Chapter 4. Performing Additional Configuration on Satellite Server

Procedure

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories.
3. Click Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs) or Red Hat Satellite Client 6 for RHEL 8 x86_64 (RPMs) to expand the repository set.

4. For the x86_64 architecture, click the + icon to enable the repository.

   If the Red Hat Satellite Client 6 items are not visible, it may be because they are not included in the Red Hat Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Red Hat Subscription Manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing Content.

   Enable the Red Hat Satellite Client 6 repository for every supported major version of Red Hat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created.

Procedure

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories.

3. In the Available Repositories pane, click on Red Hat Satellite Client 6 (for RHEL 7 Server) (RPMs) or Red Hat Satellite Client 6 (for RHEL 6 Server - ELS) (RPMs) to expand the repository set.

   If the Red Hat Satellite Client 6 items are not visible, it may be because they are not included in the Red Hat Subscription Manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Red Hat Subscription Manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing Content.

4. For the x86_64 architecture, click the + icon to enable the repository. Enable the Red Hat Satellite Client 6 repository for every supported major version of Red Hat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created.

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the Red Hat Enterprise Linux for x86_64 product to view available content.
3. Select Red Hat Satellite Client 6 for RHEL 9 x86_64 RPMs or Red Hat Satellite Client 6 for RHEL 8 x86_64 RPMs whichever is applicable.
4. Click Synchronize Now.

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the Red Hat Enterprise Linux Server or Red Hat Enterprise Linux Server - Extended Lifecycle Support whichever product is applicable to view available content.
3. Select Red Hat Satellite Client 6 (for RHEL 7 Server) RPMs x86_64 or Red Hat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64 based on your operating system version.
4. Click Synchronize Now.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > HTTP Proxies.
2. Click New HTTP Proxy.
3. In the Name field, enter the name for the HTTP proxy.
4. In the Url field, enter the URL of the HTTP proxy in the following format: https://proxy.example.com:8080.
5. Optional: If authentication is required, in the Username field, enter the username to authenticate with.
6. Optional: If authentication is required, in the Password field, enter the password to authenticate with.
7. To test connection to the proxy, click Test Connection.
8. Click Submit.
9. In the Satellite web UI, navigate to Administer > Settings, and click the Content tab.
10. Set the Default HTTP Proxy setting to the created HTTP proxy.

CLI procedure

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # unset http_proxy
   # unset https_proxy
   # unset no_proxy

   Copy to Clipboard Toggle word wrap

2. Add an HTTP proxy entry to Satellite:

   # hammer http-proxy create --name=myproxy \
   --url http://myproxy.example.com:8080  \
   --username=proxy_username \
   --password=proxy_password

   Copy to Clipboard Toggle word wrap

3. Configure Satellite to use this HTTP proxy by default:

   # hammer settings set --name=content_default_http_proxy --value=myproxy

   Copy to Clipboard Toggle word wrap

Procedure

1. On Satellite, to verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

   Copy to Clipboard Toggle word wrap

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy row, select the adjacent Value column and enter the proxy URL.
3. Click the tick icon to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy except hosts row, select the adjacent Value column and enter the names of one or more hosts that you want to exclude from proxy requests.
3. Click the tick icon to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings, and click the Content tab.
2. Set the Default HTTP Proxy setting to no global default.

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/satellite_cert

   Copy to Clipboard Toggle word wrap

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Satellite Server, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

   Copy to Clipboard Toggle word wrap

3. Create the /root/satellite_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   CN = satellite.example.com
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth, clientAuth
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = satellite.example.com

   Copy to Clipboard Toggle word wrap

   For more information about the [ v3_req ] parameters and their purpose, see RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.

4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = satellite.example.com
   countryName =My_Country_Name 

   1

   
   stateOrProvinceName = My_State_Or_Province_Name 

   2

   
   localityName = My_Locality_Name 

   3

   
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name 

   4

   Copy to Clipboard Toggle word wrap

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

5. Generate CSR:

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \ 

   1

   
   -config /root/satellite_cert/openssl.cnf \ 

   2

   
   -out /root/satellite_cert/satellite_cert_csr.pem 

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Verification

1. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com.
2. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'
   # subscription-manager repos \
   --enable=satellite-6.14-for-rhel-8-x86_64-rpms \
   --enable=satellite-maintenance-6.14-for-rhel-8-x86_64-rpms \
   --enable=rhel-8-for-x86_64-baseos-rpms \
   --enable=rhel-8-for-x86_64-appstream-rpms

   Copy to Clipboard Toggle word wrap

3. Enable the following modules:

   # dnf module enable satellite:el8

   Copy to Clipboard Toggle word wrap
   Note

   Enablement of the module satellite:el8 warns about a conflict with postgresql:10 and ruby:2.5 as these modules are set to the default module versions on Red Hat Enterprise Linux 8. The module satellite:el8 has a dependency for the modules postgresql:12 and ruby:2.7 that will be enabled with the satellite:el8 module. These warnings do not cause installation process failure, hence can be ignored safely. For more information about modules and lifecycle streams on Red Hat Enterprise Linux 8, see Red Hat Enterprise Linux Application Streams Lifecycle.

Procedure

1. To install PostgreSQL, enter the following command:

   # dnf install postgresql-server postgresql-evr postgresql-contrib

   Copy to Clipboard Toggle word wrap

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

   Copy to Clipboard Toggle word wrap

3. Edit the /var/lib/pgsql/data/postgresql.conf file:

   # vi /var/lib/pgsql/data/postgresql.conf

   Copy to Clipboard Toggle word wrap

   Note that the default configuration of external PostgreSQL needs to be adjusted to work with Satellite. The base recommended external database configuration adjustments are as follows:

   • checkpoint_completion_target: 0.9
   • max_connections: 500
   • shared_buffers: 512MB
   • work_mem: 4MB

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

   Copy to Clipboard Toggle word wrap

5. Edit the /var/lib/pgsql/data/pg_hba.conf file:

   # vi /var/lib/pgsql/data/pg_hba.conf

   Copy to Clipboard Toggle word wrap

6. Add the following line to the file:

     host  all   all   Satellite_ip/32   md5

   Copy to Clipboard Toggle word wrap

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl enable --now postgresql

   Copy to Clipboard Toggle word wrap

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql
   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

9. Switch to the postgres user and start the PostgreSQL client:

   $ su - postgres -c psql

   Copy to Clipboard Toggle word wrap

10. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;
    CREATE DATABASE pulpcore OWNER pulp;

    Copy to Clipboard Toggle word wrap

11. Connect to the Pulp database:

    postgres=# \c pulpcore
    You are now connected to database "pulpcore" as user "postgres".

    Copy to Clipboard Toggle word wrap

12. Create the hstore extension:

    pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore";
    CREATE EXTENSION

    Copy to Clipboard Toggle word wrap

13. Exit the postgres user:

    # \q

    Copy to Clipboard Toggle word wrap

14. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
    # PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

    Copy to Clipboard Toggle word wrap

Procedure

1. To configure the external databases for Satellite, enter the following command:

   # satellite-installer --scenario satellite \
   --foreman-db-database foreman \
   --foreman-db-host postgres.example.com \
   --foreman-db-manage false \
   --foreman-db-password Foreman_Password \
   --foreman-proxy-content-pulpcore-manage-postgresql false \
   --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \
   --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \
   --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password \
   --foreman-proxy-content-pulpcore-postgresql-user pulp \
   --katello-candlepin-db-host postgres.example.com \
   --katello-candlepin-db-name candlepin \
   --katello-candlepin-db-password Candlepin_Password \
   --katello-candlepin-manage-db false

   Copy to Clipboard Toggle word wrap

   To enable the Secure Sockets Layer (SSL) protocol for these external databases, add the following options:

   --foreman-db-root-cert <path_to_CA>
   --foreman-db-sslmode verify-full
   --foreman-proxy-content-pulpcore-postgresql-ssl true
   --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA>
   --katello-candlepin-db-ssl true
   --katello-candlepin-db-ssl-ca <path_to_CA>
   --katello-candlepin-db-ssl-verify true

   Copy to Clipboard Toggle word wrap