Installation Guide

Procedure 2.3. Configuring the Satellite Server to Allow Red Hat Subscription Manager Access to the CDN

1. On the network gateway and the HTTP Proxy, open the following hostnames, ports and protocols:

   Table 2.1. Required Hostnames, Ports and Protocols

   Hostname	Port	Protocol
   subscription.rhn.redhat.com	443	https
   cdn.redhat.com	443	https
   *.akamaiedge.net	443	https

2. On the Satellite Server, fill in the following details in the/etc/rhsm/rhsm.conf file:

   # an http proxy server to use (enter server FQDN)
   proxy_hostname = http_proxy.example.com
   
   # port for http proxy server
   proxy_port = 3128
   
   # user name for authenticating to an http proxy, if needed
   proxy_user =
   
   # password for basic http proxy auth, if needed
   proxy_password =
   

Procedure 2.4. Setting a Custom Server Certificate while running katello-installer for the first time

• Run this command on the Red Hat Satellite Server:

  katello-installer --certs-server-cert ~/path/to/server.crt\
                    --certs-server-cert-req ~/path/to/server.crt.req\
                    --certs-server-key ~/path/to/server.crt.key\
                    --certs-server-ca-cert ~/path/to/cacert.crt
  

  Where:

  • certs-server-cert is the path to your certificate, signed by your certificate authority (or self signed)
  • certs-server-cert-req is the path to your certificate signing request file that was used to create the certificate.
  • certs-server-key the private key used to sign the certificate
  • certs-server-ca-cert ~/path/to/cacert.crt the path to the CA certificate on this system.

Procedure 2.5. Setting a Custom Server Certificate after running katello-installer

1. The initial run of katello-installer uses the default CA for both server and client certificates. To enforce custom certificates deployment, set the --certs-update-server parameter and the --certs-update-server-ca parameter to update the CA certificate:

   katello-installer --certs-server-cert ~/path/to/server.crt\ --certs-server-cert-req ~/path/to/server.crt.req\ --certs-server-key ~/path/to/server.crt.key\ --certs-server-ca-cert ~/path/to/cacert.crt\ --certs-update-server --certs-update-server-ca
   

   This will regenerate the katello-ca-consumer package and the server CA certificate.
2. After the server CA changes, install the new version of the consumer-ca-consumer package on the client systems:

   rpm -Uvh http://katello.example.com/pub/katello-ca-consumer-latest.noarch.rpm
   

Procedure 3.1. Creating an Organization

1. Click the Administer → Organizations menu on the top right hand corner.
2. Click the New Organization button.
3. Type in the name of the new organization in the Name field.
4. Type in the label of the new organization in the Label field.
5. Type in a description of the new organization in the Description field.
6. Click the Submit button.
7. Select the hosts to assign to the new organization.
   • Click the Assign All button to assign all hosts with no organization to the new organization.
   • Click the Manually Assign button to manually select and assign the hosts with no organization.
   • Click the Proceed to Edit button to skip assigning hosts.

Procedure 3.2. Editing an Organization

1. Click the Administer → Organizations menu on the top right hand corner.
2. Click the name of the organization to be edited.
3. Select the resource to edit from the list on the left.
4. Click the name of the desired items to add them to the Selected Items list.
5. Click the Submit button.

Procedure 3.3. Removing an Organization

1. Click the Administer → Organizations menu on the top right hand corner.
2. Select Delete from the drop down menu to the right of the name of the organization you want to remove.
3. An alert box appears:

   Delete Organization Name?

4. Click the OK button.

Procedure 4.11. To Configure a Host to Synchronize and Export Content from the Red Hat CDN:

1. Use Red Hat Subscription Manager to register the synchronization host to RHN.
2. List all the available subscriptions to find the correct Red Hat Satellite product to allocate to your system:

   # subscription-manager list --available --all

   This command displays output similar to the following:

   +-------------------------------------------+
       Available Subscriptions
   +-------------------------------------------+
   
   
   ProductName:        Red Hat Satellite
   ProductId:          SKU123456
   PoolId:             e1730d1f4eaa448397bfd30c8c7f3d334bd8b
   Quantity:           10
   Multi-Entitlement:  No
   Expires:            08/20/2013
   MachineType:        physical
   

   Note

   The SKU and Pool ID depend on the Red Hat Satellite product type that corresponds to your system version and product type.
3. Subscribe to the pool using the following command:

   # subscription-manager subscribe --pool=Red_Hat_Satellite_Pool_Id
   # subscription-manager subscribe --pool=Red_Hat_Enterprise_Linux_Pool_Id
   # subscription-manager subscribe --pool=Red_Hat_Enterprise_Linux_Software_Collections_Pool_Id
   

4. Disable all existing repositories:

   # subscription-manager repos --disable "*"
   

5. Enable the Red Hat Satellite and Red Hat Enterprise Linux and Red Hat Software Collections repositories. Ensure the Red Hat Enterprise Linux repository matches the specific version you are using.

   # subscription-manager repos --enable rhel-6-server-rpms \
   --enable rhel-server-rhscl-6-rpms \
   --enable rhel-6-server-satellite-6.0-rpms
   

   Note

   The commands above are based on Red Hat Enterprise Linux 6. If you are using a different version of Red Hat Enterprise Linux, change the repository based on your specific version.
6. Install katello-utils and associated RPM files:

   # yum install python-qpid-qmf python-qpid  qpid-cpp-server-store katello-utils
   

   katello-utils includes the katello-disconnected utility that is required to set up repositories for import while qpid related packages are necessary for pulp configuration.
7. Generate a 32-character alphanumeric string for the oauth_secret entry in the /etc/pulp/server.conf file:

   $ tr -dc "[:alnum:]" < /dev/urandom | head -c 32

8. In the /etc/pulp/server.conf, uncomment the [oauth] entry and add the randomly-generated value from the previous step as the oauth_secret value:

   [oauth]
   enabled: true
   oauth_key: katello
   oauth_secret: v8SeYqvS5QUfmg0dIrJOBG58lAHDRZnN

9. Disable authentication in /etc/qpid/qpidd.conf:

   # Configuration file for qpidd. Entries are of the form:
   #   name=value
   #
   # (Note: no spaces on either side of '=').
   # Run "qpidd --help" or see "man qpidd" for more details.
   
   auth=no
   

   All incoming connections authenticate using the Satellite's default realm.
10. Configure the connection from katello-disconnected to Pulp with the previously generated value as your --oauth-secret option:

    # katello-disconnected setup --oauth-key=katello --oauth-secret=v8SeYqvS5QUfmg0dIrJOBG58lAHDRZnN

    This places a configuration value in ~/.katello-disconnected.
11. Configure Pulp on the synchronization server:

    sudo service qpidd start
    sudo chkconfig qpidd on
    sudo service mongod start
    sleep 10
    sudo chkconfig mongod on
    sudo -u apache pulp-manage-db
    sudo service httpd restart
    sudo chkconfig pulp_workers on
    sudo service pulp_workers start
    sudo chkconfig pulp_celerybeat on
    sudo service pulp_celerybeat start
    sudo chkconfig pulp_resource_manager on
    sudo service pulp_resource_manager start
    

12. Import the manifest to set up the list of available repositories to synchronize based on the selected subscriptions:

    # katello-disconnected import -m ./manifest.zip
    

1. Disable all repositories:

   # katello-disconnected disable --all
   

   katello-disconnected enables all repositories by default.
2. Choose which repositories you wish to sync by listing all available repositories from the manifest:

   # katello-disconnected list --disabled
   rhel-5-server-debug-rpms-5Server-i386
   rhel-5-server-debug-rpms-5Server-ia64
   rhel-5-server-debug-rpms-5Server-x86_64
   rhel-5-server-debug-rpms-5_7-i386
   rhel-5-server-debug-rpms-5_7-ia64
   rhel-5-server-debug-rpms-5_7-x86_64
   rhel-5-server-debug-rpms-5_8-i386
   rhel-5-server-debug-rpms-5_8-ia64
   rhel-5-server-debug-rpms-5_8-x86_64
   rhel-5-server-debug-rpms-5_9-i386
   rhel-5-server-debug-rpms-5_9-ia64
   rhel-5-server-debug-rpms-5_9-x86_64
   rhel-5-server-isos-5Server-i386
   

3. Enable the chosen repositories for synchronization:

   # katello-disconnected enable -r rhel-6-server-sam-rpms-6_4-x86_64
   

4. Create the repositories and push them to Pulp to allow synchronization:

   # katello-disconnected configure
   

   Note

   The configure option for katello-disconnected reads the manifest, creates pulp repositories, and generates scripts before synchronization. It needs to be run each time a repository is enabled or disabled.
5. Synchronize the repositories:

   # katello-disconnected sync
   

   You can use the watch option to monitor the synchronization process.

   # katello-disconnected watch
   Watching sync... (this may be safely interrupted with Ctrl+C)
   running:
   rhel-6-server-sam-rpms-6_4-x86_64 
   
   running:
   rhel-6-server-sam-rpms-6_4-x86_64 
   ...
   finished:
   rhel-6-server-sam-rpms-6_4-x86_64 
   
   
   Watching finished
   

1. Export the synchronized repositories:

   # katello-disconnected export -t /var/tmp/export
   

   The output will look similar to:

   
   # katello-disconnected export -t /var/tmp/export
   # katello-disconnected watch
   Watching sync... (this may be safely interrupted with Ctrl+C)
   running:
   rhel-6-server-sam-rpms-6_4-x86_64
   
   finished:
   rhel-6-server-sam-rpms-6_4-x86_64
   Watching finished
   Done watching ...
    Copying content to /var/tmp/export
    Archiving contents of /var/tmp/export into 4600M tar archives.
    NOTE: This may take a while.
   tar: Removing leading `/' from member names
   
   Done exporting content, please copy /var/tmp/export/* to your disconnected host
   

   This operation will create the following files in /var/tmp/export:

   # ls /var/tmp/export/
   content-export-00 content-export-01 content-export-02 expand_export.sh
   

2. Copy the files from /var/tmp/export into the external media.

   Note

   If the files are too big for your external media, the files can be copied sequentially in a series of DVDs.

1. Copy the exported contents of the external media to a directory on the disconnected Satellite.

   Note

   If the exported content was placed in different external media devices, ensure that you copy all the contents in one directory on the disconnected Satellite.
2. Run the expand_export.sh script copied along with your exported content:

   # ./expand_export.sh 
   *** Done expanding archives. ***
   

   Warning

   The disconnected Satellite needs to have equal to the same space as the exported archive before you expand the exported content. The script will fail otherwise.
   The script will expand the archive into a directory.
3. Move the expanded directory tree's content to /var/www/html on the Satellite Server and restore the SELinux contexts on the moved files:

   # mv var/tmp/export/* /var/www/html/
   # cd /var/www/html
   # restorecon -r *
   

   Note

   The Satellite is now acting as its own CDN with the files located in http://localhost/content. This is not a requirement. The CDN can be hosted on a different machine inside the same disconnected network as long as it is accessible to the Satellite server via HTTP.
4. Add the CDN address to the Satellite web interface:
   1. Log in to the Satellite web interface.
   2. Click Content → Red Hat Subscriptions and then click Manage Manifest.
   3. On the Subscription Manifest information screen, scroll to Red Hat Provider Details. Click the edit icon on the Repository URL entry and change the entry to the CDN's repository URL.
   4. Click Browse to choose the manifest file.
   5. Click Upload to import your manifest.
5. Enable the repositories from the local CDN:
   1. Click Content → Red Hat Repositories
   2. Enable the repositories that were enabled and synchronized in the Synchronizing Content section.
6. Click Content → Sync Status.
7. Select the repositories you want to synchronize and click Synchronize Now.

Procedure 5.2. Setting a Custom Server Certificate while running capsule-certs-generate for the first time

1. Run this command on the Red Hat Satellite Server:

   capsule-certs-generate --capsule-fqdn "$CAPSULE"\
                          --certs-tar "~/$CAPSULE-certs.tar"\
                          --server-cert ~/path/to/server.crt\
                          --server-cert-req ~/path/to/server.crt.req\
                          --server-key ~/path/to/server.key\
                          --server-ca-cert ~/cacert.crt
   

   Where:

   • capsule_FQDN is the Satellite Capsule Server's fully qualified domain name. (REQUIRED)
   • certs-tar is the name of the tar file to be generated that contains the certificate to be used by the Satellite Capsule installer.
   • server-cert is the path to your certificate, signed by your certificate authority (or self signed)
   • server-cert-req is the path to your certificate signing request file that was used to create the certificate.
   • server-key is the private key used to sign the certificate
   • server-ca-cert ~/path/to/cacert.crt the path to the CA certificate on this system.
2. Copy the generated tarball, capsule.example.com-certs.tar, from the Satellite Server to the Satellite Capsule host system.
3. On the Satellite Capsule Server:
   1. Register your Satellite Capsule Server to the Satellite Server:

      # rpm -Uvh http://sat6host.example.redhat.com/pub/katello-ca-consumer-latest.noarch.rpm
      # subscription-manager register --org "ACME_Corporation" --env [environment]/[content_view_name]
      

      Note

      The Satellite Capsule Server must be assigned to an organization as the Satellite Capsule Server requires an environment to synchronize content from the Satellite Server. Only organizations have environments.

      Assigning a location is optional though recommended to indicate proximity to the hosts that the Satellite Capsule Server is managing.
   2. Depending on the desired Satellite Capsule Server type, choose one of the following options:
      1. Option 1: Satellite Capsule Server with Smart Proxy: This installs a Satellite Capsule Server with Smart Proxy features (DHCP, DNS, Puppet). Run the following commands as the root user on the Satellite Capsule Server:

           
         # capsule-installer --parent-fqdn          "satellite.example.com"\
                             --register-in-foreman  "true"\
                             --foreman-oauth-key    "xmmQCGYdkoCRcbviGfuPdX7ZiCsdExf"\
                             --foreman-oauth-secret "w5ZDpyPJ24eSBNo53AFybcnqoDYXgLUA"\
                             --pulp-oauth-secret    "doajBEXqNcANy93ZbciFyysWaiwt6BWU"\
                             --certs-tar            "/root/capsule.example.com-certs.tar"\
                             --puppet               "true"\
                             --puppetca             "true"\
                             --pulp                 "true"\
                             --tftp                 "true"\
                             --dhcp                 "true"\
                             --dhcp-interface       "virbr1"\
                            --dns                  "true"\
                            --dns-forwarders       "8.8.8.8"\
                            --dns-forwarders       "8.8.4.4"\
                            --dns-interface        "virbr1"\
                            --dns-zone             "example.com"
         
         

      2. Option 2 - Satellite Capsule Server as a Content Node: This installs a Satellite Capsule Server with content management features and a Puppet Master. Run the following commands as the root user on the Satellite Capsule Server:

         # capsule-installer --parent-fqdn          "sat6.example.com"\
                             --register-in-foreman  "true"\
                             --pulp-oauth-secret    "doajBEXqNcANy93ZbciFyysWaiwt6BWU"\
                             --certs-tar           "~/capsule.example.com-certs.tar"\
                             --puppet               "false"\
                             --puppetca             "false"\
                             --pulp                 "true"
         

      3. Option 3 - Satellite Capsule Server as a Content Node with Smart Proxy: This installs a Satellite Capsule Server with all the features. Run the following commands as the root user on the Satellite Capsule Server:

         # capsule-installer --parent-fqdn          "sat6.example.com"\
                             --register-in-foreman  "true"\
                             --foreman-oauth-key    "xmmQCGYdkoCRcbviGfuPdX7ZiCsdExf"\
                             --foreman-oauth-secret "w5ZDpyPJ24eSBNo53AFybcnqoDYXgLUA"\
                             --pulp-oauth-secret    "doajBEXqNcANy93ZbciFyysWaiwt6BWU"\
                             --certs-tar            "/root/capsule.example.com-certs.tar"\
                             --puppet               "true"\
                             --puppetca             "true"\
                             --pulp                 "true"\
                             --tftp                 "true"\
                             --dhcp                 "true"\
                             --dhcp-interface       "virbr1"\
                            --dns                  "true"\
                            --dns-forwarders       "8.8.8.8"\
                            --dns-forwarders       "8.8.4.4"\
                            --dns-interface        "virbr1"\
                            --dns-zone             "example.com"
         
         

Procedure 5.3. Setting a Custom Server Certificate after running capsule-certs-generate

1. Generate a new certificate based on your custom server certificate:

   capsule-certs-generate --capsule-fqdn "satcapsule.example.com"\
                          --certs-tar "~/$CAPSULE-certs.tar"\
                          --server-cert ~/path/to/server.crt\
                          --server-cert-req ~/path/to/server.crt.req\
                          --server-key ~/path/to/server.key\
                          --server-ca-cert ~/cacert.crt\
                          --certs-update-server --certs-update-server-ca
   

2. Copy the generated tarball, capsule.example.com-certs.tar, from the Satellite Server to the Satellite Capsule host system.
3. On the Satellite Capsule Server, re-run the capsule-installer command to refresh the certificates. Depending on the desired Satellite Capsule Server type, choose one of the following options:
   1. Option 1: Satellite Capsule Server with Smart Proxy: This installs a Satellite Capsule Server with Smart Proxy features (DHCP, DNS, Puppet). Run the following commands as the root user on the Satellite Capsule Server:

        
      # capsule-installer --parent-fqdn          "satellite.example.com"\
                          --register-in-foreman  "true"\
                          --foreman-oauth-key    "xmmQCGYdkoCRcbviGfuPdX7ZiCsdExf"\
                          --foreman-oauth-secret "w5ZDpyPJ24eSBNo53AFybcnqoDYXgLUA"\
                          --pulp-oauth-secret    "doajBEXqNcANy93ZbciFyysWaiwt6BWU"\
                          --certs-tar            "/root/capsule.example.com-certs.tar"\
                          --puppet               "true"\
                          --puppetca             "true"\
                          --pulp                 "true"\
                          --tftp                 "true"\
                          --dhcp                 "true"\
                          --dhcp-interface       "virbr1"\
                         --dns                  "true"\
                         --dns-forwarders       "8.8.8.8"\
                         --dns-forwarders       "8.8.4.4"\
                         --dns-interface        "virbr1"\
                         --dns-zone             "example.com"
      
      

   2. Option 2 - Satellite Capsule Server as a Content Node: This installs a Satellite Capsule Server with content management features and a Puppet Master. Run the following commands as the root user on the Satellite Capsule Server:

      # capsule-installer --parent-fqdn          "sat6.example.com"\
                          --register-in-foreman  "true"\
                          --pulp-oauth-secret    "doajBEXqNcANy93ZbciFyysWaiwt6BWU"\
                          --certs-tar           "~/capsule.example.com-certs.tar"\
                          --puppet               "false"\
                          --puppetca             "false"\
                          --pulp                 "true"
      

   3. Option 3 - Satellite Capsule Server as a Content Node with Smart Proxy: This installs a Satellite Capsule Server with all the features. Run the following commands as the root user on the Satellite Capsule Server:

      # capsule-installer --parent-fqdn          "sat6.example.com"\
                          --register-in-foreman  "true"\
                          --foreman-oauth-key    "xmmQCGYdkoCRcbviGfuPdX7ZiCsdExf"\
                          --foreman-oauth-secret "w5ZDpyPJ24eSBNo53AFybcnqoDYXgLUA"\
                          --pulp-oauth-secret    "doajBEXqNcANy93ZbciFyysWaiwt6BWU"\
                          --certs-tar            "/root/capsule.example.com-certs.tar"\
                          --puppet               "true"\
                          --puppetca             "true"\
                          --pulp                 "true"\
                          --tftp                 "true"\
                          --dhcp                 "true"\
                          --dhcp-interface       "virbr1"\
                         --dns                  "true"\
                         --dns-forwarders       "8.8.8.8"\
                         --dns-forwarders       "8.8.4.4"\
                         --dns-interface        "virbr1"\
                         --dns-zone             "example.com"