Chapter 3. Performing Additional Configuration on Satellite Server

Procedure

1. Navigate to the Red Hat Customer Portal at https://access.redhat.com/ and log in.
2. In the upper left of the window, click Downloads.
3. To the right of Red Hat Enterprise Linux 7, click Versions 7 and below.
4. From the Version list, select the required version of the Red Hat Enterprise Linux 7, for example 7.7.
5. In the Download Red Hat Enterprise Linux window, locate the binary DVD version of the ISO image, for example, Red Hat Enterprise Linux 7.7 Binary DVD, and click Download Now.
6. When the download completes, copy the ISO image to Satellite Server.

7. On Satellite Server, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop rhel-binary-dvd.iso /mnt/iso

   Copy to Clipboard Toggle word wrap

8. Create Kickstart directories:

   # mkdir --parents \
   /var/www/html/pub/sat-import/content/dist/rhel/server/7/7.7/x86_64/kickstart/

   Copy to Clipboard Toggle word wrap

9. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/* /var/www/html/pub/sat-import/content/dist/rhel/server/7/7.7/x86_64/kickstart/

   Copy to Clipboard Toggle word wrap

10. Add the following entries to the listing files:

    To the /var/www/html/pub/sat-import/content/dist/rhel/server/7/listing file, append the version number with a new line. For example, for the RHEL 7.7 ISO, append 7.7.

    To the /var/www/html/pub/sat-import/content/dist/rhel/server/7/7.7/listing file, append the architecture with a new line. For example, x86_64.

    To the /var/www/html/pub/sat-import/content/dist/rhel/server/7/7.7/x86_64/listing file, append kickstart with a new line.

11. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo \
    /var/www/html/pub/sat-import/content/dist/rhel/server/7/7.7/x86_64/kickstart/treeinfo

    Copy to Clipboard Toggle word wrap

12. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso
    # rmdir /mnt/iso

    Copy to Clipboard Toggle word wrap
13. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. Navigate to the Red Hat Customer Portal at https://access.redhat.com/ and log in.
2. In the upper left of the window, click Downloads.
3. Click Red Hat Enterprise Linux 8.
4. In the Download Red Hat Enterprise Linux window, locate the binary DVD version of the ISO image, for example, Red Hat Enterprise Linux 8.1 Binary DVD, and click Download Now.
5. When the download completes, copy the ISO image to Satellite Server.

6. On Satellite Server, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop rhel-binary-dvd.iso /mnt/iso

   Copy to Clipboard Toggle word wrap

7. Create directories for Red Hat Enterprise Linux 8 AppStream and BaseOS Kickstart repositories:

   # mkdir --parents \
   /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart
   
   # mkdir --parents \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

   Copy to Clipboard Toggle word wrap

8. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/AppStream/* \
   /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart
   
   # cp -a /mnt/iso/BaseOS/* /mnt/iso/images/ \
   /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

   Copy to Clipboard Toggle word wrap

   Note that for BaseOS, you must also copy the contents of the /mnt/iso/images/ directory.

9. Add the following entries to the listing files:

   To the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/listing file, append kickstart with a new line.

   To the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/listing file, append kickstart with a new line:

   To the /var/www/html/pub/sat-import/content/dist/rhel8/listing file, append the version number with a new line. For example, for the RHEL 8.1 binary ISO, append 8.1.

10. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo
    
    # cp /mnt/iso/.treeinfo \
    /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo

    Copy to Clipboard Toggle word wrap
11. Open the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file for editing.

12. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variant = AppStream to variant = BaseOS
    • Change variants = AppStream,BaseOS to variants = BaseOS
13. In the [tree] section, change variants = AppStream,BaseOS to variants = BaseOS.

14. In the [variant-BaseOS] section, make the following changes:

    • Change packages = BaseOS/Packages to packages = Packages
    • Change repository = BaseOS to repository = .
15. Delete the [media] and [variant-AppStream] sections.
16. Save and close the file.

17. Verify that the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file has the following format:

    [checksums]
    images/efiboot.img = sha256:9ad9beee4c906cd05d227a1be7a499c8d2f20b3891c79831325844c845262bb6
    images/install.img = sha256:e246bf4aedfff3bb54ae9012f959597cdab7387aadb3a504f841bdc2c35fe75e
    images/pxeboot/initrd.img = sha256:a66e3c158f02840b19c372136a522177a2ab4bd91cb7269fb5bfdaaf7452efef
    images/pxeboot/vmlinuz = sha256:789028335b64ddad343f61f2abfdc9819ed8e9dfad4df43a2694c0a0ba780d16
    
    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 8.1.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = BaseOS
    variants = BaseOS
    version = 8.1.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [images-x86_64]
    efiboot.img = images/efiboot.img
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [images-xen]
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 8.1.0
    
    [stage2]
    mainimage = images/install.img
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = BaseOS
    
    [variant-BaseOS]
    id = BaseOS
    name = BaseOS
    packages = Packages
    repository = .
    type = variant
    uid = BaseOS

    Copy to Clipboard Toggle word wrap
18. Open the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file for editing.

19. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variants = AppStream,BaseOS to variants = AppStream
20. In the [tree] section, change variants = AppStream,BaseOS to variants = AppStream

21. In the [variant-AppStream] section, make the following changes:

    • Change packages = AppStream/Packages to packages = Packages
    • Change repository = AppStream to repository = .
22. Delete the following sections from the file: [checksums], [images-x86_64], [images-xen], [media], [stage2], [variant-BaseOS].
23. Save and close the file.

24. Verify that the /var/www/html/pub/sat-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file has the following format:

    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 8.1.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = AppStream
    variants = AppStream
    version = 8.1.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 8.1.0
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = AppStream
    
    [variant-AppStream]
    id = AppStream
    name = AppStream
    packages = Packages
    repository = .
    type = variant
    uid = AppStream

    Copy to Clipboard Toggle word wrap

25. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso
    # rmdir /mnt/iso

    Copy to Clipboard Toggle word wrap
26. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user.

   # mkdir /root/satellite_cert

   Copy to Clipboard Toggle word wrap

2. Create a private key with which to sign the Certificate Signing Request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Satellite Server, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

   Copy to Clipboard Toggle word wrap

3. Create the /root/satellite_cert/openssl.cnf configuration file for the Certificate Signing Request (CSR) and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   x509_extensions = usr_cert
   prompt = no
   
   [ req_distinguished_name ] 

   1

   
   C  = Country Name (2 letter code)
   ST = State or Province Name (full name)
   L  = Locality Name (eg, city)
   O  = Organization Name (eg, company)
   OU = The division of your organization handling the certificate
   CN = satellite.example.com 

   2

   
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   subjectAltName = @alt_names
   
   [ usr_cert ]
   basicConstraints=CA:FALSE
   nsCertType = client, server, email
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   nsComment = "OpenSSL Generated Certificate"
   subjectKeyIdentifier=hash
   authorityKeyIdentifier=keyid,issuer
   
   [ alt_names ]
   DNS.1 = satellite.example.com 

   3

   Copy to Clipboard Toggle word wrap

   1

   In the [ req_distinguished_name ] section, enter information about your organization.

   2

   Set the certificate’s Common Name CN to match the fully qualified domain name (FQDN) of your Satellite Server. To confirm a FQDN, on that Satellite Server, enter the hostname -f command. This is required to ensure that the katello-certs-check command validates the certificate correctly.

   3

   Set the Subject Alternative Name (SAN) DNS.1 to match the fully qualified domain name (FQDN) of your server.

4. Generate the Certificate Signing Request (CSR):

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \ 

   1

   
   -config /root/satellite_cert/openssl.cnf \ 

   2

   
   -out /root/satellite_cert/satellite_cert_csr.pem 

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to the private key.

   2

   Path to the configuration file.

   3

   Path to the CSR to generate.

5. Send the certificate signing request to the Certificate Authority. The same Certificate Authority must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the Certificate Authority for the preferred method. In response to the request, you can expect to receive a Certificate Authority bundle and a signed certificate, in separate files.

Procedure

1. Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server.

   # katello-certs-check \
   -c /root/satellite_cert/satellite_cert.pem \      

   1

   
   -k /root/satellite_cert/satellite_cert_key.pem \  

   2

   
   -b /root/satellite_cert/ca_cert_bundle.pem        

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to Satellite Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign Satellite Server certificate.

   3

   Path to the Certificate Authority bundle.

   If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to Satellite Server.

   To install the Red Hat Satellite Server with the custom certificates, run:

     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite.example.com_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite.example.com_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/CA-Chain.pem"

   Copy to Clipboard Toggle word wrap

   To update the certificates on a currently running Satellite installation, run:

     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite.example.com_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite.example.com_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/CA-Chain.pem" \
       --certs-update-server \
       --certs-update-server-ca

   Copy to Clipboard Toggle word wrap

2. Depending on your requirements, enter the satellite-installer command that installs a new Satellite Server with custom SSL certificates or updates certificates on a currently running Satellite Server. The output of the katello-certs-check command may not be accurate in some cases. Therefore, you must follow the steps mentioned above instead of the command outputs.

   If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates.

   Important

   Do not delete the certificate archive file after you deploy the certificate. It is required, for example, when upgrading Satellite Server.

3. On a computer with network access to Satellite Server, navigate to the following URL: \https://satellite.example.com.
4. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'
   # subscription-manager repos --enable=rhel-server-rhscl-7-rpms \
   --enable=rhel-7-server-rpms --enable=rhel-7-server-satellite-6.10-rpms

   Copy to Clipboard Toggle word wrap

Procedure

1. To install PostgreSQL, enter the following command:

   # yum install rh-postgresql12-postgresql-server \
   rh-postgresql12-syspaths \
   rh-postgresql12-postgresql-evr

   Copy to Clipboard Toggle word wrap

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

   Copy to Clipboard Toggle word wrap

3. Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf file:

   # vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/postgresql.conf

   Copy to Clipboard Toggle word wrap

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

   Copy to Clipboard Toggle word wrap

5. Edit the /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf file:

   # vi /var/opt/rh/rh-postgresql12/lib/pgsql/data/pg_hba.conf

   Copy to Clipboard Toggle word wrap

6. Add the following line to the file:

     host  all   all   Satellite_ip/24   md5

   Copy to Clipboard Toggle word wrap

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl start postgresql
   # systemctl enable postgresql

   Copy to Clipboard Toggle word wrap

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql
   # firewall-cmd --runtime-to-permanent

   Copy to Clipboard Toggle word wrap

9. Switch to the postgres user and start the PostgreSQL client:

   $ su - postgres -c psql

   Copy to Clipboard Toggle word wrap

10. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;
    CREATE DATABASE pulpcore OWNER pulp;

    Copy to Clipboard Toggle word wrap

11. Exit the postgres user:

    # \q

    Copy to Clipboard Toggle word wrap

12. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
    # PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

    Copy to Clipboard Toggle word wrap

Procedure

1. To configure the external databases for Satellite, enter the following command:

   satellite-installer --scenario satellite \
     --foreman-db-host postgres.example.com \
     --foreman-db-password Foreman_Password \
     --foreman-db-database foreman \
     --foreman-db-manage false \
     --katello-candlepin-db-host postgres.example.com \
     --katello-candlepin-db-name candlepin \
     --katello-candlepin-db-password Candlepin_Password \
     --katello-candlepin-manage-db false \
     --foreman-proxy-content-pulpcore-manage-postgresql false \
     --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \
     --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \
     --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password
     --foreman-proxy-content-pulpcore-postgresql-user pulp

   Copy to Clipboard Toggle word wrap

   To enable the Secure Sockets Layer (SSL) protocol for these external databases, add the following options:

   --foreman-db-sslmode verify-full
   --foreman-db-root-cert <path_to_CA>
   --katello-candlepin-db-ssl true
   --katello-candlepin-db-ssl-verify true
   --foreman-proxy-content-pulpcore-postgresql-ssl true
   --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA>

   Copy to Clipboard Toggle word wrap