Chapter 3. Performing Additional Configuration on Satellite Server

Procedure

1. In the Satellite web UI, navigate to Content > Subscriptions.
2. Click Manage Manifest.
3. Switch to the CDN Configuration tab.
4. Select the Export Sync tab.
5. Click Update.

CLI procedure

1. Log in to your Satellite Server by using SSH.

2. Set CDN configuration to sync by using exports:

   # hammer organization configure-cdn --name="My_Organization" --type=export_sync

Procedure

1. Navigate to Content > Subscriptions.
2. Click Manage Manifest.
3. Navigate to the CDN Configuration tab.
4. Select the Network Sync tab.
5. In the URL field, enter the address of the upstream Satellite Server.
6. In the Username, enter your username for upstream login.
7. In the Password, enter your password or personal access token for upstream login.
8. In the Organization label field, enter the label of the upstream organization.
9. Optional: In the Lifecycle Environment Label field, enter the label of the upstream lifecycle environment. Default is Library.
10. Optional: In the Content view label field, enter the label of the upstream content view. Default is Default_Organization_View.
11. From the SSL CA Content Credential menu, select a CA certificate used by the upstream Satellite Server.
12. Click Update.
13. In the Satellite web UI, navigate to Content > Products.
14. Select the product that contains the repositories that you want to synchronize.

15. From the Select Action menu, select Sync Now to synchronize all repositories within the product.

    You can also create a synchronization plan to ensure updates on a regular basis. For more information, see Creating a Synchronization Plan in Managing content.

CLI procedure

1. Connect to your downstream Satellite Server using SSH.

2. View information about the upstream CA certificate:

   # hammer content-credential show \
   --name="My_Upstream_CA_Cert" \
   --organization="My_Downstream_Organization"

   Note the ID of the CA certificate for the next step.

3. Set CDN configuration to an upstream Satellite Server:

   # hammer organization configure-cdn --name="My_Downstream_Organization" \
   --type=network_sync \
   --url https://upstream-satellite.example.com \
   --username upstream_username --password upstream_password \
   --ssl-ca-credential-id "My_Upstream_CA_Cert_ID" \ --upstream-organization-label="_My_Upstream_Organization" \
   [--upstream-lifecycle-environment-label="My_Lifecycle_Environment"] \
   [--upstream-content-view-label="My_Content_View"]

   The default lifecycle environment label is Library. The default content view label is Default_Organization_View.

Procedure

1. On Satellite Server, enter the following command:

   # satellite-installer --foreman-proxy-dhcp false \
   --foreman-proxy-dns false \
   --foreman-proxy-tftp false

2. In the Satellite web UI, navigate to Infrastructure > Subnets and select a subnet.
3. Click the Capsules tab and clear the DHCP Capsule, TFTP Capsule, and Reverse DNS Capsule fields.
4. In the Satellite web UI, navigate to Infrastructure > Domains and select a domain.
5. Clear the DNS Capsule field.

6. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP address of Satellite or Capsule
   Option 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/satellite_cert

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Satellite Server, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

3. Create the /root/satellite_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   commonName = satellite.example.com
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = satellite.example.com

4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = satellite.example.com
   countryName =My_Country_Name 1
   stateOrProvinceName = My_State_Or_Province_Name 2
   localityName = My_Locality_Name 3
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name 4

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

5. Generate CSR:

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \ 1
   -config /root/satellite_cert/openssl.cnf \ 2
   -out /root/satellite_cert/satellite_cert_csr.pem 3

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Procedure

1. Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server.

   # katello-certs-check \
   -c /root/satellite_cert/satellite_cert.pem \      1
   -k /root/satellite_cert/satellite_cert_key.pem \  2
   -b /root/satellite_cert/ca_cert_bundle.pem        3

   1

   Path to Satellite Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign Satellite Server certificate.

   3

   Path to the Certificate Authority bundle.

   If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to Satellite Server.

   Example output of katello-certs-check

   Validation succeeded.
   
   To install the Red Hat Satellite Server with the custom certificates, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem"
   
   To update the certificates on a currently running Red Hat Satellite installation, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem" \
       --certs-update-server --certs-update-server-ca

   Note that you must not access or modify /root/ssl-build.

2. From the output of the katello-certs-check command, depending on your requirements, enter the satellite-installer command that installs a new Satellite with custom SSL certificates or updates certificates on a currently running Satellite.

   If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates.

   Important

   satellite-installer needs the certificate archive file after you deploy the certificate. Do not modify or delete it. It is required, for example, when upgrading Satellite Server.

3. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com.
4. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. To install PostgreSQL, enter the following command:

   # dnf install postgresql-server postgresql-evr postgresql-contrib

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

3. Edit the /var/lib/pgsql/data/postgresql.conf file:

   # vi /var/lib/pgsql/data/postgresql.conf

   Note that the default configuration of external PostgreSQL needs to be adjusted to work with Satellite. The base recommended external database configuration adjustments are as follows:

   • checkpoint_completion_target: 0.9
   • max_connections: 500
   • shared_buffers: 512MB
   • work_mem: 4MB

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

5. Add the following line to the end of the file to use SCRAM for authentication:

   password_encryption=scram-sha-256

6. Edit the /var/lib/pgsql/data/pg_hba.conf file:

   # vi /var/lib/pgsql/data/pg_hba.conf

7. Add the following line to the file:

     host  all   all   Satellite_ip/32   scram-sha-256

8. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl enable --now postgresql

9. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql

10. Make the changes persistent:

    # firewall-cmd --runtime-to-permanent

11. Switch to the postgres user and start the PostgreSQL client:

    $ su - postgres -c psql

12. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;
    CREATE DATABASE pulpcore OWNER pulp;

13. Connect to the Pulp database:

    postgres=# \c pulpcore
    You are now connected to database "pulpcore" as user "postgres".

14. Create the hstore extension:

    pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore";
    CREATE EXTENSION

15. Exit the postgres user:

    # \q

16. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
    # PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

Procedure

1. To configure the external databases for Satellite, enter the following command:

   # satellite-installer \
   --katello-candlepin-manage-db false \
   --katello-candlepin-db-host postgres.example.com \
   --katello-candlepin-db-name candlepin \
   --katello-candlepin-db-user candlepin \
   --katello-candlepin-db-password Candlepin_Password \
   --foreman-proxy-content-pulpcore-manage-postgresql false \
   --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \
   --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \
   --foreman-proxy-content-pulpcore-postgresql-user pulp \
   --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password \
   --foreman-db-manage false \
   --foreman-db-host postgres.example.com \
   --foreman-db-database foreman \
   --foreman-db-username foreman \
   --foreman-db-password Foreman_Password

   To enable the Secure Sockets Layer (SSL) protocol for these external databases, add the following options:

   --foreman-db-root-cert <path_to_CA>
   --foreman-db-sslmode verify-full
   --foreman-proxy-content-pulpcore-postgresql-ssl true
   --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA>
   --katello-candlepin-db-ssl true
   --katello-candlepin-db-ssl-ca <path_to_CA>
   --katello-candlepin-db-ssl-verify true