Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 6. Security settings

You can configure global settings for provisioning.

This chapter only mentions notable settings.

6.1. Configuring the security token validity duration
Link kopieren

When performing any kind of provisioning, as a security measure, Satellite automatically generates a unique token and adds this token to the kickstart URL in the PXE configuration file (PXELinux, Grub2). By default, the token is valid for 360 minutes. When you provision a host, ensure that you reboot the host within this time frame. If the token expires, it is no longer valid and you receive a 404 error and the operating system installer download fails.

Procedure

  1. In the Satellite web UI, navigate to Administer > Settings, and click the Provisioning tab.
  2. Find the Token duration option and click the edit icon and edit the duration, or enter 0 to disable token generation. If token generation is disabled, an attacker can spoof client IP address and download kickstart from Satellite Server, including the encrypted root password.

6.2. Setting a default encrypted root password for hosts
Link kopieren

If you do not want to set a plain text default root password for the hosts that you provision, you can use a default encrypted password.

The default root password can be inherited by a host group and consequentially by hosts in that group.

If you change the password and reprovision the hosts in the group that inherits the password, the password will be overwritten on the hosts.

Procedure

  1. Generate an encrypted password: 

    $ python3 -c 'import crypt,getpass;pw=getpass.getpass(); print(crypt.crypt(pw)) if (pw==getpass.getpass("Confirm: ")) else exit()'
    Copy to Clipboard Toggle word wrap
  2. Copy the password for later use.
  3. In the Satellite web UI, navigate to Administer > Settings.
  4. On the Settings page, select the Provisioning tab.
  5. In the Name column, navigate to Root password, and click Click to edit.
  6. Paste the encrypted password, and click Save.

6.3. Provisioning FIPS-compliant hosts
Link kopieren

Satellite supports provisioning hosts that comply with the National Institute of Standards and Technology’s Security Requirements for Cryptographic Modules standard, reference number FIPS 140-2, referred to here as FIPS.

To enable the provisioning of hosts that are FIPS-compliant, complete the following tasks:

  • Change the provisioning password hashing algorithm for the operating system
  • Create a host group and set a host group parameter to enable FIPS

For more information, see Working with host groups in Managing hosts.

The provisioned hosts have the FIPS-compliant settings applied. To confirm that these settings are enabled, complete the steps in Section 6.3.3, “Verifying FIPS mode is enabled”.

6.3.1. Changing the provisioning password hashing algorithm
Link kopieren

To provision FIPS-compliant hosts, you must first set the password hashing algorithm that you use in provisioning to SHA256. This configuration setting must be applied for each operating system you want to deploy as FIPS-compliant.

Procedure

  1. Identify the Operating System IDs: 

    $ hammer os list
    Copy to Clipboard Toggle word wrap

  2. Update each operating system’s password hash value. 

    $ hammer os update \
--password-hash SHA256
--title "My_Operating_System"
    Copy to Clipboard Toggle word wrap

    Note that you cannot use a comma-separated list of values.

6.3.2. Setting the FIPS-enabled parameter
Link kopieren

To provision a FIPS-compliant host, you must create a host group and set the host group parameter fips_enabled to true. If this is not set to true, or is absent, the FIPS-specific changes do not apply to the system. You can set this parameter when you provision a host or for a host group.

To set this parameter when provisioning a host, append --parameters fips_enabled=true to the Hammer command. 

$ hammer hostgroup set-parameter \
--hostgroup "My_Host_Group" \
--name fips_enabled \
--value "true"
Copy to Clipboard Toggle word wrap

For more information, see the output of the command hammer hostgroup set-parameter --help.

6.3.3. Verifying FIPS mode is enabled
Link kopieren

To verify these FIPS compliance changes have been successful, you must provision a host and check its configuration.

Procedure

  1. Log in to the host as root or with an admin-level account.

  2. Enter the following command: 

    $ cat /proc/sys/crypto/fips_enabled
    Copy to Clipboard Toggle word wrap

    A value of 1 confirms that FIPS mode is enabled.

Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat