Chapter 2. Configuring DHCP integration

Procedure

1. Create a security token:

   # tsig-keygen -a hmac-md5 omapi_key

   Copy to Clipboard Toggle word wrap

   Note that Satellite supports only the hmac-md5 algorithm for OMAPI authentication.

   Example output:

   key "omapi_key" {
   	algorithm hmac-md5;
   	secret "4z1jwYO0RGUTJbWDepFBdg==";
   };

   Copy to Clipboard Toggle word wrap

2. Edit the /etc/dhcp/dhcpd.conf file, and append the following settings:

   key omapi_key {
   	algorithm hmac-md5;
   	secret "key_secret";
   };
   omapi-port 7911;
   omapi-key omapi_key;

   Copy to Clipboard Toggle word wrap

   The settings specified in the example include the following:

   key omapi_key

   Defines the key, its algorithm and encrypted password. Use the output of the tsig-keygen command for this directive.

   omapi-port 7911;

   Enables the OMAPI protocol in ISC DHCP and defines the port of the protocol.

   omapi-key omapi_key

   Defines the name of the key the OMAPI interface uses. The name must match the one you specified in the tsig-keygen command.

3. Restart the dhcpd service:

   # systemctl restart dhcpd

   Copy to Clipboard Toggle word wrap

4. Open the OMAPI port in the firewalld service:

   # firewall-cmd --add-port=7911/tcp

   Copy to Clipboard Toggle word wrap

5. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

Procedure

1. On Satellite Server, determine both the UID and the primary GID of the foreman-proxy user:

   # id -u foreman-proxy
   # id -g foreman-proxy

   Copy to Clipboard Toggle word wrap

   You require these IDs in the next steps.

2. On the DHCP server, share the configuration of the DHCP service and lease database over NFS:

   1. Create the foreman-proxy group with the same group ID as on the Satellite Server:

      # groupadd -g My_User_ID foreman-proxy

      Copy to Clipboard Toggle word wrap

   2. Create the foreman-proxy user with the same user ID and primary group ID as on the Satellite Server:

      # useradd -u My_User_ID -g My_Group_ID -s /sbin/nologin foreman-proxy

      Copy to Clipboard Toggle word wrap

   3. Ensure that members of the foreman-proxy group can access the configuration file of the DHCP service:

      # chgrp -R foreman-proxy /etc/dhcp/
      # chmod g+rx /etc/dhcp/
      # chmod g+r /etc/dhcp/dhcpd.conf

      Copy to Clipboard Toggle word wrap

   4. Install the nfs-server package:

      # dnf install nfs-utils

      Copy to Clipboard Toggle word wrap

   5. Edit the /etc/exports file, and append share entries for the /etc/dhcp/ and /var/lib/dhcpd/ directories:

      /etc/dhcp        satellite.example.com(ro)
      /var/lib/dhcpd   satellite.example.com(ro)

      Copy to Clipboard Toggle word wrap

      Share the directories in read-only mode and only with the Satellite Server or Capsule Server.

   6. Enable and start the NFS server service:

      # systemctl enable --now nfs-server

      Copy to Clipboard Toggle word wrap

   7. Open the NFSv4 port in the firewalld service:

      # firewall-cmd --add-service=nfs

      Copy to Clipboard Toggle word wrap

   8. Make the changes persistent:

      # firewall-cmd --runtime-to-permanent

      Copy to Clipboard Toggle word wrap

Procedure

1. Install the required package:

   # satellite-maintain packages install nfs-utils

   Copy to Clipboard Toggle word wrap

2. Create the directories into which you later mount the NFS shares:

   # mkdir -p \
   /srv/nfs/etc/dhcp \
   /srv/nfs/var/lib/dhcpd

   Copy to Clipboard Toggle word wrap

3. Edit the /etc/fstab file, and add entries for the NFS shares to mount them automatically when the system boots:

   dhcp_server_fqdn:/etc/dhcp       /srv/nfs/etc/dhcp       nfs  ro,auto,context="system_u:object_r:dhcp_etc_t:s0"     0 0
   dhcp_server_fqdn:/var/lib/dhcpd  /srv/nfs/var/lib/dhcpd  nfs  ro,auto,context="system_u:object_r:dhcpd_state_t:s0"  0 0

   Copy to Clipboard Toggle word wrap

4. Reload systemd so that this service uses the updated /etc/fstab file:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

5. Mount the NFS shares:

   # mount /srv/nfs/etc/dhcp/
   # mount /srv/nfs/var/lib/dhcpd/

   Copy to Clipboard Toggle word wrap

6. Verify that the foreman-proxy user can access the files on the NFS server. For example:

   1. Display the first 5 lines of the /srv/nfs/etc/dhcp/dhcpd.conf file:

      $ su - foreman-proxy -c 'head -5 /srv/nfs/etc/dhcp/dhcpd.conf'

      Copy to Clipboard Toggle word wrap

   2. Display the first 5 lines of the /srv/nfs/var/lib/dhcpd/dhcpd.leases file:

      $ su - foreman-proxy -c 'head -5 /srv/nfs/var/lib/dhcpd/dhcpd.leases'

      Copy to Clipboard Toggle word wrap

7. Configure Satellite Server or Capsule Server to use the DHCP server:

   # satellite-installer \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-provider remote_isc \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-server dhcp_server_fqdn \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /srv/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /srv/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret key_secret \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port 7911

   Copy to Clipboard Toggle word wrap
8. For each affected Capsule, update the configuration of that Capsule in the Satellite web UI. For more information, see Section 2.5, “Associating the DHCP service with a subnet”.