Chapter 2. Configuring DHCP integration

Procedure

1. Create a security token:

   # tsig-keygen -a Algorithm_Name My_Key_Name

   Use the following values in the command:

   Algorithm_Name

   Specifies the algorithm to be used to generate the key. You can use any of the values specified in the tsig-keygen(8) man page on your system. The default algorithm is HMAC-SHA256.

   My_Key_Name

   Specifies the name of the OMAPI key. The default name is tsig-key.

   The command outputs key information in the following format:

   key "My_Key_Name" {
   	algorithm Algorithm_Name;
   	secret "Key_Secret";
   };

2. Edit the /etc/dhcp/dhcpd.conf file, and append the following settings:

   key "My_Key_Name" {
   	algorithm Algorithm_Name;
   	secret "Key_Secret";
   };
   omapi-port 7911;
   omapi-key My_Key_Name;

   The settings specified in the example include the following:

   key "My_Key_Name"

   Defines the key, its algorithm and encrypted password. Use the output of the tsig-keygen command for this directive.

   omapi-port 7911

   Enables the OMAPI protocol in ISC DHCP and defines the port of the protocol.

   omapi-key My_Key_Name

   Defines the name of the key the OMAPI interface uses. The name must match the one you specified in the tsig-keygen command.

3. Restart the dhcpd service:

   # systemctl restart dhcpd

4. Open the OMAPI port in the firewalld service:

   # firewall-cmd --add-port=7911/tcp

5. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. On Satellite Server, determine both the UID and the primary GID of the foreman-proxy user:

   # id -u foreman-proxy
   # id -g foreman-proxy

   You require these IDs in the next steps.

2. On the DHCP server, share the configuration of the DHCP service and lease database over NFS:

   1. Create the foreman-proxy group with the same group ID as on the Satellite Server:

      # groupadd -g My_User_ID foreman-proxy

   2. Create the foreman-proxy user with the same user ID and primary group ID as on the Satellite Server:

      # useradd -u My_User_ID -g My_Group_ID -s /sbin/nologin foreman-proxy

   3. Ensure that members of the foreman-proxy group can access the configuration file of the DHCP service:

      # chgrp -R foreman-proxy /etc/dhcp/
      # chmod g+rx /etc/dhcp/
      # chmod g+r /etc/dhcp/dhcpd.conf

   4. Install the nfs-server package:

      # dnf install nfs-utils

   5. Edit the /etc/exports file, and append share entries for the /etc/dhcp/ and /var/lib/dhcpd/ directories:

      /etc/dhcp        satellite.example.com(ro)
      /var/lib/dhcpd   satellite.example.com(ro)

      Share the directories in read-only mode and only with the Satellite Server or Capsule Server.

   6. Enable and start the NFS server service:

      # systemctl enable --now nfs-server

   7. Open the NFSv4 port in the firewalld service:

      # firewall-cmd --add-service=nfs

   8. Make the changes persistent:

      # firewall-cmd --runtime-to-permanent

Procedure

1. Install the required package:

   # satellite-maintain packages install nfs-utils

2. Create the directories into which you later mount the NFS shares:

   # mkdir -p \
   /srv/nfs/etc/dhcp \
   /srv/nfs/var/lib/dhcpd

3. Edit the /etc/fstab file, and add entries for the NFS shares to mount them automatically when the system boots:

   dhcp_server_fqdn:/etc/dhcp       /srv/nfs/etc/dhcp       nfs  ro,auto,context="system_u:object_r:dhcp_etc_t:s0"     0 0
   dhcp_server_fqdn:/var/lib/dhcpd  /srv/nfs/var/lib/dhcpd  nfs  ro,auto,context="system_u:object_r:dhcpd_state_t:s0"  0 0

4. Reload systemd so that this service uses the updated /etc/fstab file:

   # systemctl daemon-reload

5. Mount the NFS shares:

   # mount /srv/nfs/etc/dhcp/
   # mount /srv/nfs/var/lib/dhcpd/

6. Verify that the foreman-proxy user can access the files on the NFS server. For example:

   1. Display the first 5 lines of the /srv/nfs/etc/dhcp/dhcpd.conf file:

      $ su - foreman-proxy -c 'head -5 /srv/nfs/etc/dhcp/dhcpd.conf'

   2. Display the first 5 lines of the /srv/nfs/var/lib/dhcpd/dhcpd.leases file:

      $ su - foreman-proxy -c 'head -5 /srv/nfs/var/lib/dhcpd/dhcpd.leases'

7. Configure Satellite Server or Capsule Server to use the DHCP server:

   # satellite-installer \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-provider remote_isc \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-server dhcp_server_fqdn \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /srv/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /srv/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret key_secret \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port 7911

8. For each affected Capsule, update the configuration of that Capsule in the Satellite web UI. For more information, see Section 2.5, “Associating the DHCP service with a subnet”.