the adjacent Value column and enter the names of one or more hosts that you want to exclude from proxy requests.
3. Click the tick icon to save your changes.

Procedure

1. Navigate to Administer > Settings, and click the Content tab.
2. Set the Default HTTP Proxy setting to no global default.

1. To store all the source certificate files, create a directory that is accessible only to the root user.

   # mkdir /root/satellite_cert

2. Create a private key with which to sign the Certificate Signing Request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Satellite Server, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

3. Create the /root/satellite_cert/openssl.cnf configuration file for the Certificate Signing Request (CSR) and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   x509_extensions = usr_cert
   prompt = no
   
   [ req_distinguished_name ] 1
   C  = Country Name (2 letter code)
   ST = State or Province Name (full name)
   L  = Locality Name (eg, city)
   O  = Organization Name (eg, company)
   OU = The division of your organization handling the certificate
   CN = satellite.example.com 2
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   subjectAltName = @alt_names
   
   [ usr_cert ]
   basicConstraints=CA:FALSE
   nsCertType = client, server, email
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   nsComment = "OpenSSL Generated Certificate"
   subjectKeyIdentifier=hash
   authorityKeyIdentifier=keyid,issuer
   
   [ alt_names ]
   DNS.1 = satellite.example.com 3

   1

   In the [ req_distinguished_name ] section, enter information about your organization.

   2

   Set the certificate’s Common Name CN to match the fully qualified domain name (FQDN) of your Satellite Server. To confirm a FQDN, on that Satellite Server, enter the hostname -f command. This is required to ensure that the katello-certs-check command validates the certificate correctly.

   3

   Set the Subject Alternative Name (SAN) DNS.1 to match the fully qualified domain name (FQDN) of your server.

4. Generate the Certificate Signing Request (CSR):

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \ 1
   -config /root/satellite_cert/openssl.cnf \ 2
   -out /root/satellite_cert/satellite_cert_csr.pem 3

   1

   Path to the private key.

   2

   Path to the configuration file.

   3

   Path to the CSR to generate.

5. Send the certificate signing request to the Certificate Authority. The same Certificate Authority must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the Certificate Authority for the preferred method. In response to the request, you can expect to receive a Certificate Authority bundle and a signed certificate, in separate files.

1. Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server.

   # katello-certs-check \
   -c /root/satellite_cert/satellite_cert.pem \      1
   -k /root/satellite_cert/satellite_cert_key.pem \  2
   -b /root/satellite_cert/ca_cert_bundle.pem        3

   1

   Path to the Satellite Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign the Capsule Server certificate.

   3

   Path to the Certificate Authority bundle.

   If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to Satellite Server.

   Example output of katello-certs-check

   Validation succeeded.
   
   To install the Red Hat Satellite Server with the custom certificates, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem"
   
   To update the certificates on a currently running Red Hat Satellite installation, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem" \
       --certs-update-server --certs-update-server-ca

2. From the output of the katello-certs-check command, depending on your requirements, enter the satellite-installer command that installs a new Satellite with custom SSL certificates or updates certificates on a currently running Satellite.

   If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates.

   Important

   Do not delete the certificate archive file after you deploy the certificate. It is required, for example, when upgrading Satellite Server.

3. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com.
4. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'
   # subscription-manager repos --enable=rhel-server-rhscl-7-rpms \
   --enable=rhel-7-server-rpms --enable=rhel-7-server-satellite-6.9-rpms

Procedure

1. To install MongoDB, enter the following command:

   # yum install rh-mongodb34 rh-mongodb34-syspaths

2. Start and enable the rh-mongodb34 service:

   # systemctl start rh-mongodb34-mongod
   # systemctl enable rh-mongodb34-mongod

3. Create a Pulp user on MongoDB for database pulp_database:

   # mongo pulp_database \
   --eval "db.createUser({user:'pulp',pwd:'pulp_password',roles:[{role:'dbOwner', db:'pulp_database'},{ role: 'readWrite', db: 'pulp_database'}]})"

4. In the /etc/opt/rh/rh-mongodb34/mongod.conf file, specify the bind IP:

   bindIp: your_mongodb_server_bind_IP,::1

5. Edit the /etc/opt/rh/rh-mongodb34/mongod.conf file to enable authentication in the security section:

   security:
     authorization: enabled

6. Restart the rh-mongodb34-mongod service:

   # systemctl restart rh-mongodb34-mongod

7. Open port 27017 for MongoDB:

   # firewall-cmd --add-port=27017/tcp
   # firewall-cmd --runtime-to-permanent

8. From Satellite Server, test that you can access the database. If the connection succeeds, the command returns 1.

   # scl enable rh-mongodb34 " mongo --host mongo.example.com \
   -u pulp -p pulp_password --port 27017 --eval 'ping:1' pulp_database"

Procedure

1. To install PostgreSQL, enter the following command:

   # yum install rh-postgresql12-postgresql-server \
   rh-postgresql12-syspaths \
   rh-postgresql12-postgresql-evr

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

3. Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf file:

   # vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

5. Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf file:

   # vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf

6. Add the following line to the file:

     host  all   all   Satellite_ip/24   md5

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl start postgresql
   # systemctl enable postgresql

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql
   # firewall-cmd --runtime-to-permanent

9. Switch to the postgres user and start the PostgreSQL client:

   $ su - postgres -c psql

10. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE USER "pulpcore" WITH PASSWORD 'Pulpcore_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;
    CREATE DATABASE pulpcore OWNER pulpcore;

11. Exit the postgres user:

    # \q

12. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
    # PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulpcore -d pulpcore -c "SELECT 1 as ping"

Procedure

1. To configure the external databases for Satellite, enter the following command:

   satellite-installer --scenario satellite \
     --foreman-db-host postgres.example.com \
     --foreman-db-password Foreman_Password \
     --foreman-db-database foreman \
     --katello-candlepin-db-host postgres.example.com \
     --katello-candlepin-db-name candlepin \
     --katello-candlepin-db-password Candlepin_Password \
     --katello-candlepin-manage-db false \
     --foreman-proxy-content-pulpcore-manage-postgresql false \
     --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \
     --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \
     --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password \
     --katello-pulp-db-username pulp \
     --katello-pulp-db-password pulp_password \
     --katello-pulp-db-seeds mongo.example.com:27017 \
     --katello-pulp-db-name pulp_database

2. Verify the status of the databases:

   • For PostgreSQL, enter the following command:

     # satellite-maintain service status --only postgresql

   • For MongoDB, enter the following command:

     # satellite-maintain service status --only rh-mongodb34-mongod