Chapter 6. Performing additional configuration on Satellite Server

Procedure

1. Log in to the Red Hat registry by using Podman:

   # podman login --authfile /etc/foreman/registry-auth.json registry.redhat.io

   This command creates the /etc/foreman/registry-auth.json file.

2. Enable the plugin:

   # satellite-installer --enable-iop

3. If you want to use the Red Hat Lightspeed vulnerability service in Satellite and your Satellite Server connects to https://security.access.redhat.com through an HTTP proxy, configure the iop-cvemap-download service to use the same HTTP proxy:

   1. Edit the iop-cvemap-download service:

      # systemctl edit iop-cvemap-download.service

   2. Input the following content:

      [Service]
      Environment = HTTPS_PROXY=http://http-proxy.example.com:port
      Environment = NO_PROXY=localhost

Procedure

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. Ensure that the RPM repository type is selected.
3. In the search field, type name = "Red Hat Satellite Client 6" and press Enter. Optionally, enable the Recommended Repositories filter to limit the results.
4. Click the name of the required repository to expand the repository set.
5. For the required architecture, click the + icon to enable the repository.

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the required product to view available repositories.
3. Select the repositories you want to synchronize.
4. Click Synchronize Now.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > HTTP Proxies.
2. Click New HTTP Proxy.
3. In the Name field, enter the name for the HTTP proxy.
4. In the Url field, enter the URL of the HTTP proxy in the following format: https://http-proxy.example.com:8080.
5. Optional: If authentication is required, in the Username field, enter the username to authenticate with.
6. Optional: If authentication is required, in the Password field, enter the password to authenticate with.
7. To test connection to the proxy, click Test Connection.
8. Select the Default content HTTP proxy option to set the new HTTP proxy as default for content synchronization.
9. Click Submit.

Procedure

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set:

   # unset http_proxy https_proxy no_proxy

2. Add an HTTP proxy entry to Satellite and set the HTTP proxy as default for content synchronization:

   $ hammer http-proxy create \
   --name=My_HTTP_Proxy \
   --username=My_HTTP_Proxy_User_Name \
   --password=My_HTTP_Proxy_Password \
   --url http://http-proxy.example.com:8080 \
   --content-default-http-proxy true

Procedure

1. On Satellite, to verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy row, select the adjacent Value column and enter the proxy URL.
3. Click the tick icon to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy except hosts row, select the adjacent Value column and enter the names of one or more hosts that you want to exclude from proxy requests.
3. Click the tick icon to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings, and click the Content tab.
2. Set the Default HTTP Proxy setting to no global default.

Procedure

1. Install the ipa-client package on Satellite Server or Capsule Server:

   # satellite-maintain packages install ipa-client

2. Configure the server as a Identity Management client:

   # ipa-client-install

3. Create a realm proxy user, realm-capsule, and the relevant roles in Identity Management:

   # foreman-prepare-realm admin realm-capsule

   Note the principal name that returns and your Identity Management server configuration details because you require them for the following procedure.

Procedure

1. Copy the /root/freeipa.keytab file to any Capsule Server that you want to include in the same principal and realm:

   # scp /root/freeipa.keytab root@capsule.example.com:/etc/foreman-proxy/freeipa.keytab

2. On your Satellite Server, move the /root/freeipa.keytab file to the /etc/foreman-proxy directory:

   # mv /root/freeipa.keytab /etc/foreman-proxy

3. On your Satellite Server and Capsule Servers, set ownership to the foreman-proxy user and group:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab

4. Enter the following command on all Capsules that you want to include in the realm. If you use the integrated Capsule on Satellite, enter this command on Satellite Server:

   # satellite-installer --foreman-proxy-realm true \
   --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
   --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM \
   --foreman-proxy-realm-provider freeipa

   You can also use these options when you first configure the Satellite Server.

5. Ensure that the most updated versions of the ca-certificates package is installed and trust the Identity Management Certificate Authority:

   # cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
   # update-ca-trust extract

6. Optional: If you configure Identity Management on an existing Satellite Server or Capsule Server, complete the following steps to ensure that the configuration changes take effect:

   1. Restart the foreman-proxy service:

      # systemctl restart foreman-proxy

   2. In the Satellite web UI, navigate to Infrastructure > Capsules.
   3. Locate the Capsule you have configured for Identity Management and from the list in the Actions column, select Refresh.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > Realms and click Create Realm.
2. In the Name field, enter a name for the realm.
3. From the Realm Type list, select the type of realm.
4. From the Realm Capsule list, select Capsule Server where you have configured Identity Management.
5. Click the Locations tab and from the Locations list, select the location where you want to add the new realm.
6. Click the Organizations tab and from the Organizations list, select the organization where you want to add the new realm.
7. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. Select the host group that you want to update.
3. Select the Network tab.
4. From the Realm list, select the realm you create as part of this procedure.
5. Click Submit.

Procedure

1. On the Identity Management server, create a host group:

   # ipa hostgroup-add hostgroup_name --desc=hostgroup_description

2. Create an automembership rule:

   # ipa automember-add --type=hostgroup hostgroup_name automember_rule

   Where you can use the following options:

   • automember-add flags the group as an automember group.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • automember_rule adds the name you want to identify the automember rule by.

3. Define an automembership condition based on the userclass attribute:

   # ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex=^webserver hostgroup_name
   ----------------------------------
   Added condition(s) to "hostgroup_name"
   ----------------------------------
   Automember Rule: automember_rule
   Inclusive Regex: userclass=^webserver
   ----------------------------
   Number of conditions added 1
   ----------------------------

   Where you can use the following options:

   • automember-add-condition adds regular expression conditions to identify group members.
   • --key=userclass specifies the key attribute as userclass.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • --inclusive-regex= ^webserver identifies matching values with a regular expression pattern.

   • hostgroup_name – identifies the target host group’s name.

     Note

     When a system is added to Satellite Server’s hostgroup_name host group, it is added automatically to the Identity Management server’s "hostgroup_name" host group. Identity Management host groups allow for Host-Based Access Controls (HBAC), sudo policies and other Identity Management functions.

Procedure

1. If you have installed Satellite with a default Satellite certificate and want to configure Satellite with an alternate CNAME, generate a new default Satellite SSL certificate with an additional CNAME on Satellite Server:

   # satellite-installer --certs-cname alternate_fqdn --certs-update-server

2. If you have not installed Satellite, you can add the --certs-cname alternate_fqdn option to the satellite-installer command to install Satellite with an alternate CNAME.
3. If you use Satellite with a custom certificate, when creating a custom certificate, include the alternate CNAME records to the custom certificate. For more information, see Creating a Custom SSL Certificate for Satellite Server.

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/satellite_cert

2. Create a private key with which to sign the certificate signing request (CSR). The private key must be unencrypted:

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

   If you already have a private key, skip this step.

3. Optional: Verify that the key is unencrypted:

   # openssl pkey -noout -in /root/satellite_cert/satellite_cert_key.pem

   If the command does not ask for a password, the key is unencrypted. If your private key is password-protected, remove the password.

4. Create the /root/satellite_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   commonName = satellite.example.com
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth, clientAuth
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = satellite.example.com

   For more information about the [ v3_req ] parameters and their purpose, see RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.

5. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = satellite.example.com
   countryName = My_Country_Name
   stateOrProvinceName = My_State_Or_Province_Name
   localityName = My_Locality_Name
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name

   The options used in the configuration file include the following:

   countryName

   The country represented by a two-letter code

   stateOrProvinceName

   Full name of the state or province

   localityName

   Full name of the locality (example: New York)

   organizationalUnitName

   Division responsible for the certificate (example: IT department)

6. Generate the CSR:

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \
   -config /root/satellite_cert/openssl.cnf \
   -out /root/satellite_cert/satellite_cert_csr.pem

   The options used in the configuration file include the following:

   -key

   Path to the private key

   -config

   Path to the configuration file

   -out

   Path to the CSR to generate

7. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Verification

1. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com.
2. In your browser, view the certificate details to verify the deployed certificate.