Installing Satellite Server from a Connected Network

Procedure

1. Enter the following command with any additional options that you want to use:

   # satellite-installer --scenario satellite \
   --foreman-initial-organization "initial_organization_name" \
   --foreman-initial-location "initial_location_name" \
   --foreman-initial-admin-username admin_user_name \
   --foreman-initial-admin-password admin_password

   Copy to Clipboard Toggle word wrap

   The script displays its progress and writes logs to /var/log/foreman-installer/satellite.log.

Procedure

1. Copy the default answer file /etc/foreman-installer/scenarios.d/satellite-answers.yaml to a location on your local file system.

   # cp /etc/foreman-installer/scenarios.d/satellite-answers.yaml \
   /etc/foreman-installer/scenarios.d/my-answer-file.yaml

   Copy to Clipboard Toggle word wrap
2. To view all of the configurable options, enter the satellite-installer --scenario satellite --help command.
3. Open your copy of the answer file, edit the values to suit your environment, and save the file.

4. Open the /etc/foreman-installer/scenarios.d/satellite.yaml file and edit the answer file entry to point to your custom answer file.

   :answer_file: /etc/foreman-installer/scenarios.d/my-answer-file.yaml

   Copy to Clipboard Toggle word wrap

5. Run the satellite-installer script.

   # satellite-installer --scenario satellite

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Satellite web UI, navigate to Infrastructure > HTTP Proxies.
2. Click New HTTP Proxy.
3. In the Name field, enter the name for the HTTP proxy.
4. In the Url field, enter the URL of the HTTP proxy in the following format: https://proxy.example.com:8080.
5. Optional: If authentication is required, in the Username field, enter the username to authenticate with.
6. Optional: If authentication is required, in the Password field, enter the password to authenticate with.
7. To test connection to the proxy, click the Test Connection button.
8. Click Submit.
9. Navigate to Administer > Settings, and click the Content tab.
10. Set the Default HTTP Proxy setting to the created HTTP proxy.

For CLI Users

1. Verify that the http_proxy, https_proxy, and no_proxy variables are not set.

   # unset http_proxy
   # unset https_proxy
   # unset no_proxy

   Copy to Clipboard Toggle word wrap

2. Add an HTTP proxy entry to Satellite:

   # hammer http-proxy create --name=myproxy \
   --url http://myproxy.example.com:8080  \
   --username=proxy_username \
   --password=proxy_password

   Copy to Clipboard Toggle word wrap

3. Configure Satellite to use this HTTP proxy by default:

   # hammer settings set --name=content_default_http_proxy --value=myproxy

   Copy to Clipboard Toggle word wrap

Procedure

1. On the network gateway and the HTTP Proxy, enable TCP for the following host names:

   Expand

   Host name	Port	Protocol
   subscription.rhsm.redhat.com	443	HTTPS
   cdn.redhat.com	443	HTTPS
   *.akamaiedge.net	443	HTTPS
   cert-api.access.redhat.com (if using Red Hat Insights)	443	HTTPS
   api.access.redhat.com (if using Red Hat Insights)	443	HTTPS

   Show more

   Satellite Server uses SSL to communicate with the Red Hat CDN securely. Use of an SSL interception proxy interferes with this communication. These hosts must be whitelisted on the proxy.

   For a list of IP addresses used by the Red Hat CDN (cdn.redhat.com), see the Knowledgebase article Public CIDR Lists for Red Hat on the Red Hat Customer Portal.

2. On Satellite Server, complete the following details in the /etc/rhsm/rhsm.conf file:

   # an http proxy server to use (enter server FQDN)
   proxy_hostname = myproxy.example.com
   
   # port for http proxy server
   proxy_port = 8080
   
   # user name for authenticating to an http proxy, if needed
   proxy_user =
   
   # password for basic http proxy auth, if needed
   proxy_password =

   Copy to Clipboard Toggle word wrap

Procedure

1. On Satellite, to verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows:

   # semanage port -l | grep http_cache
   http_cache_port_t       tcp    8080, 8118, 8123, 10001-10010
   [output truncated]

   Copy to Clipboard Toggle word wrap

2. To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows:

   # semanage port -a -t http_cache_port_t -p tcp 8088

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy row, select the adjacent Value column and enter the proxy URL.
3. Click the tick icon to save your changes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. In the HTTP(S) proxy except hosts row, select the adjacent Value column and enter the names of one or more hosts that you want to exclude from proxy requests.
3. Click the tick icon to save your changes.

Procedure

1. Navigate to Administer > Settings, and click the Content tab.
2. Set the Default HTTP Proxy setting to no global default.

1. To store all the source certificate files, create a directory that is accessible only to the root user.

   # mkdir /root/satellite_cert

   Copy to Clipboard Toggle word wrap

2. Create a private key with which to sign the Certificate Signing Request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Satellite Server, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

   Copy to Clipboard Toggle word wrap

3. Create the /root/satellite_cert/openssl.cnf configuration file for the Certificate Signing Request (CSR) and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   x509_extensions = usr_cert
   prompt = no
   
   [ req_distinguished_name ] 

   1

   
   C  = Country Name (2 letter code)
   ST = State or Province Name (full name)
   L  = Locality Name (eg, city)
   O  = Organization Name (eg, company)
   OU = The division of your organization handling the certificate
   CN = satellite.example.com 

   2

   
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   subjectAltName = @alt_names
   
   [ usr_cert ]
   basicConstraints=CA:FALSE
   nsCertType = client, server, email
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   nsComment = "OpenSSL Generated Certificate"
   subjectKeyIdentifier=hash
   authorityKeyIdentifier=keyid,issuer
   
   [ alt_names ]
   DNS.1 = satellite.example.com 

   3

   Copy to Clipboard Toggle word wrap

   1

   In the [ req_distinguished_name ] section, enter information about your organization.

   2

   Set the certificate’s Common Name CN to match the fully qualified domain name (FQDN) of your Satellite Server. To confirm a FQDN, on that Satellite Server, enter the hostname -f command. This is required to ensure that the katello-certs-check command validates the certificate correctly.

   3

   Set the Subject Alternative Name (SAN) DNS.1 to match the fully qualified domain name (FQDN) of your server.

4. Generate the Certificate Signing Request (CSR):

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \ 

   1

   
   -config /root/satellite_cert/openssl.cnf \ 

   2

   
   -out /root/satellite_cert/satellite_cert_csr.pem 

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to the private key.

   2

   Path to the configuration file.

   3

   Path to the CSR to generate.

5. Send the certificate signing request to the Certificate Authority. The same Certificate Authority must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the Certificate Authority for the preferred method. In response to the request, you can expect to receive a Certificate Authority bundle and a signed certificate, in separate files.

1. Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server.

   # katello-certs-check \
   -c /root/satellite_cert/satellite_cert.pem \      

   1

   
   -k /root/satellite_cert/satellite_cert_key.pem \  

   2

   
   -b /root/satellite_cert/ca_cert_bundle.pem        

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to the Satellite Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign the Capsule Server certificate.

   3

   Path to the Certificate Authority bundle.

   If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to Satellite Server.

   Example output of katello-certs-check

   Validation succeeded.
   
   To install the Red Hat Satellite Server with the custom certificates, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem"
   
   To update the certificates on a currently running Red Hat Satellite installation, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem" \
       --certs-update-server --certs-update-server-ca

   Copy to Clipboard Toggle word wrap

2. From the output of the katello-certs-check command, depending on your requirements, enter the satellite-installer command that installs a new Satellite with custom SSL certificates or updates certificates on a currently running Satellite.

   If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates.

   重要

   Do not delete the certificate archive file after you deploy the certificate. It is required, for example, when upgrading Satellite Server.

3. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com.
4. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'
   # subscription-manager repos --enable=rhel-server-rhscl-7-rpms \
   --enable=rhel-7-server-rpms --enable=rhel-7-server-satellite-6.8-rpms

   Copy to Clipboard Toggle word wrap

Procedure

1. To install MongoDB, enter the following command:

   # yum install rh-mongodb34 rh-mongodb34-syspaths

   Copy to Clipboard Toggle word wrap

2. Start and enable the rh-mongodb34 service:

   # systemctl start rh-mongodb34-mongod
   # systemctl enable rh-mongodb34-mongod

   Copy to Clipboard Toggle word wrap

3. Create a Pulp user on MongoDB for database pulp_database:

   # mongo pulp_database \
   --eval "db.createUser({user:'pulp',pwd:'pulp_password',roles:[{role:'dbOwner', db:'pulp_database'},{ role: 'readWrite', db: 'pulp_database'}]})"

   Copy to Clipboard Toggle word wrap

4. In the /etc/opt/rh/rh-mongodb34/mongod.conf file, specify the bind IP:

   bindIp: your_mongodb_server_bind_IP,::1

   Copy to Clipboard Toggle word wrap

5. Edit the /etc/opt/rh/rh-mongodb34/mongod.conf file to enable authentication in the security section:

   security:
     authorization: enabled

   Copy to Clipboard Toggle word wrap

6. Restart the rh-mongodb34-mongod service:

   # systemctl restart rh-mongodb34-mongod

   Copy to Clipboard Toggle word wrap

7. Open port 27017 for MongoDB:

   # firewall-cmd --add-port=27017/tcp
   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

8. From Satellite Server, test that you can access the database. If the connection succeeds, the command returns 1.

   # scl enable rh-mongodb34 " mongo --host mongo.example.com \
   -u pulp -p pulp_password --port 27017 --eval 'ping:1' pulp_database"

   Copy to Clipboard Toggle word wrap

Procedure

1. To install PostgreSQL, enter the following command:

   # yum install rh-postgresql12-postgresql-server \
   rh-postgresql12-syspaths \
   rh-postgresql12-postgresql-evr

   Copy to Clipboard Toggle word wrap

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

   Copy to Clipboard Toggle word wrap

3. Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf file:

   # vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf

   Copy to Clipboard Toggle word wrap

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

   Copy to Clipboard Toggle word wrap

5. Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf file:

   # vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf

   Copy to Clipboard Toggle word wrap

6. Add the following line to the file:

     host  all   all   Satellite_ip/24   md5

   Copy to Clipboard Toggle word wrap

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl start postgresql
   # systemctl enable postgresql

   Copy to Clipboard Toggle word wrap

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql
   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

9. Switch to the postgres user and start the PostgreSQL client:

   $ su - postgres -c psql

   Copy to Clipboard Toggle word wrap

10. Create two databases and dedicated roles, one for Satellite and one for Candlepin:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;

    Copy to Clipboard Toggle word wrap

11. Exit the postgres user:

    # \q

    Copy to Clipboard Toggle word wrap

12. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"

    Copy to Clipboard Toggle word wrap

Procedure

1. To configure the external databases for Satellite, enter the following command:

   satellite-installer --scenario satellite \
     --foreman-db-host postgres.example.com \
     --foreman-db-password Foreman_Password \
     --foreman-db-database foreman \
     --katello-candlepin-db-host postgres.example.com \
     --katello-candlepin-db-name candlepin \
     --katello-candlepin-db-password Candlepin_Password \
     --katello-candlepin-manage-db false \
     --katello-pulp-db-username pulp \
     --katello-pulp-db-password pulp_password \
     --katello-pulp-db-seeds mongo.example.com:27017 \
     --katello-pulp-db-name pulp_database

   Copy to Clipboard Toggle word wrap

2. Verify the status of the databases:

   • For PostgreSQL, enter the following command:

     # satellite-maintain service status --only postgresql

     Copy to Clipboard Toggle word wrap

   • For MongoDB, enter the following command:

     # satellite-maintain service status --only rh-mongodb34-mongod

     Copy to Clipboard Toggle word wrap

Procedure

1. On a Red Hat Enterprise Linux Server server, install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) packages:

   # yum install dhcp bind

   Copy to Clipboard Toggle word wrap

2. Generate a security token:

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   Copy to Clipboard Toggle word wrap

   As a result, a key pair that consists of two files is created in the current directory.

3. Copy the secret hash from the key:

   # cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2

   Copy to Clipboard Toggle word wrap

4. Edit the dhcpd configuration file for all of the subnets and add the key. The following is an example:

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm HMAC-MD5;
   	secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw==";
   };
   omapi-key omapi_key;

   Copy to Clipboard Toggle word wrap

   Note that the option routers value is the Satellite or Capsule IP address that you want to use with an external DHCP service.

5. Delete the two key files from the directory that they were created in.

6. On Satellite Server, define each subnet. Do not set DHCP Capsule for the defined Subnet yet.

   To prevent conflicts, set up the lease and reservation ranges separately. For example, if the lease range is 192.168.38.10 to 192.168.38.100, in the Satellite web UI define the reservation range as 192.168.38.101 to 192.168.38.250.

7. Configure the firewall for external access to the DHCP server:

   # firewall-cmd --add-service dhcp \
   && firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

8. On Satellite Server, determine the UID and GID of the foreman user:

   # id -u foreman
   993
   # id -g foreman
   990

   Copy to Clipboard Toggle word wrap

9. On the DHCP server, create the foreman user and group with the same IDs as determined in a previous step:

   # groupadd -g 990 foreman
   # useradd -u 993 -g 990 -s /sbin/nologin foreman

   Copy to Clipboard Toggle word wrap

10. To ensure that the configuration files are accessible, restore the read and execute flags:

    # chmod o+rx /etc/dhcp/
    # chmod o+r /etc/dhcp/dhcpd.conf
    # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

    Copy to Clipboard Toggle word wrap

11. Start the DHCP service:

    # systemctl start dhcpd

    Copy to Clipboard Toggle word wrap

12. Export the DHCP configuration and lease files using NFS:

    # yum install nfs-utils
    # systemctl enable rpcbind nfs-server
    # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd

    Copy to Clipboard Toggle word wrap

13. Create directories for the DHCP configuration and lease files that you want to export using NFS:

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

    Copy to Clipboard Toggle word wrap

14. To create mount points for the created directories, add the following line to the /etc/fstab file:

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

    Copy to Clipboard Toggle word wrap

15. Mount the file systems in /etc/fstab:

    # mount -a

    Copy to Clipboard Toggle word wrap

16. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)
    
    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)
    
    /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

    Copy to Clipboard Toggle word wrap

    Note that the IP address that you enter is the Satellite or Capsule IP address that you want to use with an external DHCP service.

17. Reload the NFS server:

    # exportfs -rva

    Copy to Clipboard Toggle word wrap

18. Configure the firewall for the DHCP omapi port 7911:

    # firewall-cmd --add-port="7911/tcp" \
    && firewall-cmd --runtime-to-permanent

    Copy to Clipboard Toggle word wrap

19. Optional: Configure the firewall for external access to NFS. Clients are configured using NFSv3.

    # firewall-cmd --zone public --add-service mountd \
    && firewall-cmd --zone public --add-service rpc-bind \
    && firewall-cmd --zone public --add-service nfs \
    && firewall-cmd --runtime-to-permanent

    Copy to Clipboard Toggle word wrap

Procedure

1. Install the nfs-utils utility:

   # yum install nfs-utils

   Copy to Clipboard Toggle word wrap

2. Create the DHCP directories for NFS:

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

   Copy to Clipboard Toggle word wrap

3. Change the file owner:

   # chown -R foreman-proxy /mnt/nfs

   Copy to Clipboard Toggle word wrap

4. Verify communication with the NFS server and the Remote Procedure Call (RPC) communication paths:

   # showmount -e DHCP_Server_FQDN
   # rpcinfo -p DHCP_Server_FQDN

   Copy to Clipboard Toggle word wrap

5. Add the following lines to the /etc/fstab file:

   DHCP_Server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0
   
   DHCP_Server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

   Copy to Clipboard Toggle word wrap

6. Mount the file systems on /etc/fstab:

   # mount -a

   Copy to Clipboard Toggle word wrap

7. To verify that the foreman-proxy user can access the files that are shared over the network, display the DHCP configuration and lease files:

   # su foreman-proxy -s /bin/bash
   bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   bash-4.2$ exit

   Copy to Clipboard Toggle word wrap

8. Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file:

   # satellite-installer --foreman-proxy-dhcp=true \
   --foreman-proxy-dhcp-provider=remote_isc \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911 \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-server=DHCP_Server_FQDN

   Copy to Clipboard Toggle word wrap

9. Restart the foreman-proxy service:

   # systemctl restart foreman-proxy

   Copy to Clipboard Toggle word wrap
10. Log in to the Satellite Server web UI.
11. Navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.
12. Associate the DHCP service with the appropriate subnets and domain.

Creating a Kerberos Principal on the IdM Server

1. Obtain a Kerberos ticket for the account obtained from the IdM administrator:

   # kinit idm_user

   Copy to Clipboard Toggle word wrap

2. Create a new Kerberos principal for Satellite Server to use to authenticate on the IdM server.

   # ipa service-add satellite.example.com

   Copy to Clipboard Toggle word wrap

Installing and Configuring the IdM Client

1. On the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment, install the ipa-client package:

   # satellite-maintain packages install ipa-client

   Copy to Clipboard Toggle word wrap

2. Configure the IdM client by running the installation script and following the on-screen prompts:

   # ipa-client-install

   Copy to Clipboard Toggle word wrap

3. Obtain a Kerberos ticket:

   # kinit admin

   Copy to Clipboard Toggle word wrap

4. Remove any preexisting keytab:

   # rm /etc/foreman-proxy/dns.keytab

   Copy to Clipboard Toggle word wrap

5. Obtain the keytab for this system:

   # ipa-getkeytab -p capsule/satellite.example.com@EXAMPLE.COM \
   -s idm1.example.com -k /etc/foreman-proxy/dns.keytab

   Copy to Clipboard Toggle word wrap
   注記

   When adding a keytab to a standby system with the same host name as the original system in service, add the r option to prevent generating new credentials and rendering the credentials on the original system invalid.

6. For the dns.keytab file, set the group and owner to foreman-proxy:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab

   Copy to Clipboard Toggle word wrap

7. Optional: To verify that the keytab file is valid, enter the following command:

   # kinit -kt /etc/foreman-proxy/dns.keytab \
   capsule/satellite.example.com@EXAMPLE.COM

   Copy to Clipboard Toggle word wrap

Configuring DNS Zones in the IdM web UI

1. Create and configure the zone that you want to manage:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Select Add and enter the zone name. For example, example.com.
   3. Click Add and Edit.

   4. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule/047satellite.example.com@EXAMPLE.COM wildcard * ANY;

      Copy to Clipboard Toggle word wrap
   5. Set Dynamic update to True.
   6. Enable Allow PTR sync.
   7. Click Save to save the changes.

2. Create and configure the reverse zone:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Click Add.
   3. Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups.
   4. Click Add and Edit.

   5. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

      Copy to Clipboard Toggle word wrap
   6. Set Dynamic update to True.
   7. Click Save to save the changes.

Configuring the Satellite or Capsule Server that Manages the DNS Service for the Domain

1. Use the satellite-installer command to configure the Satellite or Capsule that manages the DNS Service for the domain:

   • On Satellite, enter the following command:

     satellite-installer --scenario satellite \
     --foreman-proxy-dns=true \
     --foreman-proxy-dns-managed=true \
     --foreman-proxy-dns-provider=nsupdate_gss \
     --foreman-proxy-dns-server="idm1.example.com" \
     --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \
     --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \
     --foreman-proxy-dns-reverse="55.168.192.in-addr.arpa" \
     --foreman-proxy-dns-zone=example.com \
     --foreman-proxy-dns-ttl=86400

     Copy to Clipboard Toggle word wrap

   • On Capsule, enter the following command:

     satellite-installer --scenario capsule \
     --foreman-proxy-dns=true \
     --foreman-proxy-dns-managed=true \
     --foreman-proxy-dns-provider=nsupdate_gss \
     --foreman-proxy-dns-server="idm1.example.com" \
     --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \
     --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \
     --foreman-proxy-dns-reverse="55.168.192.in-addr.arpa" \
     --foreman-proxy-dns-zone=example.com \
     --foreman-proxy-dns-ttl=86400

     Copy to Clipboard Toggle word wrap

2. Restart the Satellite or Capsule’s Proxy Service.

   # systemctl restart foreman-proxy

   Copy to Clipboard Toggle word wrap

Updating the Configuration in the Satellite web UI

1. Navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.

2. Configure the domain:

   1. Navigate to Infrastructure > Domains and select the domain name.
   2. In the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

3. Configure the subnet:

   1. Navigate to Infrastructure > Subnets and select the subnet name.
   2. In the Subnet tab, set IPAM to None.
   3. In the Domains tab, select the domain that you want to manage using the IdM server.
   4. In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.

Enabling External Updates to the DNS Zone in the IdM Server

1. On the IdM Server, add the following to the top of the /etc/named.conf file:

   EmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmpty include "/etc/rndc.key"; controls { inet IdM_Server_IP_Address port 953 allow { Satellite_IP_Address; } keys { "rndc-key"; }; }; EmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmptyEmpty

   Copy to Clipboard Toggle word wrap

2. Reload the named service to make the changes take effect:

   # systemctl reload named

   Copy to Clipboard Toggle word wrap

3. In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes:

   1. Add the following in the BIND update policy box:

      grant "rndc-key" zonesub ANY;

      Copy to Clipboard Toggle word wrap
   2. Set Dynamic update to True.
   3. Click Update to save the changes.

4. Copy the /etc/rndc.key file from the IdM server to the base operating system of your Satellite Server. Enter the following command:

   # scp /etc/rndc.key root@satellite.example.com:/etc/rndc.key

   Copy to Clipboard Toggle word wrap

5. To set the correct ownership, permissions, and SELinux context for the rndc.key file, enter the following command:

   # restorecon -v /etc/rndc.key
   # chown -v root:named /etc/rndc.key
   # chmod -v 640 /etc/rndc.key

   Copy to Clipboard Toggle word wrap

6. Assign the foreman-proxy user to the named group manually. Normally, satellite-installer ensures that the foreman-proxy user belongs to the named UNIX group, however, in this scenario Satellite does not manage users and groups, therefore you need to assign the foreman-proxy user to the named group manually.

   # usermod -a -G named foreman-proxy

   Copy to Clipboard Toggle word wrap

7. On Satellite Server, enter the following satellite-installer command to configure Satellite to use the external DNS server:

   # satellite-installer --scenario satellite \
   --foreman-proxy-dns=true \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="IdM_Server_IP_Address" \
   --foreman-proxy-keyfile=/etc/rndc.key \
   --foreman-proxy-dns-ttl=86400

   Copy to Clipboard Toggle word wrap

Testing External Updates to the DNS Zone in the IdM Server

1. Install the bind-utils utility:

   # yum install bind-utils

   Copy to Clipboard Toggle word wrap

2. Ensure that the key in the /etc/rndc.key file on Satellite Server is the same key file that is used on the IdM server:

   key "rndc-key" {
           algorithm hmac-md5;
           secret "secret-key==";
   };

   Copy to Clipboard Toggle word wrap

3. On Satellite Server, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1.

   # echo -e "server 192.168.25.1\n \
   update add test.example.com 3600 IN A 192.168.25.20\n \
   send\n" | nsupdate -k /etc/rndc.key

   Copy to Clipboard Toggle word wrap

4. On Satellite Server, test the DNS entry:

   # nslookup test.example.com 192.168.25.1
   Server:		192.168.25.1
   Address:	192.168.25.1#53
   
   Name:	test.example.com
   Address: 192.168.25.20

   Copy to Clipboard Toggle word wrap
5. To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones. Click the name of the zone and search for the host by name.

6. If resolved successfully, remove the test DNS entry:

   # echo -e "server 192.168.25.1\n \
   update delete test.example.com 3600 IN A 192.168.25.20\n \
   send\n" | nsupdate -k /etc/rndc.key

   Copy to Clipboard Toggle word wrap

7. Confirm that the DNS entry was removed:

   # nslookup test.example.com 192.168.25.1

   Copy to Clipboard Toggle word wrap

   The above nslookup command fails and returns the SERVFAIL error message if the record was successfully deleted.

Updating the Configuration in the Satellite web UI

1. Navigate to Infrastructure > Capsules.
2. For each Capsule that you want to update, from the Actions list, select Refresh.

3. Configure the domain:

   1. Navigate to Infrastructure > Domains and click the domain name that you want to configure.
   2. In the Domain tab, set DNS Capsule to the Capsule where the subnet is connected.

4. Configure the subnet:

   1. Navigate to Infrastructure > Subnets and select the subnet name.
   2. In the Subnet tab, set IPAM to DHCP or Internal DB.
   3. In the Domains tab, select the domain that you want to manage using Satellite or Capsule.
   4. In the Capsules tab, set Reverse DNS Capsule to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.