Installing Satellite Server in a disconnected network environment

Procedure

1. Open the ports for clients on Satellite Server:

   # firewall-cmd \
   --add-port="8000/tcp" \
   --add-port="9090/tcp"

   Copy to Clipboard Toggle word wrap

2. Allow access to services on Satellite Server:

   # firewall-cmd \
   --add-service=dns \
   --add-service=dhcp \
   --add-service=tftp \
   --add-service=http \
   --add-service=https \
   --add-service=puppetmaster

   Copy to Clipboard Toggle word wrap

3. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

Procedure

1. Ensure that the host name and local host resolve correctly:

   # ping -c1 localhost
   # ping -c1 `hostname -f` # my_system.domain.com

   Copy to Clipboard Toggle word wrap

   Successful name resolution results in output similar to the following:

   # ping -c1 localhost
   PING localhost (127.0.0.1) 56(84) bytes of data.
   64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.043 ms
   
   --- localhost ping statistics ---
   1 packets transmitted, 1 received, 0% packet loss, time 0ms
   rtt min/avg/max/mdev = 0.043/0.043/0.043/0.000 ms
   
   # ping -c1 `hostname -f`
   PING hostname.gateway (XX.XX.XX.XX) 56(84) bytes of data.
   64 bytes from hostname.gateway (XX.XX.XX.XX): icmp_seq=1 ttl=64 time=0.019 ms
   
   --- localhost.gateway ping statistics ---
   1 packets transmitted, 1 received, 0% packet loss, time 0ms
   rtt min/avg/max/mdev = 0.019/0.019/0.019/0.000 ms

   Copy to Clipboard Toggle word wrap

2. To avoid discrepancies with static and transient host names, set all the host names on the system by entering the following command:

   # hostnamectl set-hostname name

   Copy to Clipboard Toggle word wrap

1. The default tuning profile defined in the /usr/share/foreman-installer/config/foreman.hiera/tuning/common.yaml file
2. The tuning profile that you want to apply to your deployment and is defined in the /usr/share/foreman-installer/config/foreman.hiera/tuning/sizes/ directory
3. Optional: If you have configured a /etc/foreman-installer/custom-hiera.yaml file, Satellite applies these configuration settings.

Procedure

1. Optional: If you have configured the custom-hiera.yaml file on Satellite Server, back up the /etc/foreman-installer/custom-hiera.yaml file to custom-hiera.original. You can use the backup file to restore the /etc/foreman-installer/custom-hiera.yaml file to its original state if it becomes corrupted:

   # cp /etc/foreman-installer/custom-hiera.yaml \
   /etc/foreman-installer/custom-hiera.original

   Copy to Clipboard Toggle word wrap
2. Optional: If you have configured the custom-hiera.yaml file on Satellite Server, review the definitions of the default tuning profile in /usr/share/foreman-installer/config/foreman.hiera/tuning/common.yaml and the tuning profile that you want to apply in /usr/share/foreman-installer/config/foreman.hiera/tuning/sizes/. Compare the configuration entries against the entries in your /etc/foreman-installer/custom-hiera.yaml file and remove any duplicated configuration settings in your /etc/foreman-installer/custom-hiera.yaml file.

3. Enter the satellite-installer command with the --tuning option for the profile that you want to apply. For example, to apply the medium tuning profile settings, enter the following command:

   # satellite-installer --tuning medium

   Copy to Clipboard Toggle word wrap

Procedure

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Enterprise Linux.
4. Click All Red Hat Enterprise Linux Downloads.

5. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Enterprise Linux for x86_64.
   • Version is set to the latest minor version of the product you plan to use as the base operating system.
   • Architecture is set to the 64 bit version.
6. On the Product Software tab, download the Binary DVD image for the latest Red Hat Enterprise Linux for x86_64 version.
7. Click DOWNLOADS and select Red Hat Satellite.

8. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you plan to use.
9. On the Product Software tab, download the Binary DVD image for the latest Red Hat Satellite version.

10. Copy the ISO files to /var/tmp on the Satellite base operating system or other accessible storage device.

    # scp localfile username@hostname:remotefile

    Copy to Clipboard Toggle word wrap

Procedure

1. Create a directory to serve as the mount point for the ISO file corresponding to the version of the base operating system.

   # mkdir /media/rhel

   Copy to Clipboard Toggle word wrap

2. Mount the ISO image for Red Hat Enterprise Linux to the mount point.

   # mount -o loop rhel-DVD.iso /media/rhel

   Copy to Clipboard Toggle word wrap

3. To copy the ISO file’s repository data file and change permissions, enter:

   # cp /media/rhel/media.repo /etc/yum.repos.d/rhel.repo
   # chmod u+w /etc/yum.repos.d/rhel.repo

   Copy to Clipboard Toggle word wrap

4. Edit the repository data file and add the baseurl directive.

   [RHEL-BaseOS]
   name=Red Hat Enterprise Linux BaseOS
   mediaid=None
   metadata_expire=-1
   gpgcheck=0
   cost=500
   baseurl=file:///media/rhel/BaseOS/
   
   [RHEL-AppStream]
   name=Red Hat Enterprise Linux Appstream
   mediaid=None
   metadata_expire=-1
   gpgcheck=0
   cost=500
   baseurl=file:///media/rhel/AppStream/

   Copy to Clipboard Toggle word wrap

5. Verify that the repository has been configured.

   # yum repolist

   Copy to Clipboard Toggle word wrap

6. Create a directory to serve as the mount point for the ISO file of Satellite Server.

   # mkdir /media/sat6

   Copy to Clipboard Toggle word wrap

7. Mount the ISO image for Satellite Server to the mount point.

   # mount -o loop sat6-DVD.iso /media/sat6

   Copy to Clipboard Toggle word wrap

Procedure

1. Ensure the ISO images for Red Hat Enterprise Linux Server and Red Hat Satellite are mounted:

   # findmnt -t iso9660

   Copy to Clipboard Toggle word wrap

2. Import the Red Hat GPG keys:

   # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

   Copy to Clipboard Toggle word wrap

3. Ensure the base operating system is up to date with the Binary DVD image:

   # dnf upgrade

   Copy to Clipboard Toggle word wrap

4. Change to the directory where the Satellite ISO is mounted:

   # cd /media/sat6/

   Copy to Clipboard Toggle word wrap

5. Run the installation script in the mounted directory:

   # ./install_packages

   Copy to Clipboard Toggle word wrap

   If you have successfully installed the Satellite packages, the following message is displayed: Install is complete. Please run satellite-installer --scenario satellite.

Procedure

1. Go to the Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Click the product that contains the package that you want to download.
4. Ensure that you have the correct Product Variant, Version, and Architecture for your environment.
5. Click the Packages tab.
6. In the Search field, enter the name of the package.
7. Click the package.
8. From the Version list, select the version of the package.
9. At the bottom of the page, click Download Now.
10. Copy the package to the Satellite base operating system.

11. On Satellite Server, change to the directory where the package is located:

    # cd /path-to-package/

    Copy to Clipboard Toggle word wrap

12. Install the package locally:

    # dnf install package_name

    Copy to Clipboard Toggle word wrap

13. Change to the directory where the Satellite ISO is mounted:

    # cd /media/sat6/

    Copy to Clipboard Toggle word wrap

14. Verify that you have resolved the package dependency errors by installing Satellite Server packages. If there are further package dependency errors, repeat this procedure.

    # ./install_packages

    Copy to Clipboard Toggle word wrap

    If you have successfully installed the Satellite packages, the following message is displayed: Install is complete. Please run satellite-installer --scenario satellite.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click the Content tab.
3. Set the Subscription Connection Enabled value to No.

Procedure

1. In the Satellite web UI, ensure the context is set to the organization you want to use.
2. In the Satellite web UI, navigate to Content > Subscriptions and click Manage Manifest.
3. In the Manage Manifest window, click Choose File.
4. Navigate to the location that contains the Red Hat subscription manifest file, then click Open.

CLI procedure

1. Copy the Red Hat subscription manifest file from your local machine to Satellite Server:

   $ scp ~/manifest_file.zip root@satellite.example.com:~/.

   Copy to Clipboard Toggle word wrap

2. Log in to Satellite Server as the root user and import the Red Hat subscription manifest file:

   $ hammer subscription upload \
   --file ~/manifest_file.zip \
   --organization "My_Organization"

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Satellite web UI, navigate to Content > Subscriptions.
2. Click Manage Manifest.
3. Select the CDN Configuration tab.
4. Select the Custom CDN tab.
5. In the URL field, enter the URL of your CDN server from which you want Satellite Server to consume Red Hat repositories.
6. Optional: In the SSL CA Content Credential, select the SSL certificate of the CDN server.
7. Click Update.
8. You can now enable Red Hat repositories consumed from your internal CDN server.

CLI procedure

1. Connect to your Satellite Server using SSH.

2. Set CDN configuration to your custom CDN server:

   $ hammer organization configure-cdn --name="My_Organization" \
   --type=custom_cdn \
   --url https://my-cdn.example.com \
   --ssl-ca-credential-id "My_CDN_CA_Cert_ID"

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable the pull-based transport on your Satellite Server:

   # satellite-installer --foreman-proxy-plugin-remote-execution-script-mode pull-mqtt

   Copy to Clipboard Toggle word wrap

2. Configure the firewall to allow the MQTT service on port 1883:

   # firewall-cmd --add-service=mqtt

   Copy to Clipboard Toggle word wrap

3. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

4. In pull-mqtt mode, hosts subscribe for job notifications to either your Satellite Server or any Capsule Server through which they are registered. Ensure that Satellite Server sends remote execution jobs to that same Satellite Server or Capsule Server:

   1. In the Satellite web UI, navigate to Administer > Settings.
   2. On the Content tab, set the value of Prefer registered through Capsule for remote execution to Yes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.

2. Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect.

   1. The following example shows the configuration options for using an SMTP server:

      Expand

      Table 3.1. Using an SMTP server as a delivery method

      Name	Example value	Additional information
      Delivery method	SMTP
      SMTP address	smtp.example.com
      SMTP authentication	login
      SMTP HELO/EHLO domain	example.com
      SMTP password	password	Use the login credentials for the SMTP server.
      SMTP port	25
      SMTP username	user@example.com	Use the login credentials for the SMTP server.

      Show more

   2. The following example uses gmail.com as an SMTP server:

      Expand

      Table 3.2. Using gmail.com as an SMTP server

      Name	Example value	Additional information
      Delivery method	SMTP
      SMTP address	smtp.gmail.com
      SMTP authentication	plain
      SMTP HELO/EHLO domain	smtp.gmail.com
      SMTP enable StartTLS auto	Yes
      SMTP password	app password	Use the Google app password. For more information, see Sign in with app passwords in Google Help Center.
      SMTP port	587
      SMTP username	user@gmail.com	Use the Google account name.

      Show more

   3. The following example uses the sendmail command as a delivery method:

      Expand

      Table 3.3. Using sendmail as a delivery method

      Name	Example value	Additional information
      Delivery method	Sendmail
      Sendmail location	/usr/sbin/sendmail	For security reasons, both Sendmail location and Sendmail argument settings are read-only and can be only set in /etc/foreman/settings.yaml. Both settings currently cannot be set via satellite-installer. For more information see the sendmail 1 man page.
      Sendmail arguments	-i

      Show more

3. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust enable
     # update-ca-trust

     Copy to Clipboard Toggle word wrap

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, in the Satellite web UI, set the SMTP enable StartTLS auto option to No.
4. Click Test email to send a test message to the user’s email address to confirm the configuration is working. If a message fails to send, the Satellite web UI displays an error. See the log at /var/log/foreman/production.log for further details.

1. Install the ipa-client package on Satellite Server or Capsule Server:

   # satellite-maintain packages install ipa-client

   Copy to Clipboard Toggle word wrap

2. Configure the server as a Identity Management client:

   # ipa-client-install

   Copy to Clipboard Toggle word wrap

3. Create a realm proxy user, realm-capsule, and the relevant roles in Identity Management:

   # foreman-prepare-realm admin realm-capsule

   Copy to Clipboard Toggle word wrap

   Note the principal name that returns and your Identity Management server configuration details because you require them for the following procedure.

1. Copy the /root/freeipa.keytab file to any Capsule Server that you want to include in the same principal and realm:

   # scp /root/freeipa.keytab root@capsule.example.com:/etc/foreman-proxy/freeipa.keytab

   Copy to Clipboard Toggle word wrap

2. On your Satellite Server, move the /root/freeipa.keytab file to the /etc/foreman-proxy directory:

   # mv /root/freeipa.keytab /etc/foreman-proxy

   Copy to Clipboard Toggle word wrap

3. On your Satellite Server and Capsule Servers, set ownership to the foreman-proxy user and group:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab

   Copy to Clipboard Toggle word wrap

4. Enter the following command on all Capsules that you want to include in the realm. If you use the integrated Capsule on Satellite, enter this command on Satellite Server:

   # satellite-installer --foreman-proxy-realm true \
   --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
   --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM \
   --foreman-proxy-realm-provider freeipa

   Copy to Clipboard Toggle word wrap

   You can also use these options when you first configure the Satellite Server.

5. Ensure that the most updated versions of the ca-certificates package is installed and trust the Identity Management Certificate Authority:

   # cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
   # update-ca-trust enable
   # update-ca-trust

   Copy to Clipboard Toggle word wrap

6. Optional: If you configure Identity Management on an existing Satellite Server or Capsule Server, complete the following steps to ensure that the configuration changes take effect:

   1. Restart the foreman-proxy service:

      # systemctl restart foreman-proxy

      Copy to Clipboard Toggle word wrap
   2. In the Satellite web UI, navigate to Infrastructure > Capsules.
   3. Locate the Capsule you have configured for Identity Management and from the list in the Actions column, select Refresh.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > Realms and click Create Realm.
2. In the Name field, enter a name for the realm.
3. From the Realm Type list, select the type of realm.
4. From the Realm Capsule list, select Capsule Server where you have configured Identity Management.
5. Click the Locations tab and from the Locations list, select the location where you want to add the new realm.
6. Click the Organizations tab and from the Organizations list, select the organization where you want to add the new realm.
7. Click Submit.

1. In the Satellite web UI, navigate to Configure > Host Groups, select the host group that you want to update, and click the Network tab.
2. From the Realm list, select the realm you create as part of this procedure, and then click Submit.

To add hosts to a Identity Management host group:

1. On the Identity Management server, create a host group:

   # ipa hostgroup-add hostgroup_name --desc=hostgroup_description

   Copy to Clipboard Toggle word wrap

2. Create an automembership rule:

   # ipa automember-add --type=hostgroup hostgroup_name automember_rule

   Copy to Clipboard Toggle word wrap

   Where you can use the following options:

   • automember-add flags the group as an automember group.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • automember_rule adds the name you want to identify the automember rule by.

3. Define an automembership condition based on the userclass attribute:

   # ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex=^webserver hostgroup_name
   ----------------------------------
   Added condition(s) to "hostgroup_name"
   ----------------------------------
   Automember Rule: automember_rule
   Inclusive Regex: userclass=^webserver
   ----------------------------
   Number of conditions added 1
   ----------------------------

   Copy to Clipboard Toggle word wrap

   Where you can use the following options:

   • automember-add-condition adds regular expression conditions to identify group members.
   • --key=userclass specifies the key attribute as userclass.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • --inclusive-regex= ^webserver identifies matching values with a regular expression pattern.
   • hostgroup_name – identifies the target host group’s name.

1. Section 3.8.1, “Creating a custom SSL certificate for Satellite Server”
2. Section 3.8.2, “Deploying a custom SSL certificate to Satellite Server”
3. Section 3.8.3, “Deploying a custom SSL certificate to hosts”
4. If you have Capsule Servers registered to Satellite Server, configure them with custom SSL certificates. For more information, see Configuring Capsule Server with a Custom SSL Certificate in Installing Capsule Server.