Chapter 3. Registering Hosts

Procedure

1. In the Satellite web UI, navigate to Hosts > Provisioning Templates, find the Linux registration default template and click it.
2. Click the Association tab.
3. Ensure that the operating system that you want to register is in the Selected items column.
4. Click Submit.
5. Navigate to Hosts > Operating Systems and click the operating system that you want to register.
6. Click the Templates tab.
7. From the Registration template list, ensure that Linux registration default is selected.
8. Click Submit.
9. Navigate to Hosts > All Hosts > Register Host.

10. Optional: If you want to register hosts through Capsule, ensure that the Registration feature is enabled on this Capsule.

    Navigate to Infrastructure > Capsules, click the Capsule that you want to use, and locate the Registration feature in the Active features list.

    Optional: If the Registration feature is not enabled on your Capsule, enter the following command on the Capsule to enable it:

    # satellite-installer --foreman-proxy-registration \
    --foreman-proxy-templates \
    --foreman-proxy-template-url 'http://capsule.example.com'

11. Optional: From the Host Group list, select the host group to associate the hosts with.
12. From the Operating System list, select the operating system of hosts that you want to register.
13. From the Capsule list, select the Capsule to register hosts through. You must select the internal Capsule if you do not want to use an external Capsule.
14. From the Insights list, select whether you want to register the hosts to Insights or not.
15. From the Remote Execution list, select whether you want to deploy Satellite SSH keys to hosts or not.

16. Optional: Satellite uses the JSON Web Tokens (JWT) for authentication. The duration of this token defines how long the generated curl command works. If you want to change the duration of the token, enter the required duration to the Token lifetime (hours) field. You can set the duration to any number of hours.

    Note that Satellite uses the permissions of the user who generates the curl command for authorization of hosts. If the user loses or gains additional permissions, the permissions of the JWT change too. Therefore, do not delete, block, or change permissions of the user during the token duration.

17. Optional: In the Remote Execution Interface field, enter a network interface that hosts must use for the SSH connection. If you keep this field blank, Satellite uses the default network interface.
18. In the Activation Key(s) field, enter one or more activation keys to assign to hosts.
19. Click Generate command.
20. Copy the generated curl command to enter it on the hosts.

21. Configure hosts with the CA certificate with one of the following methods:

    • Add the --insecure option to the curl command. This makes the first call insecure, however, during this first call, hosts download the CA file from Satellite. Hosts will use this CA file to connect to Satellite with all future calls making them secure.

      If an attacker, located in the network between Satellite and a host, fetches the CA file from the first insecure call, the attacker will be able to access the content of the API calls to and from the registered host and the JWT. Therefore, if you have chosen to deploy SSH keys during registration, the attacker will be able to access the host using the SSH key. The following is an example of the curl command with the --insecure option:

      curl -X GET --insecure https://satellite.example.com/register...

    • If you do not want to call the curl command with the --insecure option, you can manually copy and install the CA file on each host.

      To do this find where Satellite stores the CA file by navigating to Administer > Settings > Authentication and locating the value for the SSL CA file setting.

      Copy the CA file to the /etc/pki/ca-trust/source/anchors/ directory on hosts and enter the following commands:

      # update-ca-trust enable
      # update-ca-trust

22. On the hosts that you want to register, enter the curl command as root.

1. Note the fully qualified domain name (FQDN) of the Satellite Server or Capsule Server, for example server.example.com.

2. Log in to the host as the root user and download the katello-ca-consumer-latest.noarch.rpm package from Satellite Server or Capsule Server to which the host is to be registered. The consumer RPM configures the host to download content from the content source that is specified in Red Hat Satellite.

   # curl --insecure --output katello-ca-consumer-latest.noarch.rpm https://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

3. Install the katello-ca-consumer-latest.noarch.rpm package:

   # yum localinstall katello-ca-consumer-latest.noarch.rpm

   Note

   The RPM package is not signed. If required, you can add the --nosignature option to install the package. The katello-ca-consumer-hostname-1.0-1.noarch.rpm package is an additional katello-ca-consumer RPM that contains the server’s host name. The katello-ca-consumer-latest.noarch.rpm package always reflects the most recent version. Both serve the same purpose.

4. Clear any old host data related to Red Hat Subscription Manager (RHSM):

   # subscription-manager clean

5. Register the host using RHSM:

   # subscription-manager register --org=your_org_name \
   --activationkey=your_activation_key

   Example 3.1. Command Output after Registration:

   # subscription-manager register --org=MyOrg --activationkey=TestKey-1
   The system has been registered with id: 62edc0f8-855b-4184-b1b8-72a9dc793b96

Procedure

1. Log in to the Atomic Host as the root user.

2. Retrieve katello-rhsm-consumer from Satellite Server:

   # wget http://satellite.example.com/pub/katello-rhsm-consumer

3. Change the mode of katello-rhsm-consumer to make it executable:

   # chmod +x katello-rhsm-consumer

4. Run katello-rhsm-consumer:

   # ./katello-rhsm-consumer

   Register with Red Hat Subscription Manager:

   # subscription-manager register

1. Manually create a directory and change the owner:

   # mkdir /etc/puppetlabs/code/environments/example_environment
   # chown apache /etc/puppetlabs/code/environments/example_environment

2. Navigate to Configure > Environments and click Import environment from. The button name includes the FQDN of the internal or external Capsule.
3. Choose the created directory and click Update.

Procedure

1. Log in to the host as the root user.

2. Download the script:

   # curl -O http://satellite.example.com/pub/bootstrap.py

3. Make the script executable:

   # chmod +x bootstrap.py

4. Confirm that the script is executable by viewing the help text:

   • On Red Hat Enterprise Linux 8:

     # /usr/libexec/platform-python bootstrap.py -h

   • On other Red Hat Enterprise Linux versions:

     # ./bootstrap.py -h

5. Enter the bootstrap command with values suitable for your environment.

   For the --server option, specify the FQDN of Satellite Server or a Capsule Server. For the --location, --organization, and --hostgroup options, use quoted names, not labels, as arguments to the options. See Section 3.4.2, “Advanced Bootstrap Script Configuration” for advanced use cases.

   • On Red Hat Enterprise Linux 8, enter the following command:

     # /usr/libexec/platform-python bootstrap.py \
     --login=admin \
     --server satellite.example.com \
     --location="Example Location" \
     --organization="Example Organization" \
     --hostgroup="Example Host Group" \
     --activationkey=activation_key

   • On Red Hat Enterprise Linux 5, 6, or 7, enter the following command:

     # ./bootstrap.py --login=admin \
     --server satellite.example.com \
     --location="Example Location" \
     --organization="Example Organization" \
     --hostgroup="Example Host Group" \
     --activationkey=activation_key

6. Enter the password of the Satellite user you specified with the --login option.

   The script sends notices of progress to stdout.

7. When prompted by the script, approve the host’s Puppet certificate. In the Satellite web UI, navigate to Infrastructure > Capsules and find the Satellite or Capsule Server you specified with the --server option.
8. From the list in the Actions column, select Certificates.
9. In the Actions column, click Sign to approve the host’s Puppet certificate.
10. Return to the host to see the remainder of the bootstrap process completing.
11. In the Satellite web UI, navigate to Hosts > All hosts and ensure that the host is connected to the correct host group.

12. Optional: After the host registration is complete, remove the script:

    # rm bootstrap.py

1. Install the katello-agent package:

   # yum install katello-agent

2. Start the goferd service :

   # systemctl start goferd

Procedure

1. On the content host, install the katello-host-tools-tracer RPM package:

   # yum install katello-host-tools-tracer

2. Enter the following command:

   # katello-tracer-upload

3. In the Satellite web UI, navigate to Hosts > All hosts, then click the required host name.
4. In the Properties tab, examine the Properties table and find the Traces item. If you cannot find a Traces item in the Properties table, then Tracer is not installed.
5. Navigate to Hosts > Content Hosts, then click the required host name.
6. Click the Traces tab to view Traces.

Procedure

1. Log in to the host as the root user.

2. Install the Puppet agent package:

   # yum install puppet-agent

3. Configure the Puppet agent to start on boot:

   • On Red Hat Enterprise Linux 6:

     # chkconfig puppet on

   • On Red Hat Enterprise Linux 7:

     # systemctl enable puppet

4. Append the following server and environment settings to the /etc/puppetlabs/puppet/puppet.conf file. Set the environment parameter to the name of the Puppet environment to which the host belongs:

   environment = My_Example_Org_Library
   server = satellite.example.com
   ca_server = satellite.example.com

5. Run the Puppet agent on the host:

   # puppet agent -t

6. In the Satellite web UI, navigate to Infrastructure > Capsules.
7. From the list in the Actions column for the required Capsule Server, select Certificates.
8. Click Sign to the right of the required host to sign the SSL certificate for the Puppet client.

9. Enter the puppet agent command again:

   # puppet agent -t