Chapter 3. Installing Satellite Server

1. Identify your Satellite subscription

   On Red Hat Enterprise Linux 6.7 (or higher) or 7.1 (or higher), you can search all available subscriptions containing the string Red Hat Satellite. On earlier versions of Red Hat Enterprise Linux, you must list all available subscriptions and manually check the output for the appropriate subscription.

   1. On Red Hat Enterprise Linux 6.7 (and higher) or 7.1 (and higher), run the following command:

      # subscription-manager list --available --matches 'Red Hat Satellite'

      This command performs a case-insensitive search of all available subscriptions' fields, including Subscription Name and Provides, matching any instances of Red Hat Satellite. Subscriptions are classified as available if they are not already attached to a system. The search string may also contain the wildcards ? or * to match a single character or zero or more characters, respectively. The wildcard characters may be escaped with a backslash to represent a literal question mark or asterisk. Likewise, to represent a backslash, it must be escaped with another backslash.

      If you are unable to find an available Satellite subscription, see the Red Hat Knowledgebase solution How do I figure out which subscriptions have been consumed by clients registered under Red Hat Subscription Manager? to run a script to allow you to see if your subscription is being consumed by another system.

   2. On other versions of Red Hat Enterprise Linux, run the following command:

      # subscription-manager list --all --available

      If the output is too long, pipe it into a pager utility, such as less or more, so that you can look over the output one screenful at a time.

   3. Regardless of which form of the subscription-manager command is run, the output should be similar to the following:

      Subscription Name: Red Hat Satellite
      Provides:          Red Hat Satellite 6
                         Red Hat Enterprise Linux Server
                         Red Hat Satellite
                         Red Hat Enterprise Linux Load Balancer (for RHEL Server)
      SKU:               MCT0370
      Pool ID:           8a85f9874152663c0541943739717d11
      Available:         3
      Suggested:         1
      Service Level:     Premium
      Service Type:      L1-L3
      Multi-Entitlement: No
      Ends:              10/07/2014
      System Type:       Physical

2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID will be different than the example provided.

3. To attach your subscription to your Satellite Server, run the following command, using your Pool ID:

   # subscription-manager attach --pool=pool_id

   The output should be similar to the following:

   Successfully attached a subscription for: Red Hat Satellite

4. To verify that the subscriptions are successfully attached, run the following command:

   # subscription-manager list --consumed

   The outputs displays something similar to the following:

   +-------------------------------------------+
      Consumed Subscriptions
   +-------------------------------------------+
   Subscription Name: Red Hat Satellite
   Provides:          Red Hat Satellite
                      Red Hat Enterprise Linux Server
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Satellite
                      Red Hat Satellite 6
                      Red Hat Software Collections  (for RHEL Server)
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux Load Balancer (for RHEL Server)
                      Red Hat Satellite with Embedded Oracle
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux High Availability (for RHEL Server)
   SKU:               MCT0370
   Contract:          10293569
   Account:           5361051
   Serial:            1653856191250699363
   Pool ID:           8a85f9874152663c0541943739717d11
   Active:            True
   Quantity Used:     1
   Service Level:     Premium
   Service Type:      L1-L3
   Status Details:
   Starts:            10/08/2013
   Ends:              10/07/2014
   System Type:       Physical

1. Disable all existing repositories.

   # subscription-manager repos --disable "*"

2. Enable the Red Hat Satellite, Red Hat Enterprise Linux, and Red Hat Software Collections repositories.

   Ensure the Red Hat Enterprise Linux repository matches the specific version you are using.

   1. If you are using Red Hat Enterprise Linux 6, run this command.

      # subscription-manager repos --enable=rhel-6-server-rpms \
      --enable=rhel-server-rhscl-6-rpms \
      --enable=rhel-6-server-satellite-6.2-rpms

   2. If you are using Red Hat Enterprise Linux 7, run this command.

      # subscription-manager repos --enable=rhel-7-server-rpms \
      --enable=rhel-server-rhscl-7-rpms \
      --enable=rhel-7-server-satellite-6.2-rpms

      Note

      If you are installing Red Hat Satellite as a virtual machine hosted on Red Hat Virtualization (RHV), you also need to enable the Red Hat Common repository, and install RHV guest agents and drivers. For more information, see Installing the Guest Agents and Drivers on Red Hat Enterprise Linux in the Virtual Machine Management Guide for more information.

3. Ensure that Red Hat Subscription Manager is not set to use a specific operating system release.

   # subscription-manager release --unset

4. Clear out any metadata left from any non-Red Hat yum repositories.

   # yum clean all

5. Verify that the repositories have been enabled.

   # yum repolist enabled

   The following output displays:

   Loaded plugins: product-id, subscription-manager
   repo id                                        repo name                                                                   status
   !rhel-7-server-rpms/x86_64                     Red Hat Enterprise Linux 7 Server (RPMs)                                    9,889
   !rhel-7-server-satellite-6.2-rpms/x86_64    Red Hat Satellite 6.2 (for RHEL 7 Server) (RPMs)                         545
   !rhel-server-rhscl-7-rpms/x86_64               Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server     4,279
   repolist: 14,713

1. Update all packages.

   # yum update

2. Install the installation package.

   # yum install satellite

3. Go to Section 3.3, “Performing the Initial Configuration” to run the installer program and perform the initial configuration of your Satellite Server.

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Enterprise Linux.

4. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Enterprise Linux Server.
   • Version is set to the latest minor version of the product you plan to use as the base system.
   • Architecture is set to the 64 bit version.
5. On the Product Software tab, download the Binary DVD image for the latest Red Hat Enterprise Linux Server version.
6. Click DOWNLOADS and select Red Hat Satellite.

7. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you plan to use as the base system.
   • Architecture is set to the 64 bit version.
8. On the Product Software tab, download the Binary DVD image for the latest Red Hat Satellite version.

9. Copy the ISO files to the Satellite base system or other accessible storage device.

   # scp localfile username@hostname:remotefile

1. Create a directory to serve as the mount point for the ISO file corresponding to the base system’s version.

   # mkdir /media/rhelX-server

   Where X is the major version of Red Hat Enterprise Linux you are using.

2. Mount the ISO image for Red Hat Enterprise Linux to the mount point.

   # mount -o loop rhelX-Server-DVD.iso /media/rhelX-server

   The following example shows mounting the ISO using Red Hat Enterprise Linux 7.2:

   # mount -o loop RHEL-7.2-20151030.0-Server-x86_64-dvd1.iso \
   /media/rhel7-server
   mount: /dev/loop0 is write-protected, mounting read-only

3. Copy the ISO file’s repository data file.

   # cp /media/rhelX-server/media.repo /etc/yum.repos.d/rhelX-server.repo

4. Edit the repository data file and add the baseurl directive.

   baseurl=file:///media/rhelX-server/

   The following example shows the repository data file using Red Hat Enterprise Linux 7.2:

   # vi /etc/yum.repos.d/rhel7-server.repo
   [InstallMedia]
   name=Red Hat Enterprise Linux 7.2
   mediaid=1446216863.790260
   metadata_expire=-1
   gpgcheck=0
   cost=500
   baseurl=file:///media/rhel7-server/
   enabled=1

5. Verify that the repository has been configured.

   # yum repolist
   Loaded plugins: product-id, search-disabled-repos, subscription-manager
   This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
   repo id          repo name                       status
   InstallMedia     Red Hat Enterprise Linux 7.2    4,620

6. Create a directory to serve as the mount point for the ISO file of the Satellite Server.

   # mkdir /media/sat6

7. Mount the ISO image for Red Hat Satellite Server to the mount point.

   # mount -o loop sat6-DVD.iso /media/sat6

   The following example shows mounting the ISO using Red Hat Satellite 6.2.1 for Red Hat Enterprise Linux 7:

   # mount -o loop satellite-6.2.1-rhel-7-x86_64-dvd.iso /media/sat6
   mount: /dev/loop1 is write-protected, mounting read-only

1. Import the Red Hat GPG keys.

   # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

2. Ensure the base system is up to date with the Binary DVD image.

   # yum update

3. Change to the directory where the Satellite ISO is mounted.

   # cd /media/sat6/

4. Run the installer script in the mounted directory.

   # ./install_packages
   	This script will install the foreman packages on the current machine.
      - Ensuring we are in an expected directory.
      - Copying installation files.
      - Creating a Repository File
      - Creating RHSCL Repository File
      - Checking to see if Foreman is already installed.
      - Importing the gpg key.
      - Foreman is not yet installed, installing it.
      - Installation repository will remain configured for future package installs.
      - Installation media can now be safely unmounted.
   
   Install is complete. Please run satellite-installer.

   If the script fails due to missing or outdated packages, you will need to download and install these separately. See Section 3.2.4, “Downloading Packages Manually” for instructions.

   If the script fails due to installed packages being newer than those required, enter yum distribution-synchronization to downgrade the installed packages to the versions that came from the Red Hat Enterprise Linux ISO, then run the installation script again. This should only occur if you have repositories configured whose source is not the Red Hat Enterprise Linux ISO. Use of such repositories is an unsupported configuration.

5. For a self-registered Satellite, disable the ISO based repositories to avoid conflicts with repositories provided by Satellite Server.

   1. Install yum-config-manager:

      # yum install yum-utils

   2. Disable the ISO based repositories:

      # yum-config-manager --disable InstallMedia --disable satellite-local --disable scl-local --disable satellite-puppet4

   3. Confirm yum repositories are disabled:

      # yum repolist

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Satellite.

4. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you are using as the base system.
   • Architecture is set to the 64 bit version.
5. On the Packages tab, enter the name of the package required in the Search box.
6. Click Download Latest next to the package required.

Synchronizing Time by Using NTP

1. Install ntp.

   # yum install ntp

2. Verify that your NTP server is available.

   # ntpdate -q ntp_server_address

3. Set the system time.

   # ntpdate ntp_server_address

4. Start and enable the ntpd service.

   # chkconfig ntpd on

Synchronizing Time by Using chronyd

1. Install chronyd.

   # yum install chrony

2. Start and enable the chrony service.

   # systemctl start chronyd
   # systemctl enable chronyd

1. Copy the default answer file /etc/foreman-installer/scenarios.d/satellite-answers.yaml to a location on your local file system.

   # cp /etc/foreman-installer/scenarios.d/satellite-answers.yaml \
   /etc/foreman-installer/scenarios.d/my-answer-file.yaml

2. To view all of the configurable options, run the satellite-installer --scenario satellite --help command.
3. Open your copy of the answer file, edit the values to suit your environment, and save the file.

4. Open the /etc/foreman-installer/scenarios.d/satellite.yaml file and edit the answer file entry to point to your custom answer file.

   :answer_file: /etc/foreman-installer/scenarios.d/my-answer-file.yaml

5. Run the satellite-installer command.

   # satellite-installer --scenario satellite

6. If you have been installing in a disconnected environment, unmount the ISO images.

   # umount /media/sat6
   # umount /media/rhel7-server

To Register a Satellite to Itself:

1. If the Satellite is already registered to the Red Hat Customer Portal, unregister the Satellite from the Red Hat Customer Portal using the following commands:

   # subscription-manager remove --all
   # subscription-manager unregister

2. The Satellite subscription on the Red Hat Customer Portal is now available and can be transferred into the Satellite’s manifest. For further information on manifests see Managing Subscriptions in the Content Management Guide.

   1. Navigate to https://access.redhat.com and click SUBSCRIPTIONS on the main menu at the top of the page.
   2. Scroll down to the Red Hat Subscription Management section, and click Satellite under Subscription Management Applications.
   3. Select the required Satellite Server by clicking its host name in the table.
   4. Click Attach a subscription and select subscriptions you want to attach. Specify the quantity for each subscription, and click the button Attach Selected.

3. Refresh the manifest on the Satellite Server:

   1. Log in to the Satellite server.
   2. Ensure that the correct organization is selected.
   3. Click Content > Red Hat Subscriptions and then click Manage Manifest at the upper right of the page.
   4. In the Subscription Manifest section, click Actions and under the Subscription Manifest subsection, click Refresh Manifest.

4. Enable Red Hat repositories using the Satellite web UI or with the command-line interface:

   • Using the Satellite web UI:

     1. Click Content > Red Hat Repositories.

     2. Navigate to the required repositories. Click each repository set from which you want to select repositories and select the check box for each required repository. The repository is automatically enabled.

        • For Red Hat Enterprise Linux 6 the repositories that need to be enabled are:

          • Red Hat Enterprise Linux 6 Server RPMs x86_64 6Server
          • Red Hat Satellite 6.2 for Red Hat Enterprise Linux 6 Server RPMs x86_64
          • Red Hat Software Collections RPMs for Red Hat Enterprise Linux 6 Server x86_64 6Server
          • Red Hat Enterprise Linux 6 Server - Satellite Tools 6.2 RPMs x86_64 Repository

        • For Red Hat Enterprise Linux 7 the repositories that need to be enabled are:

          • Red Hat Enterprise Linux 7 Server RPMs x86_64 7Server
          • Red Hat Satellite 6.2 for Red Hat Enterprise Linux 7 Server RPMs x86_64
          • Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server x86_64 7Server
          • Red Hat Satellite Tools 6.2 for Red Hat Enterprise Linux 7 Server RPMs x86_64

   • Using the Subscription Manager CLI Tool:

     You can enable the repositories required for the Satellite Server by using the following command:

     • For Red Hat Enterprise Linux 6:

       # subscription-manager repos --enable=rhel-6-server-satellite-6.2-rpms \
       --enable=rhel-6-server-satellite-tools-6.2-rpms \
       --enable=rhel-6-server-rpms \
       --enable=rhel-server-rhscl-6-rpms

     • For Red Hat Enterprise Linux 7:

       # subscription-manager repos --enable=rhel-7-server-satellite-6.2-rpms \
       --enable=rhel-7-server-satellite-tools-6.2-rpms \
       --enable=rhel-7-server-rpms \
       --enable=rhel-server-rhscl-7-rpms

5. Synchronize the Satellite Server:

   1. Navigate to Content > Sync Status. Based on the subscriptions and repositories enabled, the list of product repositories available for synchronization is displayed.
   2. Click the arrow next to the product name to see available content.
   3. Select the content you want to synchronize.

   4. Click Synchronize Now to starting synchronizing. The status of the synchronization process will appear in the Result column. If synchronization is successful, Sync complete will appear in the Result column. If synchronization failed, Error syncing will appear.

      Note

      Content synchronization can take a long time. The length of time required depends on the speed of disk drives, network connection speed, and the amount of content selected for synchronization.

6. Optionally, create a Content View to represent the Satellite Server. This will allow the Satellite to follow the same life cycle management procedures as the rest of the content on the server. For more information on Content Views see Using Content Views in the Red Hat Satellite Host Configuration Guide.

   1. To create a Content View:

      1. Log into the web UI as a Satellite administrator.
      2. Click Content > Content Views.
      3. Click Create New View.
      4. Specify the Name of the Content View. The Label field is automatically populated when the Name field is filled out. Optionally, provide a description of the Content View.
      5. Click Save.

   2. Edit the Content View to add the Red Hat Enterprise Linux server and Satellite repositories:

      1. Click Content > Content Views and choose the Content View to add repositories to.
      2. Click Yum Content and select Repositories from the drop-down menu. From the submenu, click Add.
      3. Select the required repositories to add and click Add Repositories. The required repositories for a self-registered Satellite are all the repositories for the Satellite itself, any supporting repositories and the repository for the Base OS. The repositories required for a self-registered Satellite are listed in Step 4 of this procedure.

7. Download and install the required certificates by running:

   # rpm -Uvh /var/www/html/pub/katello-ca-consumer-latest.noarch.rpm

8. Register the Satellite Server, and attach the appropriate entitlements. When registering the Satellite Server, you must specify the organization to which the server belongs, and the life cycle environment. To confirm the available organizations and life cycle environments, in the Satellite web UI navigate to Hosts > New host and select the drop-down list for these values.

   # subscription-manager register --org=organization \
   --environment=environment

   Example

   # subscription-manager register --org=ExampleCompany \
   --environment=Library

   You will be prompted for your Red Hat Satellite user name and password. The Satellite Server administrator can configure new users. See Users and Roles in the Red Hat Satellite Server Administration Guide for more information.

9. Find the pool IDs for the Satellite and for Red Hat Enterprise Linux by running the following command:

   # subscription-manager list --available

10. Attach the entitlements by running the following command:

    # subscription-manager attach --pool Red_Hat_Satellite_Pool_ID \
    --pool Red_Hat_Enterprise_Linux_ID

    A content host has now been created for the Satellite Server inside of the Satellite Server.

11. Install the Katello Agent package to allow errata management and package installation through the Satellite web UI. The katello-agent package depends on the gofer package that provides the goferd service. The goferd service must be running so that the Red Hat Satellite Server or Capsule Server can provide information about errata that are applicable for content hosts.

    To install the katello-agent run the following command:

    # yum install katello-agent

12. Ensure goferd is running:

    • On Red Hat Enterprise Linux 6, run the following command:

      # service goferd start

    • On Red Hat Enterprise Linux 7, run the following command:

      # systemctl start goferd

To Install the Satellite Tools Repository:

1. In the Satellite web UI, go to Content > Red Hat Repositories and select the RPMs tab.
2. Find and expand the Red Hat Enterprise Linux Server item.

3. Find and expand the Red Hat Satellite Tools 6.2 (for Red Hat Enterprise Linux VERSION Server) (RPMs) item.

   If the Red Hat Satellite Tools 6.2 items are not visible, it may be because they are not included in the Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Subscription Manifest and import it into Satellite.

4. Select the Enabled check box next to the Satellite 6.2 Tools repository’s name.

To Synchronize the Satellite Tools Repository:

1. Go to Content > Sync Status.

   A list of product repositories available for synchronization is displayed.

2. Click the arrow next to the product content to view available content.
3. Select the content you want to synchronize.
4. Click Synchronize Now.

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # export http_proxy=""
   # export https_proxy=$http_proxy
   # export no_proxy=$http_proxy

2. Run satellite-installer with the HTTP proxy options.

   # satellite-installer --scenario satellite \
   --katello-proxy-url=http://myproxy.example.com \
   --katello-proxy-port=8080 \
   --katello-proxy-username=proxy_username \
   --katello-proxy-password=proxy_password

3. Verify that Satellite Server can connect to the Red Hat Content Delivery Network (CDN) and can synchronize its repositories.

   1. On the network gateway and the HTTP Proxy, enable TCP for the following host names:

      Host name	Port	Protocol
      subscription.rhsm.redhat.com	443	HTTPS
      cdn.redhat.com	443	HTTPS
      *.akamaiedge.net	443	HTTPS
      cert-api.access.redhat.com (if using Red Hat Insights)	443	HTTPS
      api.access.redhat.com (if using Red Hat Insights)	443	HTTPS

      For a list of IP addresses used by the Red Hat CDN (cdn.redhat.com), see the Knowledgebase article Public CIDR Lists for Red Hat on the Red Hat Customer Portal.

   2. On Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file:

      # an http proxy server to use (enter server FQDN)
      proxy_hostname = http_proxy.example.com
      
      # port for http proxy server
      proxy_port = 3128
      
      # user name for authenticating to an http proxy, if needed
      proxy_user =
      
      # password for basic http proxy auth, if needed
      proxy_password =

Enable Power Management on Managed Hosts

1. Run the installer with the options to enable BMC.

   # satellite-installer --foreman-proxy-bmc "true" \
   --foreman-proxy-bmc-default-provider "freeipmi"

Configure DNS, DHCP, and TFTP on Satellite Server

1. Run satellite-installer with the options appropriate for your environment.

   # satellite-installer --scenario satellite \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-interface eth0 \
   --foreman-proxy-dns-zone example.com \
   --foreman-proxy-dns-forwarders 172.17.13.1 \
   --foreman-proxy-dns-reverse 13.17.172.in-addr.arpa \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-interface eth0 \
   --foreman-proxy-dhcp-range "172.17.13.100 172.17.13.150" \
   --foreman-proxy-dhcp-gateway 172.17.13.1 \
   --foreman-proxy-dhcp-nameservers 172.17.13.2 \
   --foreman-proxy-tftp true \
   --foreman-proxy-tftp-servername $(hostname)

   The status of the installation is displayed. You can view the user name and password in the command output. You can also retrieve the information from the admin_password parameter in the /etc/foreman-installer/scenarios.d/satellite-answers.yaml file.

   Success!
     * Satellite is running at https://satellite.example.com
         Default credentials are 'admin:*******'
     * Capsule is running at https://satellite.example.com:9090
     * To install additional capsule on separate machine continue by running:"
   
         capsule-certs-generate --capsule-fqdn "$CAPSULE" --certs-tar "~/$CAPSULE-certs.tar"
   
     The full log is at /var/log/foreman-installer/satellite.log

1. Go to Infrastructure > Subnets and select a subnet.
2. On the Capsules tab, ensure that there is no DHCP Capsule or TFTP Capsule associated by setting the drop-down list to None.

3. Disable forward record orchestration.

   1. Go to Infrastructure > Domains and select a domain.
   2. On the Domain tab, setting the DNS Capsule drop-down list to None.

4. Disable reverse (PTR) record orchestration.

   1. Go to Infrastructure > Subnets and select a subnet.
   2. On the Capsules tab, setting the Reverse DNS Capsule drop-down list to None.

1. Edit the configuration file /etc/foreman/email.yaml to match your preferred delivery method.

   The following example shows the contents of the configuration file for using an SMTP server:

   production:
      delivery_method: :smtp
      smtp_settings:
         address: smtp.example.com
         port: 25
         domain: example.com
         authentication: :login
         user_name: satellite@example.com
         password: satellite

   Where the user_name and password directives specify the login credentials for the SMTP server. The default /etc/foreman/email.yaml contains authentication: :none.

   The following example uses gmail.com as an SMTP server:

   production:
      delivery_method: :smtp
      smtp_settings:
         enable_starttls_auto: true
         address: smtp.gmail.com
         port: 587
         domain: smtp.gmail.com
         authentication: :plain
         user_name: user@gmail.com
         password: password

   The following example uses the sendmail command as a delivery method:

   production:
      delivery_method: :sendmail
      sendmail_settings:
         arguments: "-i -t -G"

   Where the arguments directive is used to pass command-line options to sendmail. The default value of arguments is "-i -t". For more information see the sendmail 1 man page.

2. If you decide to send email via an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust enable
     # update-ca-trust

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, add the following directive to /etc/foreman/email.yaml under smtp_settings:

     enable_starttls_auto: false

3. After updating the /etc/foreman/email.yaml file, restart Katello services to apply the changes.

   # katello-service restart

4. Additional email settings, such as the reply address or subject prefix, can be set up in the Satellite web UI at Administer > Settings under the General tab.

1. Section 3.5.8.1, “Obtain an SSL Certificate for the Satellite Server”
2. Section 3.5.8.2, “Validate the Satellite Server’s SSL Certificate”
3. Section 3.5.8.3, “Run the Satellite Installer with Custom Certificate Parameters”
4. Section 3.5.8.4, “Install the New Certificate on all Hosts Connected to the Satellite Server”

Configuring the Firewall on Red Hat Enterprise Linux 6

1. Configure iptables service on Satellite and Capsule Servers.

   # iptables -I OUTPUT -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && iptables -I OUTPUT -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && iptables -I OUTPUT -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && iptables -I OUTPUT -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && iptables -I OUTPUT -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && iptables -I OUTPUT -o lo -p tcp -m tcp --dport 28017 -j DROP \
   && service iptables save

Configuring the Firewall on Red Hat Enterprise Linux 7

1. Configure the firewall on Satellite and Capsule Servers.

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP