Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 6. Security settings

You can configure global settings for provisioning.

This chapter only mentions notable settings.

When performing any kind of provisioning, as a security measure, Satellite automatically generates a unique token and adds this token to the kickstart URL in the PXE configuration file (PXELinux, Grub2). By default, the token is valid for 360 minutes. When you provision a host, ensure that you reboot the host within this time frame. If the token expires, it is no longer valid and you receive a 404 error and the operating system installer download fails.

Procedure

  1. In the Satellite web UI, navigate to Administer > Settings, and click the Provisioning tab.
  2. Find the Token duration option and click the edit icon and edit the duration, or enter 0 to disable token generation. If token generation is disabled, an attacker can spoof client IP address and download kickstart from Satellite Server, including the encrypted root password.

If you do not want to set a plain text default root password for the hosts that you provision, you can use a default encrypted password.

The default root password can be inherited by a host group and consequentially by hosts in that group.

If you change the password and reprovision the hosts in the group that inherits the password, the password will be overwritten on the hosts.

Procedure

  1. Generate an encrypted password: 

    $ python3 -c 'import crypt,getpass;pw=getpass.getpass(); print(crypt.crypt(pw)) if (pw==getpass.getpass("Confirm: ")) else exit()'
    Copy to Clipboard Toggle word wrap
  2. Copy the password for later use.
  3. In the Satellite web UI, navigate to Administer > Settings.
  4. On the Settings page, select the Provisioning tab.
  5. In the Name column, navigate to Root password, and click Click to edit.
  6. Paste the encrypted password, and click Save.

6.3. Provisioning FIPS-compliant hosts
Copy link

Satellite supports provisioning hosts that comply with the National Institute of Standards and Technology’s Security Requirements for Cryptographic Modules standard, reference number FIPS 140-2, referred to here as FIPS.

To enable the provisioning of hosts that are FIPS-compliant, complete the following tasks:

  • Change the provisioning password hashing algorithm for the operating system
  • Create a host group and set a host group parameter to enable FIPS

For more information, see Working with host groups in Managing hosts.

The provisioned hosts have the FIPS-compliant settings applied. To confirm that these settings are enabled, complete the steps in Section 6.3.3, “Verifying FIPS mode is enabled”.

To provision FIPS-compliant hosts, you must first set the password hashing algorithm that you use in provisioning to SHA256. This configuration setting must be applied for each operating system you want to deploy as FIPS-compliant.

Procedure

  1. Identify the Operating System IDs: 

    $ hammer os list
    Copy to Clipboard Toggle word wrap

  2. Update each operating system’s password hash value. 

    $ hammer os update \
--password-hash SHA256
--title "My_Operating_System"
    Copy to Clipboard Toggle word wrap

    Note that you cannot use a comma-separated list of values.

6.3.2. Setting the FIPS-enabled parameter
Copy link

To provision a FIPS-compliant host, you must create a host group and set the host group parameter fips_enabled to true. If this is not set to true, or is absent, the FIPS-specific changes do not apply to the system. You can set this parameter when you provision a host or for a host group.

To set this parameter when provisioning a host, append --parameters fips_enabled=true to the Hammer command. 

$ hammer hostgroup set-parameter \
--hostgroup "My_Host_Group" \
--name fips_enabled \
--value "true"
Copy to Clipboard Toggle word wrap

For more information, see the output of the command hammer hostgroup set-parameter --help.

6.3.3. Verifying FIPS mode is enabled
Copy link

To verify these FIPS compliance changes have been successful, you must provision a host and check its configuration.

Procedure

  1. Log in to the host as root or with an admin-level account.

  2. Enter the following command: 

    $ cat /proc/sys/crypto/fips_enabled
    Copy to Clipboard Toggle word wrap

    A value of 1 confirms that FIPS mode is enabled.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat