Chapter 11. Create Client Profiles for the Red Hat Update Infrastructure Servers

Create a GPG key that you can use to sign custom packages (including client configuration RPMs) for the Red Hat Update Infrastructure (RHUI) client profile.

Enter a high-quality password and record it in a secure location.

gpg: key EDD092F4 marked as ultimately trusted

public and secret key created and signed.

gpg: checking the trustdb

gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model

gpg: depth: 0   valid:   1   signed:   0   trust:  0-, 0q, 0n, 0m, 0f, 1u

pub    4096R/EDD092F4  2015-11-25

Key fingerprint = 1139 932A 26E2 981A 1341 D636 0DDB B5F6 EDD0 925F4

uid Red Hat $USERID (rhui-client-rhui) <user@redhat.com>

Note that this key cannot be used for encryption. You may want to use the command “--edit-key” to generate a subkey for this purpose.

Export the two keys by running the following commands.

# mkdir /root/rpm-gpg
# gpg --export --armor rhui-client-rhui >> /root/rpm-gpg/rhui-client-rhui
# gpg --export --armor rhui-client-all >> /root/rpm-gpg/rhui-client-all

GPG defaults to substring matching when searching for keys. It is only necessary to specify the unique portion of the user ID (the client profile RPM name in this case). The traditional RPM-GPG-KEY- prefix will be added to the GPG key file names when the Red Hat Update Infrastructure Management Tool creates client configuration packages.

Navigate to the Red Hat Update Infrastructure Management Tool home screen.

[root@rhua ~]# rhui-manager

From the Repository Management screen, press c to select create a new custom repository (RPM content only).

------------------------------------------------------------------------------
             -= Red Hat Update Infrastructure Management Tool =-

-= Repository Management =-

   l   list repositories currently managed by the RHUI
   i   display detailed information on a repository
   a   add a new Red Hat content repository
   ad  add a new Red Hat docker container
   c   create a new custom repository (RPM content only)
   d   delete a repository from the RHUI
   u   upload content to a custom repository (RPM content only)
   p   list packages in a repository (RPM content only)

                                                   Connected: rhua.example.com
------------------------------------------------------------------------------

Enter a unique ID for the repository. Only alphanumeric characters, _ (underscore), and - (hyphen) are permitted. You cannot use spaces in the unique ID. For example, repo1, repo_1, and repo-1 are all valid entries.

Unique ID for the custom repository (alphanumerics, _, and - only):

Select sha256 as the checksum type to be used for the repository metadata.

Choose whether to protect the new repository. If you answer no to this question, any client can access the repository. If you answer yes, only clients with an appropriate entitlement certificate can access the repository.

Use of unprotected repositories is a “break glass in case of emergency” course of action.

If you choose to protect the new repository, the Red Hat Update Infrastructure Management Tool will ask for the entitlement path. It will also suggest the entitlement path based on the repository’s relative path.

Client entitlement certificates contain the download URLs that they are allowed to access. The RHUI analyzes the contents of the certificate to determine if the repository requested matches any of the permitted URLs, which determines whether to allow the client to authenticate. For example, if an entitlement certificate grants access to /some/unique/name and the request is made to a repository located at //server/pulp/repos/some/unique/name/os/repodata, the RHUI will approve the request and grant the authentication because the path begins with one of the entitled download URLs. The URL only needs to begin with the correct information; it does not need to match exactly.

Entitlements can also contain variables, as long as yum knows the value for the variable. The two most common variables to use are $basearch and $releasever, which are populated with details of the client making the request. For example, if an entitlement certificate grants access to /unique-name/$basearch/bar and the request is made to a repository located at //server/pulp/repos/unique-name/x86_64/bar, the RHUI will approve the request and grant the authentication because the path matches when the variable is populated.

The Red Hat Update Infrastructure Management Tool suggests a path to use based on the variables you used when you gave it a path for the repository. Leave the field blank to accept the suggested path.

The Red Hat Update Infrastructure Management Tool will ask if you want GNU Privacy Guard (GPG) signature turned on for content in that repository. If you press y, you will be asked if the content will be signed by Red Hat. Answering yes will include Red Hat’s GPG key in the repository configuration. You are then asked if the content will be signed by a custom GPG key. Answering yes will prompt for a path to a public GPG key to include in the repository configuration. You can continue entering multiple paths to public GPG keys.

Should the repository require clients to perform a GPG check and verify packages are signed by a GPG key? (y/n) y

Will the repository be used to host any Red Hat GPG signed content? (y/n) y

Will the repository be used to host any custom GPG signed content? (y/n) y

Enter the absolute path to the public key of the GPG key pair:
/root/rpm-gpg/rhui-client-rhui.gpg

Would you like to enter another public key? (y/n) y

Enter the absolute path to the public key of the GPG key pair:
/root/rpm-gpg/rhui-client-all.gpg

Would you like to enter another public key? (y/n) n

Install the client configuration RPM on each client node that requires updating.

# yum install /path/to/client_custom.rpm

The client configuration RPM will configure a yum repository called rhui-$ORIGINALNAME. Use yum update to update each node.

# yum update

# yum --disablerepo=* --enablerepo=rhui-rhui-3 update