Chapter 6. Prerequisites for installation

Procedure

1. On both machines, install RHEL 8 with all z-stream updates.

   1. Both BaseOS and AppStream repositories must be enabled (by default, those repositories are part of the full installation image that is available on the Red Hat Customer Portal and already enabled).
      For example, to verify that the BaseOS and Appstream repos are enabled for RHEL x86_64:

      # subscription-manager repos --enable rhel-8-for-x86_64-baseos-rpms

      # subscription-manager repos --enable rhel-8-for-x86_64-appstream-rpms

   2. Both machines should be registered and subscribed with a valid RHEL subscription.
      For example:

      # subscription-manager register --username=<customer access portal username>

      NOTE

      Check if Simple Content Access (SCA) mode is enabled on your account using:

      # subscription-manager status

      After registering with subscription-manager, if experiencing any issues installing packages from the enabled BaseOS and AppStream repositories, disable SCA in the subscription management page in the Access Portal. If you are not the administrator of your account, you will need to request the administrator to do so. Attach the pool ID containing your Red Hat Enterprise Linux subscription using the same method as outlined in the below step, and then try again to install the packages.

2. Attach the Red Hat subscriptions to the system. If your system already has a subscription attached that provides Certificate System, or if Simple Content Access (SCA) is set to the default setting enabled, skip to step 3.

   1. List the available subscriptions and note the pool ID providing Red Hat Certificate System. For example:

      # subscription-manager list --available --all
      
      ...
      Subscription Name:   Red Hat Enterprise Linux Developer Suite
      Provides:            ...
                           Red Hat Certificate System
                           ...
      Pool ID:             7aba89677a6a38fc0bba7dac673f7993
      Available:           1
      ...

      Depending on the number of subscriptions you have, the output can be very long. In this case, you can redirect it to a file:

      # subscription-manager list --available --all > /root/subscriptions.txt

   2. Attach the Certificate System subscription to the system using the pool ID from the previous step:

      # subscription-manager attach --pool=7aba89677a6a38fc0bba7dac673f7993
      
      Successfully attached a subscription for: Red Hat Enterprise Linux Developer Suite

3. "Pin" the RHEL version to 8.6 by using the subscription-manager release --set command. For example:

   # subscription-manager release --list

   # subscription-manager release --set 8.6

   Verification:

   # subscription-manager release --show

4. In addition, on rhcs10.example.com, install the environment group Server with GUI:

   # dnf groupinstall "Server with GUI"

1. Enable the Certificate System repository on rhcs10.example.com:

   # subscription-manager repos --enable certsys-10.x-for-rhel-8-x86_64-rpms

   Where x denotes the latest Certificate System version. For example, to enable the Certificate System repository for Red Hat Certificate System 10.4, please use the below command:

   # subscription-manager repos --enable certsys-10.4-for-rhel-8-x86_64-rpms
   
   Repository 'certsys-10.4-for-rhel-8-x86_64-rpms' is enabled for this system.

2. Enable the Directory Server repository on rhds11.example.com:

   # subscription-manager repos --enable=dirsrv-11-for-rhel-8-x86_64-rpms
   
   Repository 'dirsrv-11-for-rhel-8-x86_64-rpms' is enabled for this system.

1. Make sure the Fully Qualified Domain Name (FQDN) of each host matches how you wish them to be recognized. For example, run the following on both machines:

   # hostname

2. If a hostname is not what you expect it to be, you can configure the FQDN using hostnamectl. For example, to update the CS machine’s hostname:

   # hostnamectl set-hostname rhcs10.example.com

3. To update the DS machine’s hostname:

   # hostnamectl set-hostname rhds11.example.com

4. Additionally, add both the CS and DS machines' IP addresses and new hostnames as entries in /etc/hosts:

   # vi /etc/hosts

   127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
   ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
   10.1.111.111 rhcs10.example.com
   10.2.222.222 rhds11.example.com

5. Verify the FQDN again after the change:

   # hostname

1. To switch to FIPS mode, use the fips-mode-setup --enable command.

   # fips-mode-setup --enable
   
   Kernel initramdisks are being regenerated. This might take some time.
   Setting system policy to FIPS
   Note: System-wide crypto policies are applied on application start-up.
   It is recommended to restart the system for the change of policies to fully take place.
   FIPS mode will be enabled.
   Please reboot the system for the setting to take effect.

2. Restart your system to allow the kernel to switch to FIPS mode:

   # reboot

3. Verify the current state of FIPS mode after the restart:

   # fips-mode-setup --check
   
   FIPS mode is enabled.

1. As root, create a file under /etc/fapolicyd/rules.d/ with a unique name. The prefix must contain a number in the 30s range for the priority, such as 35-allow-java.rules, or 39.

   # vi /etc/fapolicyd/35-allow-java.rules

2. Add the following rule:

   allow perm=open dir=/usr/lib/jvm/ : dir=/usr/share/tomcat/bin/ ftype=application/java-archive

3. After saving the file, restart the fapolicyd service to recompile the rules:

   # systemctl restart fapolicyd.service

1. Make sure the firewalld service is running.

   # systemctl status firewalld

2. To start firewalld and configure it to start automatically when the system boots:

   # systemctl start firewalld
   # systemctl enable firewalld

Adding ports to the firewall

1. Open the required ports using the firewall-cmd utility. For example, to open the default ports for the RootCA instance in the default firewall zone:

   # firewall-cmd --permanent --add-port={8080/tcp,8443/tcp,8009/tcp,8005/tcp}

   Additionally, to open the default ports for the RootCA’s LDAP instance:

   # firewall-cmd --permanent --add-port={389/tcp,636/tcp}

2. Verify that all ports that will be used are successfully added to the firewall:

   # firewall-cmd --list-ports

3. Reload the firewall configuration to ensure that the change takes place immediately:

   # firewall-cmd --reload

1. For CS instances, add SELinux context to all ports that will be used as type http_port_t. You can do this quickly using a FOR loop command with all ports you need to add. For example, to add the default RootCA ports:

   # for port in 8080 8443 8009 8005 31080 31443 31009 31005 33080 33443 33009 33005 32080 32443 32009 32005 28080 28443 28009 28005 24080 24443 14009 14005 25080 25443 14019 14015; do semanage port -a -t http_port_t -p tcp $port; done

2. For DS ports, replace the port type option http_port_t with ldap_port_t. For example, for the RootCA’s LDAP ports:

   # for port in 389 636 7389 7636 6389 6636 12389 12636 11389 11636 5389 5636 22389 22636 16389 16636 17389 17636; do semanage port -a -t ldap_port_t -p tcp $i; done

3. Verify that all ports that will be used are successfully added with SELinux context:

   # semanage port -l