Chapter 5. Performing additional configuration on Satellite Server

Procedure

1. To install Red Hat Insights on Satellite Server, enter the following command:

   # satellite-maintain packages install insights-client

2. To register Satellite Server with Red Hat Insights, enter the following command:

   # satellite-installer --register-with-insights

Procedure

1. Enable the pull-based transport on your Satellite Server:

   # satellite-installer --foreman-proxy-plugin-remote-execution-script-mode pull-mqtt

2. Configure the firewall to allow the MQTT service on port 1883:

   # firewall-cmd --add-service=mqtt

3. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

4. In pull-mqtt mode, hosts subscribe for job notifications to either your Satellite Server or any Capsule Server through which they are registered. Ensure that Satellite Server sends remote execution jobs to that same Satellite Server or Capsule Server:

   1. In the Satellite web UI, navigate to Administer > Settings.
   2. On the Content tab, set the value of Prefer registered through Capsule for remote execution to Yes.

Procedure

1. You must disable DHCP management in the installer or not use it.
2. For all IPv6 subnets created in Satellite, set the DHCP Capsule to blank.
3. Optional: If the host and the DHCP server are separated by a router, configure the DHCP relay agent and point to the DHCP server.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.

2. Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect.

   1. The following example shows the configuration options for using an SMTP server:

      Expand

      Table 5.1. Using an SMTP server as a delivery method

      Name	Example value	Additional information
      Delivery method	SMTP
      SMTP address	smtp.example.com
      SMTP authentication	login
      SMTP HELO/EHLO domain	example.com
      SMTP password	password	Use the login credentials for the SMTP server.
      SMTP port	25
      SMTP username	user@example.com	Use the login credentials for the SMTP server.

      Show more

   2. The following example uses gmail.com as an SMTP server:

      Expand

      Table 5.2. Using gmail.com as an SMTP server

      Name	Example value	Additional information
      Delivery method	SMTP
      SMTP address	smtp.gmail.com
      SMTP authentication	plain
      SMTP HELO/EHLO domain	smtp.gmail.com
      SMTP enable StartTLS auto	Yes
      SMTP password	app password	Use the Google app password. For more information, see Sign in with app passwords in Google Help Center.
      SMTP port	587
      SMTP username	user@gmail.com	Use the Google account name.

      Show more

   3. The following example uses the sendmail command as a delivery method:

      Expand

      Table 5.3. Using sendmail as a delivery method

      Name	Example value	Additional information
      Delivery method	Sendmail
      Sendmail location	/usr/sbin/sendmail	For security reasons, both Sendmail location and Sendmail argument settings are read-only and can be only set in /etc/foreman/settings.yaml. Both settings currently cannot be set via satellite-installer. For more information see the sendmail 1 man page.
      Sendmail arguments	-i

      Show more

3. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust extract

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, in the Satellite web UI, set the SMTP enable StartTLS auto option to No.
4. Click Test email to send a test message to the user’s email address to confirm the configuration is working. If a message fails to send, the Satellite web UI displays an error. See the log at /var/log/foreman/production.log for further details.

1. Install the ipa-client package on Satellite Server or Capsule Server:

   # satellite-maintain packages install ipa-client

2. Configure the server as a Identity Management client:

   # ipa-client-install

3. Create a realm proxy user, realm-capsule, and the relevant roles in Identity Management:

   # foreman-prepare-realm admin realm-capsule

   Note the principal name that returns and your Identity Management server configuration details because you require them for the following procedure.

1. Copy the /root/freeipa.keytab file to any Capsule Server that you want to include in the same principal and realm:

   # scp /root/freeipa.keytab root@capsule.example.com:/etc/foreman-proxy/freeipa.keytab

2. On your Satellite Server, move the /root/freeipa.keytab file to the /etc/foreman-proxy directory:

   # mv /root/freeipa.keytab /etc/foreman-proxy

3. On your Satellite Server and Capsule Servers, set ownership to the foreman-proxy user and group:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab

4. Enter the following command on all Capsules that you want to include in the realm. If you use the integrated Capsule on Satellite, enter this command on Satellite Server:

   # satellite-installer --foreman-proxy-realm true \
   --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
   --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM \
   --foreman-proxy-realm-provider freeipa

   You can also use these options when you first configure the Satellite Server.

5. Ensure that the most updated versions of the ca-certificates package is installed and trust the Identity Management Certificate Authority:

   # cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
   # update-ca-trust extract

6. Optional: If you configure Identity Management on an existing Satellite Server or Capsule Server, complete the following steps to ensure that the configuration changes take effect:

   1. Restart the foreman-proxy service:

      # systemctl restart foreman-proxy

   2. In the Satellite web UI, navigate to Infrastructure > Capsules.
   3. Locate the Capsule you have configured for Identity Management and from the list in the Actions column, select Refresh.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > Realms and click Create Realm.
2. In the Name field, enter a name for the realm.
3. From the Realm Type list, select the type of realm.
4. From the Realm Capsule list, select Capsule Server where you have configured Identity Management.
5. Click the Locations tab and from the Locations list, select the location where you want to add the new realm.
6. Click the Organizations tab and from the Organizations list, select the organization where you want to add the new realm.
7. Click Submit.

1. In the Satellite web UI, navigate to Configure > Host Groups, select the host group that you want to update, and click the Network tab.
2. From the Realm list, select the realm you create as part of this procedure, and then click Submit.

To add hosts to a Identity Management host group:

1. On the Identity Management server, create a host group:

   # ipa hostgroup-add hostgroup_name --desc=hostgroup_description

2. Create an automembership rule:

   # ipa automember-add --type=hostgroup hostgroup_name automember_rule

   Where you can use the following options:

   • automember-add flags the group as an automember group.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • automember_rule adds the name you want to identify the automember rule by.

3. Define an automembership condition based on the userclass attribute:

   # ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex=^webserver hostgroup_name
   ----------------------------------
   Added condition(s) to "hostgroup_name"
   ----------------------------------
   Automember Rule: automember_rule
   Inclusive Regex: userclass=^webserver
   ----------------------------
   Number of conditions added 1
   ----------------------------

   Where you can use the following options:

   • automember-add-condition adds regular expression conditions to identify group members.
   • --key=userclass specifies the key attribute as userclass.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • --inclusive-regex= ^webserver identifies matching values with a regular expression pattern.
   • hostgroup_name – identifies the target host group’s name.

1. Section 5.12.1, “Creating a custom SSL certificate for Satellite Server”
2. Section 5.12.2, “Deploying a custom SSL certificate to Satellite Server”
3. Section 5.12.3, “Deploying a custom SSL certificate to hosts”
4. If you have Capsule Servers registered to Satellite Server, configure them with custom SSL certificates. For more information, see Configuring Capsule Server with a Custom SSL Certificate in Installing Capsule Server.