Chapter 3. Installing Satellite Server

1. Identify your Satellite subscription.

   # subscription-manager list --available --matches 'Red Hat Satellite'

   This command performs a case-insensitive search of all available subscriptions' fields, including Subscription Name and Provides, matching any instances of Red Hat Satellite. Subscriptions are classified as available if they are not already attached to a system. The search string may also contain the wildcards ? or * to match a single character or zero or more characters, respectively. The wildcard characters may be escaped with a backslash to represent a literal question mark or asterisk. Likewise, to represent a backslash, it must be escaped with another backslash.

   If you are unable to find an available Satellite subscription, see the Red Hat Knowledgebase solution How do I figure out which subscriptions have been consumed by clients registered under Red Hat Subscription Manager? to run a script to allow you to see if your subscription is being consumed by another system.

   If the output is too long, pipe it into a pager utility, such as less or more, so that you can look over the output one screenful at a time.

   1. Regardless of which form of the subscription-manager command is run, the output should be similar to the following:

      Subscription Name: Red Hat Satellite
      Provides:          Red Hat Satellite 6
                         Red Hat Enterprise Linux Server
                         Red Hat Satellite
                         Red Hat Enterprise Linux Load Balancer (for RHEL Server)
      SKU:               MCT0370
      Pool ID:           8a85f9874152663c0541943739717d11
      Available:         3
      Suggested:         1
      Service Level:     Premium
      Service Type:      L1-L3
      Multi-Entitlement: No
      Ends:              10/07/2014
      System Type:       Physical

2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID is different than the example provided.

3. To attach your subscription to your Satellite Server, enter the following command, using your Pool ID:

   # subscription-manager attach --pool=pool_id

   The output should be similar to the following:

   Successfully attached a subscription for: Red Hat Satellite

4. To verify that the subscriptions are successfully attached, enter the following command:

   # subscription-manager list --consumed

   The outputs displays something similar to the following:

   +-------------------------------------------+
      Consumed Subscriptions
   +-------------------------------------------+
   Subscription Name: Red Hat Satellite
   Provides:          Red Hat Satellite
                      Red Hat Enterprise Linux Server
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Satellite
                      Red Hat Satellite 6
                      Red Hat Software Collections  (for RHEL Server)
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux Load Balancer (for RHEL Server)
                      Red Hat Satellite with Embedded Oracle
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux High Availability (for RHEL Server)
   SKU:               MCT0370
   Contract:          10293569
   Account:           5361051
   Serial:            1653856191250699363
   Pool ID:           8a85f9874152663c0541943739717d11
   Active:            True
   Quantity Used:     1
   Service Level:     Premium
   Service Type:      L1-L3
   Status Details:
   Starts:            10/08/2013
   Ends:              10/07/2014
   System Type:       Physical

1. Disable all existing repositories.

   # subscription-manager repos --disable "*"

2. Enable the required repositories:

   • To enable the Red Hat Satellite, Red Hat Enterprise Linux, Red Hat Software Collections, and Puppet 4 repositories, enter the following command:

     # subscription-manager repos \
     --enable=rhel-7-server-rpms \
     --enable=rhel-server-rhscl-7-rpms \
     --enable=rhel-7-server-satellite-6.3-rpms \
     --enable=rhel-7-server-satellite-6.3-puppet4-rpms

   • Alternatively, to enable the Red Hat Satellite, Red Hat Enterprise Linux, Red Hat Software Collections, and Puppet 3 repositories, enter the following command:

     # subscription-manager repos \
     --enable=rhel-7-server-rpms \
     --enable=rhel-server-rhscl-7-rpms \
     --enable=rhel-7-server-satellite-6.3-rpms

     Note

     Satellite 6.3 is the last supported release for Puppet 3. You must upgrade from Puppet 3 to Puppet 4 while on Satellite 6.3, and before upgrading to Satellite 6.4. Satellite 6.4 only supports Puppet 5, and the upgrade to Puppet 5 will be made during the Satellite upgrade.

     Note

     If you are installing Red Hat Satellite as a virtual machine hosted on Red Hat Virtualization (RHV), you also need to enable the Red Hat Common repository, and install RHV guest agents and drivers. For more information, see Installing the Guest Agents and Drivers on Red Hat Enterprise Linux in the Virtual Machine Management Guide for more information.

3. Ensure that Red Hat Subscription Manager is not set to use a specific operating system release.

   # subscription-manager release --unset

4. Clear out any metadata left from any non-Red Hat yum repositories.

   # yum clean all

5. Verify that the repositories have been enabled.

   # yum repolist enabled

   Output similar to the following displays:

   Loaded plugins: product-id, subscription-manager
   repo id                                    repo name                                                                status
   !rhel-7-server-rpms/x86_64                 Red Hat Enterprise Linux 7 Server (RPMs)                                 9,889
   !rhel-7-server-satellite-6.3-rpms/x86_64   Red Hat Satellite 6.3 (for RHEL 7 Server) (RPMs)                           545
   !rhel-server-rhscl-7-rpms/x86_64           Red Hat Software Collections RPMs for Red Hat Enterprise Linux 7 Server  4,279
   repolist: 14,713

1. Update all packages.

   # yum update

2. Install the installation package.

   # yum install satellite

3. Go to Section 3.3, “Performing the Initial Configuration” to run the installation script and perform the initial configuration of your Satellite Server.

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Enterprise Linux.

4. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Enterprise Linux Server.
   • Version is set to the latest minor version of the product you plan to use as the base system.
   • Architecture is set to the 64 bit version.
5. On the Product Software tab, download the Binary DVD image for the latest Red Hat Enterprise Linux Server version.
6. Click DOWNLOADS and select Red Hat Satellite.

7. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you plan to use as the base system.
   • Architecture is set to the 64 bit version.
8. On the Product Software tab, download the Binary DVD image for the latest Red Hat Satellite version.

9. Copy the ISO files to the Satellite base system or other accessible storage device.

   # scp localfile username@hostname:remotefile

1. Create a directory to serve as the mount point for the ISO file corresponding to the base system’s version.

   # mkdir /media/rhel7-server

2. Mount the ISO image for Red Hat Enterprise Linux to the mount point.

   # mount -o loop rhel7-Server-DVD.iso /media/rhel7-server

   The following example shows mounting the ISO using Red Hat Enterprise Linux 7.2:

   # mount -o loop RHEL-7.2-20151030.0-Server-x86_64-dvd1.iso \
   /media/rhel7-server
   mount: /dev/loop0 is write-protected, mounting read-only

3. Copy the ISO file’s repository data file.

   # cp /media/rhel7-server/media.repo /etc/yum.repos.d/rhel7-server.repo

4. Edit the repository data file and add the baseurl directive.

   baseurl=file:///media/rhel7-server/

   The following example shows the repository data file using Red Hat Enterprise Linux 7.2:

   # vi /etc/yum.repos.d/rhel7-server.repo
   [InstallMedia]
   name=Red Hat Enterprise Linux 7.2
   mediaid=1446216863.790260
   metadata_expire=-1
   gpgcheck=0
   cost=500
   baseurl=file:///media/rhel7-server/
   enabled=1

5. Verify that the repository has been configured.

   # yum repolist
   Loaded plugins: product-id, search-disabled-repos, subscription-manager
   This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
   repo id          repo name                       status
   InstallMedia     Red Hat Enterprise Linux 7.2    4,620

6. Create a directory to serve as the mount point for the ISO file of the Satellite Server.

   # mkdir /media/sat6

7. Mount the ISO image for Red Hat Satellite Server to the mount point.

   # mount -o loop sat6-DVD.iso /media/sat6

   The following example shows mounting the ISO using Red Hat Satellite 6.3.0 for Red Hat Enterprise Linux 7:

   # mount -o loop satellite-6.3.0-rhel-7-x86_64-dvd.iso /media/sat6
   mount: /dev/loop1 is write-protected, mounting read-only

8. Red Hat Satellite 6.3 uses Puppet 3 by default, but you can also use Puppet 4. To use Puppet 4, create a local repository to access the required packages and add the following contents:

   # vi /etc/yum.repos.d/satellite-puppet4.repo
   [satellite-puppet4]
   name=satellite-puppet4
   baseurl=file:///media/sat6/addons/Puppet4
   enabled=1
   gpgcheck=1

1. Ensure the ISO images for Red Hat Enterprise Linux Server and Red Hat Satellite are mounted:

   # findmnt -t iso9660

2. Import the Red Hat GPG keys.

   # rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

3. Ensure the base system is up to date with the Binary DVD image.

   # yum update

4. Change to the directory where the Satellite ISO is mounted.

   # cd /media/sat6/

5. Run the installation script in the mounted directory.

   # ./install_packages
   	This script will install the foreman packages on the current machine.
      - Ensuring we are in an expected directory.
      - Copying installation files.
      - Creating a Repository File
      - Creating RHSCL Repository File
      - Checking to see if Foreman is already installed.
      - Importing the gpg key.
      - Foreman is not yet installed, installing it.
      - Installation repository will remain configured for future package installs.
      - Installation media can now be safely unmounted.
   
   Install is complete. Please run satellite-installer --scenario satellite.

   If the script fails due to missing or outdated packages, you must download and install these separately. See Section 3.2.4, “Downloading Packages Manually” for instructions.

   If the script fails due to installed packages being newer than those required, enter yum distribution-synchronization to downgrade the installed packages to the versions that came from the Red Hat Enterprise Linux ISO, then run the installation script again. This should only occur if you have repositories configured whose source is not the Red Hat Enterprise Linux ISO. Use of such repositories is an unsupported configuration.

1. Go to Red Hat Customer Portal and log in.
2. Click DOWNLOADS.
3. Select Red Hat Satellite.

4. Ensure that you have the correct product and version for your environment.

   • Product Variant is set to Red Hat Satellite.
   • Version is set to the latest minor version of the product you are using as the base system.
   • Architecture is set to the 64 bit version.
5. On the Packages tab, enter the name of the package required in the Search box.
6. Click Download Latest next to the package required.

Synchronizing Time using chronyd

1. Install chronyd.

   # yum install chrony

2. Start and enable the chronyd service.

   # systemctl start chronyd
   # systemctl enable chronyd

1. Open https://access.redhat.com/ in your browser and log in to your Red Hat account.
2. Navigate to Subscriptions in the upper-left corner of the Customer Portal.
3. Navigate to Subscription Allocations.
4. Click Create New subscription allocation.
5. In the Name field, enter a name.
6. From the Type list, select the type and version that corresponds to your Satellite Server.
7. Click Create.

1. Navigate to Subscription Allocations.
2. Select the name of the subscription you want to change.
3. Click the Subscriptions tab.
4. Click Add Subscriptions.
5. A list of your Red Hat product subscriptions appears. Enter the Entitlement Quantity for each product.
6. Click Submit to complete the assignment.

To Install the Satellite Tools Repository:

1. In the Satellite web UI, go to Content > Red Hat Repositories and select the RPMs tab.
2. Find and expand the Red Hat Enterprise Linux Server item.

3. Find and expand the Red Hat Satellite Tools 6.3 (for Red Hat Enterprise Linux 7 Server) (RPMs) item.

   If the Red Hat Satellite Tools 6.3 items are not visible, it may be because they are not included in the Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Subscription Manifest and import it into Satellite.

4. Select the Enabled check box next to the Satellite 6.3 Tools repository’s name.

To Synchronize the Satellite Tools Repository:

1. Go to Content > Sync Status.

   A list of product repositories available for synchronization is displayed.

2. Click the arrow next to the product content to view available content.
3. Select the content you want to synchronize.
4. Click Synchronize Now.

To Configure Satellite with an HTTP Proxy

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # unset http_proxy
   # unset https_proxy
   # unset no_proxy

2. Run satellite-installer with the HTTP proxy options.

   # satellite-installer --scenario satellite \
   --katello-proxy-url=http://myproxy.example.com \
   --katello-proxy-port=8080 \
   --katello-proxy-username=proxy_username \
   --katello-proxy-password=proxy_password

3. Verify that Satellite Server can connect to the Red Hat Content Delivery Network (CDN) and can synchronize its repositories.

   1. On the network gateway and the HTTP Proxy, enable TCP for the following host names:

      Host name	Port	Protocol
      subscription.rhsm.redhat.com	443	HTTPS
      cdn.redhat.com	443	HTTPS
      *.akamaiedge.net	443	HTTPS
      cert-api.access.redhat.com (if using Red Hat Insights)	443	HTTPS
      api.access.redhat.com (if using Red Hat Insights)	443	HTTPS

      Satellite Server communicates with the Red Hat CDN securely over SSL. Use of an SSL interception proxy interferes with this communication. These hosts must be whitelisted on the proxy.

      For a list of IP addresses used by the Red Hat CDN (cdn.redhat.com), see the Knowledgebase article Public CIDR Lists for Red Hat on the Red Hat Customer Portal.

   2. On Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file:

      # an http proxy server to use (enter server FQDN)
      proxy_hostname = myproxy.example.com
      
      # port for http proxy server
      proxy_port = 8080
      
      # user name for authenticating to an http proxy, if needed
      proxy_user =
      
      # password for basic http proxy auth, if needed
      proxy_password =

1. To verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

Enable Power Management on Managed Hosts

1. Run the installer with the options to enable BMC.

   # satellite-installer --foreman-proxy-bmc "true" \
   --foreman-proxy-bmc-default-provider "freeipmi"

Configure DNS, DHCP, and TFTP on Satellite Server

1. Run satellite-installer with the options appropriate for your environment.

   # satellite-installer --scenario satellite \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-managed true \
   --foreman-proxy-dns-interface eth0 \
   --foreman-proxy-dns-zone example.com \
   --foreman-proxy-dns-forwarders 172.17.13.1 \
   --foreman-proxy-dns-reverse 13.17.172.in-addr.arpa \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-managed true \
   --foreman-proxy-dhcp-interface eth0 \
   --foreman-proxy-dhcp-range "172.17.13.100 172.17.13.150" \
   --foreman-proxy-dhcp-gateway 172.17.13.1 \
   --foreman-proxy-dhcp-nameservers 172.17.13.2 \
   --foreman-proxy-tftp true \
   --foreman-proxy-tftp-managed true \
   --foreman-proxy-tftp-servername $(hostname)

   For more information about configuring DHCP, DNS, and TFTP services, see the Configuring Network Services section in the Provisioning Guide.

   The script displays its progress and writes logs to /var/log/foreman-installer/satellite.log. You can view the settings used, including the admin_password parameter, in the /etc/foreman-installer/scenarios.d/satellite-answers.yaml file.

1. In the web UI, go to Infrastructure > Subnets and select a subnet.
2. On the Capsules tab, ensure that there is no DHCP Capsule or TFTP Capsule associated by setting the drop-down list to None.

3. Disable forward record orchestration.

   1. Go to Infrastructure > Domains and select a domain.
   2. On the Domain tab, setting the DNS Capsule drop-down list to None.

4. Disable reverse (PTR) record orchestration.

   1. Go to Infrastructure > Subnets and select a subnet.
   2. On the Capsules tab, setting the Reverse DNS Capsule drop-down list to None.

5. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP_address_of_Satellite_or_Capsule
   Option 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

To Configure Satellite Server for Outgoing Emails:

1. In the Satellite web UI, navigate to Administer Settings.

2. Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect.

   1. The following example shows the configuration options for using an SMTP server:

      Table 3.1. Using an SMTP server as a delivery method

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.example.com
      SMTP authentication	login
      SMTP HELO/EHLO domain	example.com
      SMTP password	password
      SMTP port	25
      SMTP username	satellite@example.com

      The SMTP username and SMTP password specify the login credentials for the SMTP server.

   2. The following example uses gmail.com as an SMTP server:

      Table 3.2. Using gmail.com as an SMTP server

      Name	Example value
      Delivery method	SMTP
      SMTP address	smtp.gmail.com
      SMTP authentication	plain
      SMTP HELO/EHLO domain	smtp.gmail.com
      SMTP enable StartTLS auto	Yes
      SMTP password	password
      SMTP port	587
      SMTP username	user@gmail.com

   3. The following example uses the sendmail command as a delivery method:

      Table 3.3. Using sendmail as a delivery method

      Name	Example value
      Delivery method	Sendmail
      Sendmail arguments	-i -t -G

      The Sendmail arguments specify the options passed to the sendmail command. The default value is -i -t. For more information see the sendmail 1 man page.

3. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps:

   • Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server:

     # cp mailca.crt /etc/pki/ca-trust/source/anchors/
     # update-ca-trust enable
     # update-ca-trust

     Where mailca.crt is the CA certificate of the SMTP server.

   • Alternatively, in the web UI, set the SMTP enable StartTLS auto option to No.
4. Click Test email to send a test message to the user’s email address to confirm the configuration is working. If a message fails to send, the web UI displays an error. See the log at /var/log/foreman/production.log for further details.

1. Section 3.4.7.1, “Obtain an SSL Certificate for the Satellite Server”
2. Section 3.4.7.2, “Validate the Satellite Server’s SSL Certificate”
3. Section 3.4.7.3, “Run the Satellite Installer with Custom Certificate Parameters”
4. Section 3.4.7.4, “Install the New Certificate on all Hosts Connected to the Satellite Server”

1. Configure the Firewall.

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Repeat the command adding the --permanent option to make the settings persistent.

   # firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 27017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner apache -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 \
   -o lo -p tcp -m tcp --dport 28017 -m owner \
   --uid-owner root -j ACCEPT \
   && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 \
   -o lo -p tcp -m tcp --dport 28017 -j DROP