Chapter 4. Configuring External Services

1. On the Red Hat Enterprise Linux Server, install the ISC DNS Service.

   # yum install bind bind-utils

   Ensure that the nsupdate utility was installed. The Capsule uses the nsupdate utility to update DNS records on the remote server.

2. Copy the /etc/rndc.key file from the services server to the Capsule Server.

   # scp localfile username@hostname:remotefile

3. Ensure that the ownership, permissions, and SELinux context are correct.

   # restorecon -v /etc/rndc.key
   # chown -v root:named /etc/rndc.key
   # chmod -v 640 /etc/rndc.key

4. Test the nsupdate utility by adding a host remotely.

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key
   # nslookup aaa.virtual.lan 192.168.38.2
   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

5. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file.

   # satellite-installer --foreman-proxy-dns=true \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="192.168.38.2" \
   --foreman-proxy-keyfile=/etc/rndc.key \
   --foreman-proxy-dns-ttl=86400

6. Restart the foreman-proxy service.

   # systemctl restart foreman-proxy

7. Log in to the Satellite Server web UI.
8. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DNS feature should appear.
9. Associate the DNS service with the appropriate subnets and domain.

To configure the DHCP server and share the DHCP configuration and lease files

1. Deploy a Red Hat Enterprise Linux Server and install the ISC DHCP Service and Berkeley Internet Name Domain (BIND).

   # yum install dhcp bind

2. Generate a security token in an empty directory.

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   The above command can take a long time, for less-secure proof-of-concept deployments you can use a non-blocking random number generator.

   # dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key

   This creates the key pair in two files in the current directory.

3. Copy the secret hash from the key.

   # cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2

4. Edit the dhcpd configuration file for all of the subnets and add the key as in the example:

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm HMAC-MD5;
   	secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw==";
   };
   omapi-key omapi_key;

5. Delete the two key files from the directory where you created them.

6. Define each subnet on the Satellite Server.

   It is recommended to set up a lease range and reservation range separately to prevent conflicts. For example, the lease range is 192.168.38.10 to 192.168.38.100 so the reservation range (defined in the Satellite web UI) is 192.168.38.101 to 192.168.38.250. Do not set DHCP Capsule for the defined Subnet yet.

7. Configure the firewall for external access to the DHCP server.

   # firewall-cmd --add-service dhcp \
   && firewall-cmd --runtime-to-permanent

8. Determine the UID and GID numbers of the foreman user on the Satellite Server.

   # id -u foreman
   993
   # id -g foreman
   990

9. Create the same user and group with the same IDs on the DHCP server.

   # groupadd -g 990 foreman
   # useradd -u 993 -g 990 -s /sbin/nologin foreman

10. To make the configuration files readable, restore the read and execute flags.

    # chmod o+rx /etc/dhcp/
    # chmod o+r /etc/dhcp/dhcpd.conf
    # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

11. Start the DHCP service.

    # systemctl start dhcpd

12. Export the DHCP configuration and leases files using NFS.

    # yum install nfs-utils
    # systemctl enable rpcbind nfs-server
    # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd

13. Create the DHCP configuration and leases files to be exported using NFS.

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

14. Add the following line to the /etc/fstab file to create mount points for the newly created directories.

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

15. Mount the file systems in /etc/fstab.

    # mount -a

16. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)
    
    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)
    
    /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

17. Reload the NFS server.

    # exportfs -rva

18. Configure the firewall for the DHCP omapi port 7911 for the Satellite Server.

    # firewall-cmd --add-port="7911/tcp" \
    && firewall-cmd --runtime-to-permanent

19. If required, configure the firewall for external access to NFS.

    Clients are configured using NFSv3.

    • Use the firewalld daemon’s NFS service to configure the firewall.

      # firewall-cmd --zone public --add-service mountd \
      && firewall-cmd --zone public --add-service rpc-bind \
      && firewall-cmd --zone public --add-service nfs \
      && firewall-cmd --runtime-to-permanent

To Configure Capsule Server with External DHCP

1. Install the NFS client.

   # yum install nfs-utils

2. Create the DHCP directories for NFS.

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner.

   # chown -R foreman-proxy /mnt/nfs

4. Verify communication with the NFS server and RPC communication paths.

   # showmount -e your_DHCP_server_FQDN
   # rpcinfo -p your_DHCP_server_FQDN

5. Add the following lines to the /etc/fstab file:

   your_DHCP_server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0
   
   your_DHCP_server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems on /etc/fstab.

   # mount -a

7. Read the relevant files.

   # su foreman-proxy -s /bin/bash
   bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   bash-4.2$ exit

8. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file.

   # satellite-installer --foreman-proxy-dhcp=true \
   --foreman-proxy-dhcp-provider=remote_isc \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911 \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-server=your_DHCP_server_FQDN

9. Restart the foreman-proxy service.

   # systemctl restart foreman-proxy

10. Log in to the Satellite Server web UI.
11. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DHCP feature should appear.
12. Associate the DHCP service with the appropriate subnets and domain.

1. Create the TFTP directory to prepare for NFS.

   # mkdir -p /mnt/nfs/var/lib/tftpboot

2. Add the following line in the /etc/fstab file:

   192.168.38.2:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0

3. Mount the file systems in /etc/fstab.

   # mount -a

4. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file.

   # satellite-installer --foreman-proxy-tftp=true \
   --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot

5. If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of that server.

   # satellite-installer --foreman-proxy-tftp-servername=new_FQDN

   This updates all configuration files with the new value.

6. Log in to the Satellite Server web UI.
7. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The TFTP feature should appear.
8. Associate the TFTP service with the appropriate subnets and domain.