Chapter 5. Configuring Satellite Server with External Services
If you do not want to configure the DNS, DHCP, and TFTP services on Satellite Server, use this section to configure your Satellite Server to work with external DNS, DHCP and TFTP services.
5.1. Configuring Satellite Server with External DNS
You can configure Satellite Server with external DNS. Satellite Server uses the nsupdate
utility to update DNS records on the remote server.
To make any changes persistent, you must enter the satellite-installer
command with the options appropriate for your environment.
Prerequisites
- You must have a configured external DNS server.
Procedure
Install the
bind-utils
package:# yum install bind bind-utils
Copy the
/etc/rndc.key
file from the external DNS server to Satellite Server:# scp root@dns.example.com:/etc/rndc.key /etc/rndc.key
Configure the ownership, permissions, and SELinux context:
# restorecon -v /etc/rndc.key # chown -v root:named /etc/rndc.key # chmod -v 640 /etc/rndc.key
To test the
nsupdate
utility, add a host remotely:# echo -e "server DNS_IP_Address\n \ update add aaa.virtual.lan 3600 IN A Host_IP_Address\n \ send\n" | nsupdate -k /etc/rndc.key # nslookup aaa.virtual.lan DNS_IP_Address # echo -e "server DNS_IP_Address\n \ update delete aaa.virtual.lan 3600 IN A Host_IP_Address\n \ send\n" | nsupdate -k /etc/rndc.key
Assign the
foreman-proxy
user to thenamed
group manually. Normally, satellite-installer ensures that theforeman-proxy
user belongs to thenamed
UNIX group, however, in this scenario Satellite does not manage users and groups, therefore you need to assign theforeman-proxy
user to thenamed
group manually.# usermod -a -G named foreman-proxy
Enter the
satellite-installer
command to make the following persistent changes to the/etc/foreman-proxy/settings.d/dns.yml
file:# satellite-installer --foreman-proxy-dns=true \ --foreman-proxy-dns-managed=false \ --foreman-proxy-dns-provider=nsupdate \ --foreman-proxy-dns-server="DNS_IP_Address" \ --foreman-proxy-keyfile=/etc/rndc.key \ --foreman-proxy-dns-ttl=86400
Restart the foreman-proxy service:
# systemctl restart foreman-proxy
- Log in to the Satellite Server web UI.
- Navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.
- Associate the DNS service with the appropriate subnets and domain.
5.2. Configuring Satellite Server with External DHCP
To configure Satellite Server with external DHCP, you must complete the following procedures:
5.2.1. Configuring an External DHCP Server to Use with Satellite Server
To configure an external DHCP server to use with Satellite Server, on a Red Hat Enterprise Linux server, you must install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) packages. You must also share the DHCP configuration and lease files with Satellite Server. The example in this procedure uses the distributed Network File System (NFS) protocol to share the DHCP configuration and lease files.
If you use dnsmasq as an external DHCP server, enable the dhcp-no-override
setting. This is required because Satellite creates configuration files on the TFTP server under the grub2/
subdirectory. If the dhcp-no-override
setting is disabled, clients fetch the bootloader and its configuration from the root directory, which might cause an error.
Procedure
On a Red Hat Enterprise Linux Server server, install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) packages:
# yum install dhcp bind
Generate a security token:
# dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key
As a result, a key pair that consists of two files is created in the current directory.
Copy the secret hash from the key:
# cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2
Edit the
dhcpd
configuration file for all of the subnets and add the key. The following is an example:# cat /etc/dhcp/dhcpd.conf default-lease-time 604800; max-lease-time 2592000; log-facility local7; subnet 192.168.38.0 netmask 255.255.255.0 { range 192.168.38.10 192.168.38.100; option routers 192.168.38.1; option subnet-mask 255.255.255.0; option domain-search "virtual.lan"; option domain-name "virtual.lan"; option domain-name-servers 8.8.8.8; } omapi-port 7911; key omapi_key { algorithm HMAC-MD5; secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw=="; }; omapi-key omapi_key;
Note that the
option routers
value is the Satellite or Capsule IP address that you want to use with an external DHCP service.- Delete the two key files from the directory that they were created in.
On Satellite Server, define each subnet. Do not set DHCP Capsule for the defined Subnet yet.
To prevent conflicts, set up the lease and reservation ranges separately. For example, if the lease range is 192.168.38.10 to 192.168.38.100, in the Satellite web UI define the reservation range as 192.168.38.101 to 192.168.38.250.
Configure the firewall for external access to the DHCP server:
# firewall-cmd --add-service dhcp \ && firewall-cmd --runtime-to-permanent
On Satellite Server, determine the UID and GID of the
foreman
user:# id -u foreman 993 # id -g foreman 990
On the DHCP server, create the
foreman
user and group with the same IDs as determined in a previous step:# groupadd -g 990 foreman # useradd -u 993 -g 990 -s /sbin/nologin foreman
To ensure that the configuration files are accessible, restore the read and execute flags:
# chmod o+rx /etc/dhcp/ # chmod o+r /etc/dhcp/dhcpd.conf # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf
Start the DHCP service:
# systemctl start dhcpd
Export the DHCP configuration and lease files using NFS:
# yum install nfs-utils # systemctl enable rpcbind nfs-server # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd
Create directories for the DHCP configuration and lease files that you want to export using NFS:
# mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp
To create mount points for the created directories, add the following line to the
/etc/fstab
file:/var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0 /etc/dhcp /exports/etc/dhcp none bind,auto 0 0
Mount the file systems in
/etc/fstab
:# mount -a
Ensure the following lines are present in
/etc/exports
:/exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check) /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide) /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)
Note that the IP address that you enter is the Satellite or Capsule IP address that you want to use with an external DHCP service.
Reload the NFS server:
# exportfs -rva
Configure the firewall for the DHCP omapi port 7911:
# firewall-cmd --add-port="7911/tcp" \ && firewall-cmd --runtime-to-permanent
Optional: Configure the firewall for external access to NFS. Clients are configured using NFSv3.
# firewall-cmd --zone public --add-service mountd \ && firewall-cmd --zone public --add-service rpc-bind \ && firewall-cmd --zone public --add-service nfs \ && firewall-cmd --runtime-to-permanent
5.2.2. Configuring Satellite Server with an External DHCP Server
You can configure Satellite Server with an external DHCP server.
Prerequisite
- Ensure that you have configured an external DHCP server and that you have shared the DHCP configuration and lease files with Satellite Server. For more information, see Section 5.2.1, “Configuring an External DHCP Server to Use with Satellite Server”.
Procedure
Install the
nfs-utils
utility:# yum install nfs-utils
Create the DHCP directories for NFS:
# mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd
Change the file owner:
# chown -R foreman-proxy /mnt/nfs
Verify communication with the NFS server and the Remote Procedure Call (RPC) communication paths:
# showmount -e DHCP_Server_FQDN # rpcinfo -p DHCP_Server_FQDN
Add the following lines to the
/etc/fstab
file:DHCP_Server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0 DHCP_Server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0
Mount the file systems on
/etc/fstab
:# mount -a
To verify that the
foreman-proxy
user can access the files that are shared over the network, display the DHCP configuration and lease files:# su foreman-proxy -s /bin/bash bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases bash-4.2$ exit
Enter the
satellite-installer
command to make the following persistent changes to the/etc/foreman-proxy/settings.d/dhcp.yml
file:# satellite-installer --foreman-proxy-dhcp=true \ --foreman-proxy-dhcp-provider=remote_isc \ --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \ --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \ --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \ --foreman-proxy-plugin-dhcp-remote-isc-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== \ --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911 \ --enable-foreman-proxy-plugin-dhcp-remote-isc \ --foreman-proxy-dhcp-server=DHCP_Server_FQDN
Restart the
foreman-proxy
service:# systemctl restart foreman-proxy
- Log in to the Satellite Server web UI.
- Navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.
- Associate the DHCP service with the appropriate subnets and domain.
5.3. Configuring Satellite Server with External TFTP
You can configure Satellite Server with external TFTP services.
Procedure
Create the TFTP directory for NFS:
# mkdir -p /mnt/nfs/var/lib/tftpboot
In the
/etc/fstab
file, add the following line:TFTP_Server_IP_Address:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0
Mount the file systems in
/etc/fstab
:# mount -a
Enter the
satellite-installer
command to make the following persistent changes to the/etc/foreman-proxy/settings.d/tftp.yml
file:# satellite-installer --foreman-proxy-tftp=true \ --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot
If the TFTP service is running on a different server than the DHCP service, update the
tftp_servername
setting with the FQDN or IP address of the server that the TFTP service is running on:# satellite-installer --foreman-proxy-tftp-servername=TFTP_Server_FQDN
- Log in to the Satellite Server web UI.
- Navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.
- Associate the TFTP service with the appropriate subnets and domain.
5.4. Configuring Satellite Server with External IdM DNS
When Satellite Server adds a DNS record for a host, it first determines which Capsule is providing DNS for that domain. It then communicates with the Capsule that is configured to provide DNS service for your deployment and adds the record. The hosts are not involved in this process. Therefore, you must install and configure the IdM client on the Satellite or Capsule that is currently configured to provide a DNS service for the domain you want to manage using the IdM server.
Satellite Server can be configured to use a Red Hat Identity Management (IdM) server to provide DNS service. For more information about Red Hat Identity Management, see the Linux Domain Identity, Authentication, and Policy Guide.
To configure Satellite Server to use a Red Hat Identity Management (IdM) server to provide DNS service, use one of the following procedures:
To revert to internal DNS service, use the following procedure:
You are not required to use Satellite Server to manage DNS. When you are using the realm enrollment feature of Satellite, where provisioned hosts are enrolled automatically to IdM, the ipa-client-install
script creates DNS records for the client. Configuring Satellite Server with external IdM DNS and realm enrollment are mutually exclusive. For more information about configuring realm enrollment, see External Authentication for Provisioned Hosts in Administering Red Hat Satellite.
5.4.1. Configuring Dynamic DNS Update with GSS-TSIG Authentication
You can configure the IdM server to use the generic security service algorithm for secret key transaction (GSS-TSIG) technology defined in RFC3645. To configure the IdM server to use the GSS-TSIG technology, you must install the IdM client on the Satellite Server base operating system.
Prerequisites
- You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide.
- You must contact the IdM server administrator to ensure that you obtain an account on the IdM server with permissions to create zones on the IdM server.
- You must confirm whether Satellite Server or Capsule Server is configured to provide DNS service for your deployment.
- You must configure DNS, DHCP and TFTP services on the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment.
- You must create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see Configuring Satellite Server.
Procedure
To configure dynamic DNS update with GSS-TSIG authentication, complete the following steps:
Creating a Kerberos Principal on the IdM Server
Obtain a Kerberos ticket for the account obtained from the IdM administrator:
# kinit idm_user
Create a new Kerberos principal for Satellite Server to use to authenticate on the IdM server.
# ipa service-add satellite.example.com
Installing and Configuring the IdM Client
On the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment, install the
ipa-client
package:# satellite-maintain packages install ipa-client
Configure the IdM client by running the installation script and following the on-screen prompts:
# ipa-client-install
Obtain a Kerberos ticket:
# kinit admin
Remove any preexisting
keytab
:# rm /etc/foreman-proxy/dns.keytab
Obtain the
keytab
for this system:# ipa-getkeytab -p capsule/satellite.example.com@EXAMPLE.COM \ -s idm1.example.com -k /etc/foreman-proxy/dns.keytab
NoteWhen adding a keytab to a standby system with the same host name as the original system in service, add the
r
option to prevent generating new credentials and rendering the credentials on the original system invalid.For the
dns.keytab
file, set the group and owner toforeman-proxy
:# chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab
Optional: To verify that the
keytab
file is valid, enter the following command:# kinit -kt /etc/foreman-proxy/dns.keytab \ capsule/satellite.example.com@EXAMPLE.COM
Configuring DNS Zones in the IdM web UI
Create and configure the zone that you want to manage:
- Navigate to Network Services > DNS > DNS Zones.
-
Select Add and enter the zone name. For example,
example.com
. - Click Add and Edit.
Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:
grant capsule/047satellite.example.com@EXAMPLE.COM wildcard * ANY;
- Set Dynamic update to True.
- Enable Allow PTR sync.
- Click Save to save the changes.
Create and configure the reverse zone:
- Navigate to Network Services > DNS > DNS Zones.
- Click Add.
- Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups.
- Click Add and Edit.
Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:
grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;
- Set Dynamic update to True.
- Click Save to save the changes.
Configuring the Satellite or Capsule Server that Manages the DNS Service for the Domain
Use the
satellite-installer
command to configure the Satellite or Capsule that manages the DNS Service for the domain:On Satellite, enter the following command:
satellite-installer --scenario satellite \ --foreman-proxy-dns=true \ --foreman-proxy-dns-managed=true \ --foreman-proxy-dns-provider=nsupdate_gss \ --foreman-proxy-dns-server="idm1.example.com" \ --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \ --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \ --foreman-proxy-dns-reverse="55.168.192.in-addr.arpa" \ --foreman-proxy-dns-zone=example.com \ --foreman-proxy-dns-ttl=86400
On Capsule, enter the following command:
satellite-installer --scenario capsule \ --foreman-proxy-dns=true \ --foreman-proxy-dns-managed=true \ --foreman-proxy-dns-provider=nsupdate_gss \ --foreman-proxy-dns-server="idm1.example.com" \ --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \ --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \ --foreman-proxy-dns-reverse="55.168.192.in-addr.arpa" \ --foreman-proxy-dns-zone=example.com \ --foreman-proxy-dns-ttl=86400
Restart the Satellite or Capsule’s Proxy Service.
# systemctl restart foreman-proxy
After you run the satellite-installer
command to make any changes to your Capsule configuration, you must update the configuration of each affected Capsule in the Satellite web UI.
Updating the Configuration in the Satellite web UI
- Navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.
Configure the domain:
- Navigate to Infrastructure > Domains and select the domain name.
- In the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.
Configure the subnet:
- Navigate to Infrastructure > Subnets and select the subnet name.
- In the Subnet tab, set IPAM to None.
- In the Domains tab, select the domain that you want to manage using the IdM server.
- In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
- Click Submit to save the changes.
5.4.2. Configuring Dynamic DNS Update with TSIG Authentication
You can configure an IdM server to use the secret key transaction authentication for DNS (TSIG) technology that uses the rndc.key
key file for authentication. The TSIG protocol is defined in RFC2845.
Prerequisites
- You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide.
-
You must obtain
root
user access on the IdM server. - You must confirm whether Satellite Server or Capsule Server is configured to provide DNS service for your deployment.
- You must configure DNS, DHCP and TFTP services on the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment.
- You must create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see Configuring Satellite Server.
Procedure
To configure dynamic DNS update with TSIG authentication, complete the following steps:
Enabling External Updates to the DNS Zone in the IdM Server
On the IdM Server, add the following to the top of the
/etc/named.conf
file:######################################################################## include "/etc/rndc.key"; controls { inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; }; }; ########################################################################
Reload the
named
service to make the changes take effect:# systemctl reload named
In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes:
Add the following in the
BIND update policy
box:grant "rndc-key" zonesub ANY;
- Set Dynamic update to True.
- Click Update to save the changes.
Copy the
/etc/rndc.key
file from the IdM server to the base operating system of your Satellite Server. Enter the following command:# scp /etc/rndc.key root@satellite.example.com:/etc/rndc.key
To set the correct ownership, permissions, and SELinux context for the
rndc.key
file, enter the following command:# restorecon -v /etc/rndc.key # chown -v root:named /etc/rndc.key # chmod -v 640 /etc/rndc.key
Assign the
foreman-proxy
user to thenamed
group manually. Normally, satellite-installer ensures that theforeman-proxy
user belongs to thenamed
UNIX group, however, in this scenario Satellite does not manage users and groups, therefore you need to assign theforeman-proxy
user to thenamed
group manually.# usermod -a -G named foreman-proxy
On Satellite Server, enter the following
satellite-installer
command to configure Satellite to use the external DNS server:# satellite-installer --scenario satellite \ --foreman-proxy-dns=true \ --foreman-proxy-dns-managed=false \ --foreman-proxy-dns-provider=nsupdate \ --foreman-proxy-dns-server="IdM_Server_IP_Address" \ --foreman-proxy-keyfile=/etc/rndc.key \ --foreman-proxy-dns-ttl=86400
Testing External Updates to the DNS Zone in the IdM Server
Install the
bind-utils
utility:# yum install bind-utils
Ensure that the key in the
/etc/rndc.key
file on Satellite Server is the same key file that is used on the IdM server:key "rndc-key" { algorithm hmac-md5; secret "secret-key=="; };
On Satellite Server, create a test DNS entry for a host. For example, host
test.example.com
with an A record of192.168.25.20
on the IdM server at192.168.25.1
.# echo -e "server 192.168.25.1\n \ update add test.example.com 3600 IN A 192.168.25.20\n \ send\n" | nsupdate -k /etc/rndc.key
On Satellite Server, test the DNS entry:
# nslookup test.example.com 192.168.25.1 Server: 192.168.25.1 Address: 192.168.25.1#53 Name: test.example.com Address: 192.168.25.20
- To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones. Click the name of the zone and search for the host by name.
If resolved successfully, remove the test DNS entry:
# echo -e "server 192.168.25.1\n \ update delete test.example.com 3600 IN A 192.168.25.20\n \ send\n" | nsupdate -k /etc/rndc.key
Confirm that the DNS entry was removed:
# nslookup test.example.com 192.168.25.1
The above
nslookup
command fails and returns theSERVFAIL
error message if the record was successfully deleted.
5.4.3. Reverting to Internal DNS Service
You can revert to using Satellite Server and Capsule Server as your DNS providers. You can use a backup of the answer file that was created before configuring external DNS, or you can create a backup of the answer file. For more information about answer files, see Configuring Satellite Server.
Procedure
On the Satellite or Capsule Server that you want to configure to manage DNS service for the domain, complete the following steps:
Configuring Satellite or Capsule as a DNS Server
If you have created a backup of the answer file before configuring external DNS, restore the answer file and then enter the
satellite-installer
command:# satellite-installer
If you do not have a suitable backup of the answer file, create a backup of the answer file now. To configure Satellite or Capsule as DNS server without using an answer file, enter the following
satellite-installer
command on Satellite and each affected Capsule:# satellite-installer \ --foreman-proxy-dns=true \ --foreman-proxy-dns-managed=true \ --foreman-proxy-dns-provider=nsupdate \ --foreman-proxy-dns-server="127.0.0.1" \ --foreman-proxy-dns-tsig-principal="foremanproxy/satellite.example.com@EXAMPLE.COM" \ --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab
For more information,see Configuring DNS, DHCP, and TFTP on Capsule Server.
After you run the satellite-installer
command to make any changes to your Capsule configuration, you must update the configuration of each affected Capsule in the Satellite web UI.
Updating the Configuration in the Satellite web UI
- Navigate to Infrastructure > Capsules.
- For each Capsule that you want to update, from the Actions list, select Refresh.
Configure the domain:
- Navigate to Infrastructure > Domains and click the domain name that you want to configure.
- In the Domain tab, set DNS Capsule to the Capsule where the subnet is connected.
Configure the subnet:
- Navigate to Infrastructure > Subnets and select the subnet name.
- In the Subnet tab, set IPAM to DHCP or Internal DB.
- In the Domains tab, select the domain that you want to manage using Satellite or Capsule.
- In the Capsules tab, set Reverse DNS Capsule to the Capsule where the subnet is connected.
- Click Submit to save the changes.