Chapter 1. Client tools and components


RHEL client tools such as insights-client, subscription-manager, and rhc client handle system registration, entitlement management, and proactive remediation. These tools integrate with each other to help you connect your RHEL system to Red Hat services.

1.1. Client tools and components overview

Red Hat Enterprise Linux (RHEL) includes several client tools that work together to register your systems and connect them to Red Hat services.

rhc client
The primary registration tool for connecting RHEL systems to the Red Hat Hybrid Cloud Console. It coordinates with the other two clients to handle registration, configuration, and remote management in a single workflow.
subscription-manager
Handles system identity and subscription entitlements, and provides access to Red Hat package repositories through the Content Delivery Network (CDN).
insights-client
Gathers system data and sends it to Red Hat Lightspeed for analysis. It depends on subscription-manager for system identity.

1.2. The rhc client

The rhc client is the recommended tool to register and manage your RHEL systems that are connected to the Red Hat Hybrid Cloud Console.

Note

To register and connect systems with Red Hat Satellite or Capsule, see the Red Hat Satellite product documentation.

The rhc client works with insights-client and subscription-manager to offer a unified client experience. This experience includes system registration to Red Hat, feature level configuration, and remote management.

The remote host configuration service has two main components:

  • The rhc client remote host configuration client (a client-side daemon)
  • The remote host configuration manager (a server-side service)

1.2.1. RHC client capabilities

The remote host configuration (rhc) client provides easy registration and remote remediation capabilities for RHEL systems connected to Red Hat Lightspeed.

Easy registration
With the rhc client, you can register systems to Red Hat Subscription Management (RHSM) and Red Hat Lightspeed.
Remediations and Tasks from Red Hat Lightspeed
When you connect systems to Red Hat Lightspeed with the rhc client, registered systems can run tasks and remediation playbooks that Red Hat Lightspeed generates automatically from remediation plans by using the Automation Toolkit.

1.2.2. RHC client components and support

The rhc client is preinstalled and fully supported with all Red Hat Enterprise Linux (RHEL) 8.6 and later installations, with the exception of minimal installations.

The rhc client consists of the following utility programs:

  • The yggdrasil (rhcd on version RHEL 9 and earlier) daemon runs on the system and listens for messages from the Hybrid Cloud Console. On properly configured systems, the yggdrasil daemon can receive and run playbooks that are generated by Red Hat Lightspeed remediation plans.
  • The rhc command-line utility for RHEL.

1.3. The subscription-manager client

The subscription-manager client establishes your system’s identity and provides access to the Red Hat Content Delivery Network (CDN) for updates and packages. This registration method provides limited Red Hat Subscription Management features.

For additional features provided by Red Hat Lightspeed, consider using the rhc client.

1.4. The insights-client

The insights-client collects system data and sends it to Red Hat Lightspeed for analysis. The insights-client relies on the subscription-manager client to establish the identity of the system.

The insights-client is available for these RHEL releases.

Table 1.1. RHEL releases with insights-client availability
RHEL releaseComments

RHEL 10

Distributed with insights-client pre-installed.

RHEL 9

Distributed with insights-client pre-installed.

RHEL 8

Distributed with insights-client pre-installed, unless RHEL 8 was installed as a minimal installation.

RHEL 7

Distributed with the insights-client RPM package loaded but not installed.

Manage user permissions to control access to Red Hat Lightspeed applications. Use the User Access feature to apply role-based access control (RBAC). Red Hat provides predefined groups and roles to help Organization Administrators manage user permissions.

1.5.1. User Access overview

You can simplify access management in the Red Hat Hybrid Cloud Console by using role-based access control (RBAC). The User Access feature assigns specific permissions to roles instead of individual users, which are then inherited when roles are assigned to user groups.

You can also create custom groups and roles to provide more fine-tuned control over specific features of Red Hat Lightspeed to suit the needs of your organization.

If you are an Organization Administrator, you can use the User Access feature under Identity & Access Management User Access in the Hybrid Cloud Console to:

  • Control user permissions and organize roles.
  • Create groups that include roles and their corresponding permissions.
  • Assign users to these groups, allowing them to inherit the permissions associated with their group’s roles.

1.5.2. Predefined groups in User Access

The two predefined groups available in User Access, Default access and Default admin access provide different baseline privilege levels for users in your organization. You can also create custom groups to align permissions with specific personas, job functions, or teams in your organization.

The Default access group
By default, the Default access group is assigned many granular predefined roles, so that group members have basic visibility. Because all users in your organization are members of the Default access group, they inherit all permissions assigned to that group. The Default access group is automatically updated by Red Hat.
Important

If your Organization Administrator modifies the Default access group, for example, by removing roles to restrict access to specific applications or to use the consolidated roles, the group is automatically renamed to Custom default access. Once converted, this group is no longer automatically updated by Red Hat.

The Default admin access group
The Default admin access group contains only users who have Organization Administrator permissions. This group is automatically maintained, and users and roles in this group cannot be changed.

The Default admin access group includes many (but not all) predefined roles that provide update and delete permissions. The roles in this group usually include administrator in their names.

Tip

To view the roles included in the Default access or Default admin access group, log in to the Hybrid Cloud Console, navigate to Groups in User Access, and select the group.

1.5.3. Predefined roles assigned to groups

Understand how predefined roles in Red Hat Hybrid Cloud Console bundle permissions across multiple Red Hat Lightspeed applications to align with common user personas. Use predefined roles to reduce administrative effort, or create custom roles for more fine-tuned control over specific features.

The predefined roles are a starting point to help you control and manage user permissions. You can then use these roles to create custom roles that are tailored to your specific use cases and organization. For example, you can use the predefined granular roles to create custom roles that provide more fine-tuned control over specific features of Red Hat Lightspeed.

By default, Red Hat provides a set of consolidated roles and a set of granular roles in the Red Hat Hybrid Cloud Console User Access UI. The consolidated roles significantly reduce the administrative effort required to manage user permissions, while the granular roles provide more fine-tuned control over specific features of Red Hat Lightspeed.

You can use the predefined consolidated and granular roles in User Access simultaneously, but using consolidated roles can significantly reduce the administrative effort.

Select from the predefined consolidated roles library

The Red Hat Hybrid Cloud Console provides three predefined, consolidated User Access roles to help you manage user permissions to Red Hat Lightspeed applications and services that run on registered Red Hat Enterprise Linux systems. These roles help simplify how the Organization Administrator creates groups and permissions for various levels of access to the Red Hat Lightspeed services. If you want to reduce the administrative effort required to manage user permissions and your use case aligns with the permissions included in these roles, select from the consolidated roles library.

The consolidated roles are as follows:

RHEL viewer: The RHEL viewer role provides users visibility without the ability to make changes. It allows read-only access to Red Hat Lightspeed. You can view system configurations, compliance reports, inventory data, patch information, vulnerabilities, and overall resource states and activities. The only action permitted with this role is to generate activation keys.

RHEL operator: The RHEL operator role allows active management of your Red Hat Lightspeed environment. With this role, you can edit system configurations, inventory details, policies, and notification/integration settings. The RHEL operator role allows many of the RHEL administrator role functions, but it is restricted from editing compliance policies, content source templates, policies, or tasks. In addition, the RHEL operator role cannot execute remediation plans.

RHEL administrator: The RHEL administrator role provides comprehensive administrative privileges across your RHEL systems and Red Hat Lightspeed. With this role, you can manage system configurations, inventory, compliance policies, notifications, patch management, remediations, malware detection, and advisor recommendations. The role can also view and modify all vulnerability settings.

Important

To use the consolidated roles effectively, you might need to remove the granular RHEL roles from the Default access group to prevent permission conflicts. This action automatically changes the name of the predefined Default access group to Custom default access group, after which, it is no longer automatically updated by Red Hat.

See Predefined User Access roles for a list of the roles included in the Default admin access group and a reference table that lists most of the predefined groups and roles that are available in the Red Hat Hybrid Cloud Console and the permissions included in each role.

Granular roles
The granular roles are specific roles for individual services that allow for fine-tuned control over specific features of Red Hat Lightspeed, for example, Inventory Hosts administrator or Compliance viewer. If you want to have more control over specific features of Red Hat Lightspeed and your use case does not align with the permissions included in the consolidated roles, use the granular predefined roles.
Tip

Across the Red Hat Lightspeed product documentation, the Prerequisites section for each procedure lists which predefined roles provide the permissions needed to use the features in that procedure. For example, if a procedure requires permissions to create and view remediations, the Prerequisites section for that procedure lists the Remediations user or other valid role as a recommended predefined role to use for that procedure.

1.5.4. Check your permissions

Verify your current permissions and the roles or groups assigned to you in the Red Hat Hybrid Cloud Console. Check your permissions to troubleshoot access issues or understand your level of access to Red Hat Lightspeed applications.

Note

Only users with the Organization Administrator role can view the permissions of other users in the User Access settings and manage user permissions to Red Hat Lightspeed services. For more information, see the Configure user permissions section.

Prerequisites

  • You are logged in to the Red Hat Hybrid Cloud Console.

Procedure

  1. Click the Settings icon (⚙), then navigate to Settings Identity & Access Management My User Access.
  2. Optional: If you require additional permissions, use the Red Hat Hybrid Cloud Console Virtual Assistant to ask "Contact my Organization Administrator". The assistant sends an email to the Organization Administrator on your behalf.

Verification

All of the applications that you have permissions to access are listed on this page and are grouped by product, for example, RHEL, OpenShift Container Platform, and Ansible Automation Platform.

You can also filter your permissions by application, for example, by advisor, cost management, inventory, and remediations.

1.5.5. Configure user permissions

If you are an Organization Administrator, you can view and manage user permissions for all users in your organization. Control access to Red Hat Lightspeed and other Red Hat Hybrid Cloud Console services through the User Access interface.

Important

If you are not an Organization Administrator, you are unable to complete this task. However, you can check your own permissions for different applications by navigating to Settings Identity & Access Management My User Access. Contact your Organization Administrator to request more permissions.

Prerequisites

  • You have logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator, or you have the required administrator User Access role permissions.

Procedure

  1. Click the Settings icon (⚙), then navigate to Settings Identity & Access Management User Access.

Verification

From here, you can create and manage:

Understand the predefined roles that control permissions to manage and remediate your RHEL systems remotely using the remote host configuration manager with Red Hat Lightspeed. Use these role definitions to assign appropriate permissions to users based on their responsibilities.

The following User Access roles enable standard or enhanced access to the remote host configuration manager in the Red Hat Hybrid Cloud Console:

Table 1.2. Permissions provided by the User Access roles
User Access roleGrants permissions to …​Included in the Default access group

RHC administrator

  • Do any operations in the remote host configuration manager.
 

RHC user

  • View the current status of remote host configuration.

X

RHEL administrator

  • Do everything that a RHEL operator can do.
  • Administer RHEL system configs, inventory, compliance, notifications, patch management, execute remediation plans, malware detection, and advisor.
  • View and modify vulnerability settings.
 

RHEL operator

  • Do everything that a RHEL viewer can do.
  • Edit system configs, inventory, policies, notifications, and integrations.
  • View compliance reports, patch info, malware detections, and recommendations.
  • Create remediation plans, manage stale data, and change vulnerability settings.
Note

The RHEL operator role is restricted from editing compliance policies, content source templates, policies, or tasks. Also, the RHEL operator role cannot execute remediation plans.

 

RHEL viewer

  • Read all available data across Red Hat Lightspeed services and features.

    • View system configs, compliance reports, inventory data, patch info, vulnerabilities, and more to observe the state of resources or activities.
Note

Cannot perform actions other than generating activation keys.

 

See also the following information about the required User Access roles for remotely executing remediation plans in the Red Hat Hybrid Cloud Console:

1.6. Install the insights-client

The insights-client is automatically installed with default RHEL installations. Manual installation is required for deployments such as minimal and cloud-based installations.

Installation steps vary slightly depending on your RHEL version and installation type. After you install the insights-client, register your system. Some registration methods require activation keys.

You can install insights-client on an existing Red Hat Enterprise Linux (RHEL) system that is connected to Red Hat Cloud Access. Installing insights-client gives you automated system health checks and other services to find and fix issues before they cause problems with systems in your organization.

Install the insights-client on an existing Red Hat Enterprise Linux system purchased from a cloud marketplace and managed by Red Hat Update Infrastructure (RHUI). The insights-client provides automated health checks and services to find and fix issues before they affect your systems.

Prerequisites

  • Root-level access for the system.

Procedure

  • Enter the following command to install the current version of the insights-client package:

    RHEL versions 6 and 7

    [root@server ~]# yum install insights-client

    RHEL version 8 and later

    [root@server ~]# dnf install insights-client

Verification

Run the following command to confirm successful installation of the insights-client:

+

[root@server ~]# insights-client --version

The insights-client runs automatically based on its scheduler settings. By default, it runs every 24 hours. To run the client interactively, enter the insights-client command.

When you run insights-client, the following values and settings determine the results:

  1. Values that you enter when you run insights-client from the command line temporarily override the preset configuration file settings and system environment settings. Any values that you enter for options in the insights-client command are used only for that instance of insights-client.
  2. Settings in the configuration file (/etc/insights-client/insights-client.conf) override system environment settings.
  3. Values of any system environment variables (printenv) are not affected by the commands entered on the command line or the client configuration files.
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

Legal Notice

Theme

© 2026 Red Hat
Back to top