Installing Satellite Server in a disconnected network environment

Procedure

1. For a new installation, install fapolicyd:

   # dnf install fapolicyd

2. For an existing installation, install fapolicyd using satellite-maintain packages install:

   # satellite-maintain packages install fapolicyd

3. Start the fapolicyd service:

   # systemctl enable --now fapolicyd

Procedure

1. Enter the following command with any additional options that you want to use:

   # satellite-installer --scenario satellite \
   --foreman-initial-organization "My_Organization" \
   --foreman-initial-location "My_Location" \
   --foreman-initial-admin-username admin_user_name \
   --foreman-initial-admin-password admin_password

   The script displays its progress and writes logs to /var/log/foreman-installer/satellite.log.

2. Unmount the ISO images:

   # umount /media/sat6
   # umount /media/rhel8

Procedure

1. In the Satellite web UI, navigate to Content > Subscriptions.
2. Click Manage Manifest.
3. Switch to the CDN Configuration tab.
4. Select the Export Sync tab.
5. Click Update.

CLI procedure

1. Log in to your Satellite Server by using SSH.

2. Set CDN configuration to sync by using exports:

   # hammer organization configure-cdn --name="My_Organization" --type=export_sync

Procedure

1. Navigate to Content > Subscriptions.
2. Click Manage Manifest.
3. Navigate to the CDN Configuration tab.
4. Select the Network Sync tab.
5. In the URL field, enter the address of the upstream Satellite Server.
6. In the Username, enter your username for upstream login.
7. In the Password, enter your password or personal access token for upstream login.
8. In the Organization label field, enter the label of the upstream organization.
9. Optional: In the Lifecycle Environment Label field, enter the label of the upstream lifecycle environment. Default is Library.
10. Optional: In the Content view label field, enter the label of the upstream content view. Default is Default_Organization_View.
11. From the SSL CA Content Credential menu, select a CA certificate used by the upstream Satellite Server.
12. Click Update.
13. In the Satellite web UI, navigate to Content > Products.
14. Select the product that contains the repositories that you want to synchronize.

15. From the Select Action menu, select Sync Now to synchronize all repositories within the product.

    You can also create a synchronization plan to ensure updates on a regular basis. For more information, see Creating a Synchronization Plan in Managing content.

CLI procedure

1. Connect to your downstream Satellite Server using SSH.

2. View information about the upstream CA certificate:

   # hammer content-credential show \
   --name="My_Upstream_CA_Cert" \
   --organization="My_Downstream_Organization"

   Note the ID of the CA certificate for the next step.

3. Set CDN configuration to an upstream Satellite Server:

   # hammer organization configure-cdn --name="My_Downstream_Organization" \
   --type=network_sync \
   --url https://upstream-satellite.example.com \
   --username upstream_username --password upstream_password \
   --ssl-ca-credential-id "My_Upstream_CA_Cert_ID" \ --upstream-organization-label="_My_Upstream_Organization" \
   [--upstream-lifecycle-environment-label="My_Lifecycle_Environment"] \
   [--upstream-content-view-label="My_Content_View"]

   The default lifecycle environment label is Library. The default content view label is Default_Organization_View.

Procedure

1. Navigate to the Red Hat Customer Portal at access.redhat.com/downloads and log in.
2. Click Red Hat Enterprise Linux.
3. Select a product variant and a product version from the list. For example, product variant Red Hat Enterprise Linux for x86_64 and product version 9.0.
4. Locate the full installation image, for example, Red Hat Enterprise Linux 9.0 Binary DVD, and click Download Now. Note that you cannot provision hosts using the minimal ISO.
5. When the download completes, copy the ISO image to Satellite Server.

6. On Satellite Server, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop rhel-binary-dvd.iso /mnt/iso

   Replace rhel-binary-dvd.iso with the name of your ISO image.

7. Create directories for Red Hat Enterprise Linux 9 AppStream and BaseOS Kickstart repositories:

   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart
   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart

8. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/AppStream/* /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart
   # cp -a /mnt/iso/BaseOS/* /mnt/iso/images/ /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart

   Note that for BaseOS, you must also copy the contents of the /mnt/iso/images/ directory.

9. Add the following entries to the listing files:

   To the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/listing file, append the version number with a new line. For example, for the Red Hat Enterprise Linux 9.0 binary ISO, append 9.0.

10. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart/treeinfo
    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart/treeinfo

11. Open the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart/treeinfo file for editing.

12. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variant = AppStream to variant = BaseOS
    • Change variants = AppStream,BaseOS to variants = BaseOS
13. In the [tree] section, change variants = AppStream,BaseOS to variants = BaseOS.

14. In the [variant-BaseOS] section, make the following changes:

    • Change packages = BaseOS/Packages to packages = Packages
    • Change repository = BaseOS to repository = .
15. Delete the [media] and [variant-AppStream] sections.
16. Save and close the file.

17. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart/treeinfo file has the following format:

    [checksums]
    images/efiboot.img = sha256:c01c18acc6778d6e66c8d0872bac59bfd7219ccf3cfa70a5c605c0fb37f33a83
    images/install.img = sha256:ddd08e5a5d92edee150f91ff4f12f39253eae72ff496465cf1b2766fe4a4df49
    images/pxeboot/initrd.img = sha256:a09a8ec89d485d71ed1bdad83584d6d816e67448221172d9aad97886cd70adca
    images/pxeboot/vmlinuz = sha256:6e523d7c3266e26c695923ab12b2873b16b0c61fb2e48ade608ad8998821584b
    
    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 9.0.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = BaseOS
    variants = BaseOS
    version = 9.0.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [images-x86_64]
    efiboot.img = images/efiboot.img
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [images-xen]
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 9.0.0
    
    [stage2]
    mainimage = images/install.img
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = BaseOS
    
    [variant-BaseOS]
    id = BaseOS
    name = BaseOS
    packages = Packages
    repository = .
    type = variant
    uid = BaseOS

18. Open the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart/treeinfo file for editing.

19. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variants = AppStream,BaseOS to variants = AppStream
20. In the [tree] section, change variants = AppStream,BaseOS to variants = AppStream

21. In the [variant-AppStream] section, make the following changes:

    • Change packages = AppStream/Packages to packages = Packages
    • Change repository = AppStream to repository = .
22. Delete the following sections from the file: [checksums], [images-x86_64], [images-xen], [media], [stage2], [variant-BaseOS].
23. Save and close the file.

24. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart/treeinfo file has the following format:

    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 9.0.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = AppStream
    variants = AppStream
    version = 9.0.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 9.0.0
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = AppStream
    
    [variant-AppStream]
    id = AppStream
    name = AppStream
    packages = Packages
    repository = .
    type = variant
    uid = AppStream

25. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso
    # rmdir /mnt/iso

26. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. Navigate to the Red Hat Customer Portal at access.redhat.com/downloads and log in.
2. Click Red Hat Enterprise Linux.
3. Select a product variant and a product version from the list. For example, product variant Red Hat Enterprise Linux for x86_64 and product version 8.1.
4. Locate the full installation image, for example, Red Hat Enterprise Linux 8.1 Binary DVD, and click Download Now.
5. When the download completes, copy the ISO image to Satellite Server.

6. On Satellite Server, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop rhel-binary-dvd.iso /mnt/iso

   Replace rhel-binary-dvd.iso with the name of your ISO image.

7. Create directories for Red Hat Enterprise Linux 8 AppStream and BaseOS Kickstart repositories:

   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart
   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

8. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/AppStream/* /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart
   # cp -a /mnt/iso/BaseOS/* /mnt/iso/images/ /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

   Note that for BaseOS, you must also copy the contents of the /mnt/iso/images/ directory.

9. Add the following entries to the listing files:

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/listing file, append the version number with a new line. For example, for the Red Hat Enterprise Linux 8.1 binary ISO, append 8.1.

10. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo
    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo

11. Open the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file for editing.

12. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variant = AppStream to variant = BaseOS
    • Change variants = AppStream,BaseOS to variants = BaseOS
13. In the [tree] section, change variants = AppStream,BaseOS to variants = BaseOS.

14. In the [variant-BaseOS] section, make the following changes:

    • Change packages = BaseOS/Packages to packages = Packages
    • Change repository = BaseOS to repository = .
15. Delete the [media] and [variant-AppStream] sections.
16. Save and close the file.

17. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file has the following format:

    [checksums]
    images/efiboot.img = sha256:c01c18acc6778d6e66c8d0872bac59bfd7219ccf3cfa70a5c605c0fb37f33a83
    images/install.img = sha256:ddd08e5a5d92edee150f91ff4f12f39253eae72ff496465cf1b2766fe4a4df49
    images/pxeboot/initrd.img = sha256:a09a8ec89d485d71ed1bdad83584d6d816e67448221172d9aad97886cd70adca
    images/pxeboot/vmlinuz = sha256:6e523d7c3266e26c695923ab12b2873b16b0c61fb2e48ade608ad8998821584b
    
    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 8.1.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = BaseOS
    variants = BaseOS
    version = 8.1.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [images-x86_64]
    efiboot.img = images/efiboot.img
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [images-xen]
    initrd = images/pxeboot/initrd.img
    kernel = images/pxeboot/vmlinuz
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 8.1.0
    
    [stage2]
    mainimage = images/install.img
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = BaseOS
    
    [variant-BaseOS]
    id = BaseOS
    name = BaseOS
    packages = Packages
    repository = .
    type = variant
    uid = BaseOS

18. Open the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file for editing.

19. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variants = AppStream,BaseOS to variants = AppStream
20. In the [tree] section, change variants = AppStream,BaseOS to variants = AppStream

21. In the [variant-AppStream] section, make the following changes:

    • Change packages = AppStream/Packages to packages = Packages
    • Change repository = AppStream to repository = .
22. Delete the following sections from the file: [checksums], [images-x86_64], [images-xen], [media], [stage2], [variant-BaseOS].
23. Save and close the file.

24. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file has the following format:

    [general]
    ; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.
    ; WARNING.1 = Read productmd documentation for details about new format.
    arch = x86_64
    family = Red Hat Enterprise Linux
    name = Red Hat Enterprise Linux 8.1.0
    packagedir = Packages
    platforms = x86_64,xen
    repository = .
    timestamp = 1571146127
    variant = AppStream
    variants = AppStream
    version = 8.1.0
    
    [header]
    type = productmd.treeinfo
    version = 1.2
    
    [release]
    name = Red Hat Enterprise Linux
    short = RHEL
    version = 8.1.0
    
    [tree]
    arch = x86_64
    build_timestamp = 1571146127
    platforms = x86_64,xen
    variants = AppStream
    
    [variant-AppStream]
    id = AppStream
    name = AppStream
    packages = Packages
    repository = .
    type = variant
    uid = AppStream

25. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso
    # rmdir /mnt/iso

26. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. Navigate to the Red Hat Customer Portal at access.redhat.com/downloads and log in.
2. Click Red Hat Enterprise Linux.
3. Click Switch to version 7 and below above the Product Variant list.
4. Select a product variant and a product version from the list. For example, product variant Red Hat Enterprise Linux for x86_64 and product version 7.9.
5. Locate the full installation image, for example, Red Hat Enterprise Linux 7.9 Binary DVD, and click Download Now.
6. When the download completes, copy the ISO image to Satellite Server.

7. On Satellite Server, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso
   # mount -o loop rhel-binary-dvd.iso /mnt/iso

   Replace rhel-binary-dvd.iso with the name of your ISO image.

8. Create Kickstart directories:

   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/kickstart/

9. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/* /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/kickstart/

10. Add the following entries to the listing files:

    To the /var/www/html/pub/satellite-import/content/dist/rhel/server/7/listing file, append the version number with a new line. For example, for the Red Hat Enterprise Linux 7.9 ISO, append 7.9.

    To the /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/listing file, append the architecture with a new line. For example, x86_64.

    To the /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/listing file, append kickstart with a new line.

11. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/kickstart/treeinfo

12. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso
    # rmdir /mnt/iso

13. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the Red Hat Enterprise Linux for x86_64 product to view available content.
3. Select Red Hat Satellite Client 6 for RHEL 9 x86_64 RPMs or Red Hat Satellite Client 6 for RHEL 8 x86_64 RPMs.
4. Click Synchronize Now.

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the Red Hat Enterprise Linux Server or Red Hat Enterprise Linux Server - Extended Lifecycle Support.
3. Select Red Hat Satellite Client 6 (for RHEL 7 Server) RPMs x86_64 or Red Hat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64 based on your operating system version.
4. Click Synchronize Now.

Procedure

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories.
3. Click Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs) or Red Hat Satellite Client 6 for RHEL 8 x86_64 (RPMs) to expand the repository set.

4. For the x86_64 architecture, click the + icon to enable the repository.

   If the Red Hat Satellite Client 6 items are not visible, it may be because they are not included in the Red Hat subscription manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Red Hat subscription manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing content.

   Enable the Red Hat Satellite Client 6 repository for every supported major version of Red Hat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created.

Procedure

1. On Satellite Server, enter the following command:

   # satellite-installer --foreman-proxy-dhcp false \
   --foreman-proxy-dns false \
   --foreman-proxy-tftp false

2. In the Satellite web UI, navigate to Infrastructure > Subnets and select a subnet.
3. Click the Capsules tab and clear the DHCP Capsule, TFTP Capsule, and Reverse DNS Capsule fields.
4. In the Satellite web UI, navigate to Infrastructure > Domains and select a domain.
5. Clear the DNS Capsule field.

6. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP address of Satellite or Capsule
   Option 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/satellite_cert

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Satellite Server, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

3. Create the /root/satellite_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   commonName = satellite.example.com
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = satellite.example.com

4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = satellite.example.com
   countryName =My_Country_Name 1
   stateOrProvinceName = My_State_Or_Province_Name 2
   localityName = My_Locality_Name 3
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name 4

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

5. Generate CSR:

   # openssl req -new \
   -key /root/satellite_cert/satellite_cert_key.pem \ 1
   -config /root/satellite_cert/openssl.cnf \ 2
   -out /root/satellite_cert/satellite_cert_csr.pem 3

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Procedure

1. Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server.

   # katello-certs-check \
   -c /root/satellite_cert/satellite_cert.pem \      1
   -k /root/satellite_cert/satellite_cert_key.pem \  2
   -b /root/satellite_cert/ca_cert_bundle.pem        3

   1

   Path to Satellite Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign Satellite Server certificate.

   3

   Path to the Certificate Authority bundle.

   If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to Satellite Server.

   Example output of katello-certs-check

   Validation succeeded.
   
   To install the Red Hat Satellite Server with the custom certificates, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem"
   
   To update the certificates on a currently running Red Hat Satellite installation, run:
   
     satellite-installer --scenario satellite \
       --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
       --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \
       --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem" \
       --certs-update-server --certs-update-server-ca

   Note that you must not access or modify /root/ssl-build.

2. From the output of the katello-certs-check command, depending on your requirements, enter the satellite-installer command that installs a new Satellite with custom SSL certificates or updates certificates on a currently running Satellite.

   If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates.

   Important

   satellite-installer needs the certificate archive file after you deploy the certificate. Do not modify or delete it. It is required, for example, when upgrading Satellite Server.

3. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com.
4. In your browser, view the certificate details to verify the deployed certificate.

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'
   # subscription-manager repos \
   --enable=satellite-6.15-for-rhel-8-x86_64-rpms \
   --enable=satellite-maintenance-6.15-for-rhel-8-x86_64-rpms \
   --enable=rhel-8-for-x86_64-baseos-rpms \
   --enable=rhel-8-for-x86_64-appstream-rpms

3. Enable the following module:

   # dnf module enable satellite:el8

   Note

   Enablement of the module satellite:el8 warns about a conflict with postgresql:10 and ruby:2.5 as these modules are set to the default module versions on Red Hat Enterprise Linux 8. The module satellite:el8 has a dependency for the modules postgresql:12 and ruby:2.7 that will be enabled with the satellite:el8 module. These warnings do not cause installation process failure, hence can be ignored safely. For more information about modules and lifecycle streams on Red Hat Enterprise Linux 8, see Red Hat Enterprise Linux Application Streams Lifecycle.

Procedure

1. To install PostgreSQL, enter the following command:

   # dnf install postgresql-server postgresql-evr postgresql-contrib

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

3. Edit the /var/lib/pgsql/data/postgresql.conf file:

   # vi /var/lib/pgsql/data/postgresql.conf

   Note that the default configuration of external PostgreSQL needs to be adjusted to work with Satellite. The base recommended external database configuration adjustments are as follows:

   • checkpoint_completion_target: 0.9
   • max_connections: 500
   • shared_buffers: 512MB
   • work_mem: 4MB

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

5. Edit the /var/lib/pgsql/data/pg_hba.conf file:

   # vi /var/lib/pgsql/data/pg_hba.conf

6. Add the following line to the file:

     host  all   all   Satellite_ip/32   md5

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl enable --now postgresql

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql

9. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

10. Switch to the postgres user and start the PostgreSQL client:

    $ su - postgres -c psql

11. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';
    CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';
    CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';
    CREATE DATABASE foreman OWNER foreman;
    CREATE DATABASE candlepin OWNER candlepin;
    CREATE DATABASE pulpcore OWNER pulp;

12. Connect to the Pulp database:

    postgres=# \c pulpcore
    You are now connected to database "pulpcore" as user "postgres".

13. Create the hstore extension:

    pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore";
    CREATE EXTENSION

14. Exit the postgres user:

    # \q

15. From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com  -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"
    # PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"
    # PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

Procedure

1. To configure the external databases for Satellite, enter the following command:

   # satellite-installer \
   --foreman-db-database foreman \
   --foreman-db-host postgres.example.com \
   --foreman-db-manage false \
   --foreman-db-password Foreman_Password \
   --foreman-proxy-content-pulpcore-manage-postgresql false \
   --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \
   --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \
   --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password \
   --foreman-proxy-content-pulpcore-postgresql-user pulp \
   --katello-candlepin-db-host postgres.example.com \
   --katello-candlepin-db-name candlepin \
   --katello-candlepin-db-password Candlepin_Password \
   --katello-candlepin-manage-db false

   To enable the Secure Sockets Layer (SSL) protocol for these external databases, add the following options:

   --foreman-db-root-cert <path_to_CA>
   --foreman-db-sslmode verify-full
   --foreman-proxy-content-pulpcore-postgresql-ssl true
   --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA>
   --katello-candlepin-db-ssl true
   --katello-candlepin-db-ssl-ca <path_to_CA>
   --katello-candlepin-db-ssl-verify true

Procedure

1. On your Red Hat Enterprise Linux host, install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) utilities packages:

   # dnf install dhcp-server bind-utils

2. Generate a security token:

   # tsig-keygen -a hmac-md5 omapi_key

3. Edit the dhcpd configuration file for all subnets and add the key generated by tsig-keygen. The following is an example:

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm hmac-md5;
   	secret "My_Secret";
   };
   omapi-key omapi_key;

   Note that the option routers value is the IP address of your Satellite Server or Capsule Server that you want to use with an external DHCP service.

4. On Satellite Server, define each subnet. Do not set DHCP Capsule for the defined Subnet yet.

   To prevent conflicts, set up the lease and reservation ranges separately. For example, if the lease range is 192.168.38.10 to 192.168.38.100, in the Satellite web UI define the reservation range as 192.168.38.101 to 192.168.38.250.

5. Configure the firewall for external access to the DHCP server:

   # firewall-cmd --add-service dhcp

6. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

7. On Satellite Server, determine the UID and GID of the foreman user:

   # id -u foreman
   993
   # id -g foreman
   990

8. On the DHCP server, create the foreman user and group with the same IDs as determined in a previous step:

   # groupadd -g 990 foreman
   # useradd -u 993 -g 990 -s /sbin/nologin foreman

9. To ensure that the configuration files are accessible, restore the read and execute flags:

   # chmod o+rx /etc/dhcp/
   # chmod o+r /etc/dhcp/dhcpd.conf
   # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

10. Enable and start the DHCP service:

    # systemctl enable --now dhcpd

11. Export the DHCP configuration and lease files using NFS:

    # dnf install nfs-utils
    # systemctl enable --now nfs-server

12. Create directories for the DHCP configuration and lease files that you want to export using NFS:

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

13. To create mount points for the created directories, add the following line to the /etc/fstab file:

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

14. Mount the file systems in /etc/fstab:

    # mount -a

15. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)
    
    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)
    
    /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

    Note that the IP address that you enter is the Satellite or Capsule IP address that you want to use with an external DHCP service.

16. Reload the NFS server:

    # exportfs -rva

17. Configure the firewall for DHCP omapi port 7911:

    # firewall-cmd --add-port=7911/tcp

18. Optional: Configure the firewall for external access to NFS. Clients are configured using NFSv3.

    # firewall-cmd \
    --add-service mountd \
    --add-service nfs \
    --add-service rpc-bind \
    --zone public

19. Make the changes persistent:

    # firewall-cmd --runtime-to-permanent

Procedure

1. Install the nfs-utils package:

   # satellite-maintain packages install nfs-utils

2. Create the DHCP directories for NFS:

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner:

   # chown -R foreman-proxy /mnt/nfs

4. Verify communication with the NFS server and the Remote Procedure Call (RPC) communication paths:

   # showmount -e DHCP_Server_FQDN
   # rpcinfo -p DHCP_Server_FQDN

5. Add the following lines to the /etc/fstab file:

   DHCP_Server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0
   
   DHCP_Server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems on /etc/fstab:

   # mount -a

7. To verify that the foreman-proxy user can access the files that are shared over the network, display the DHCP configuration and lease files:

   # su foreman-proxy -s /bin/bash
   $ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   $ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   $ exit

8. Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file:

   # satellite-installer \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-provider=remote_isc \
   --foreman-proxy-dhcp-server=My_DHCP_Server_FQDN \
   --foreman-proxy-dhcp=true \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret=My_Secret \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911

9. Associate the DHCP service with the appropriate subnets and domain.

Creating a Kerberos principal on the IdM server

1. Obtain a Kerberos ticket for the account obtained from the IdM administrator:

   # kinit idm_user

2. Create a new Kerberos principal for Satellite Server to use to authenticate on the IdM server:

   # ipa service-add capsule/satellite.example.com

Installing and configuring the idM client

1. On the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment, install the ipa-client package:

   # satellite-maintain packages install ipa-client

2. Configure the IdM client by running the installation script and following the on-screen prompts:

   # ipa-client-install

3. Obtain a Kerberos ticket:

   # kinit admin

4. Remove any preexisting keytab:

   # rm /etc/foreman-proxy/dns.keytab

5. Obtain the keytab for this system:

   # ipa-getkeytab -p capsule/satellite.example.com@EXAMPLE.COM \
   -s idm1.example.com -k /etc/foreman-proxy/dns.keytab

   Note

   When adding a keytab to a standby system with the same host name as the original system in service, add the r option to prevent generating new credentials and rendering the credentials on the original system invalid.

6. For the dns.keytab file, set the group and owner to foreman-proxy:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab

7. Optional: To verify that the keytab file is valid, enter the following command:

   # kinit -kt /etc/foreman-proxy/dns.keytab \
   capsule/satellite.example.com@EXAMPLE.COM

Configuring DNS zones in the IdM web UI

1. Create and configure the zone that you want to manage:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Select Add and enter the zone name. For example, example.com.
   3. Click Add and Edit.

   4. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

   5. Set Dynamic update to True.
   6. Enable Allow PTR sync.
   7. Click Save to save the changes.

2. Create and configure the reverse zone:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Click Add.
   3. Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups.
   4. Click Add and Edit.

   5. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

   6. Set Dynamic update to True.
   7. Click Save to save the changes.

Configuring the Satellite or Capsule Server that manages the DNS service for the domain

1. Configure your Satellite Server or Capsule Server to connect to your DNS service:

   # satellite-installer \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate_gss \
   --foreman-proxy-dns-server="idm1.example.com" \
   --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \
   --foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \
   --foreman-proxy-dns=true

2. For each affected Capsule, update the configuration of that Capsule in the Satellite web UI:

   1. In the Satellite web UI, navigate to Infrastructure > Capsules, locate the Satellite Server, and from the list in the Actions column, select Refresh.

   2. Configure the domain:

      1. In the Satellite web UI, navigate to Infrastructure > Domains and select the domain name.
      2. In the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

   3. Configure the subnet:

      1. In the Satellite web UI, navigate to Infrastructure > Subnets and select the subnet name.
      2. In the Subnet tab, set IPAM to None.
      3. In the Domains tab, select the domain that you want to manage using the IdM server.
      4. In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
      5. Click Submit to save the changes.

Enabling external updates to the DNS zone in the IdM server

1. On the IdM Server, add the following to the top of the /etc/named.conf file:

   ########################################################################
   
   include "/etc/rndc.key";
   controls  {
   inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; };
   };
   ########################################################################

2. Reload the named service to make the changes take effect:

   # systemctl reload named

3. In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes:

   1. Add the following in the BIND update policy box:

      grant "rndc-key" zonesub ANY;

   2. Set Dynamic update to True.
   3. Click Update to save the changes.

4. Copy the /etc/rndc.key file from the IdM server to the base operating system of your Satellite Server. Enter the following command:

   # scp /etc/rndc.key root@satellite.example.com:/etc/rndc.key

5. To set the correct ownership, permissions, and SELinux context for the rndc.key file, enter the following command:

   # restorecon -v /etc/rndc.key
   # chown -v root:named /etc/rndc.key
   # chmod -v 640 /etc/rndc.key

6. Assign the foreman-proxy user to the named group manually. Normally, satellite-installer ensures that the foreman-proxy user belongs to the named UNIX group, however, in this scenario Satellite does not manage users and groups, therefore you need to assign the foreman-proxy user to the named group manually.

   # usermod -a -G named foreman-proxy

7. On Satellite Server, enter the following satellite-installer command to configure Satellite to use the external DNS server:

   # satellite-installer \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="IdM_Server_IP_Address" \
   --foreman-proxy-dns-ttl=86400 \
   --foreman-proxy-dns=true \
   --foreman-proxy-keyfile=/etc/rndc.key

Testing external updates to the DNS zone in the IdM server

1. Ensure that the key in the /etc/rndc.key file on Satellite Server is the same key file that is used on the IdM server:

   key "rndc-key" {
           algorithm hmac-md5;
           secret "secret-key==";
   };

2. On Satellite Server, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1.

   # echo -e "server 192.168.25.1\n \
   update add test.example.com 3600 IN A 192.168.25.20\n \
   send\n" | nsupdate -k /etc/rndc.key

3. On Satellite Server, test the DNS entry:

   # nslookup test.example.com 192.168.25.1
   Server:		192.168.25.1
   Address:	192.168.25.1#53
   
   Name:	test.example.com
   Address: 192.168.25.20

4. To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones. Click the name of the zone and search for the host by name.

5. If resolved successfully, remove the test DNS entry:

   # echo -e "server 192.168.25.1\n \
   update delete test.example.com 3600 IN A 192.168.25.20\n \
   send\n" | nsupdate -k /etc/rndc.key

6. Confirm that the DNS entry was removed:

   # nslookup test.example.com 192.168.25.1

   The above nslookup command fails and returns the SERVFAIL error message if the record was successfully deleted.

Updating the configuration in the Satellite web UI

1. In the Satellite web UI, navigate to Infrastructure > Capsules.
2. For each Capsule that you want to update, from the Actions list, select Refresh.

3. Configure the domain:

   1. In the Satellite web UI, navigate to Infrastructure > Domains and click the domain name that you want to configure.
   2. In the Domain tab, set DNS Capsule to the Capsule where the subnet is connected.

4. Configure the subnet:

   1. In the Satellite web UI, navigate to Infrastructure > Subnets and select the subnet name.
   2. In the Subnet tab, set IPAM to DHCP or Internal DB.
   3. In the Domains tab, select the domain that you want to manage using Satellite or Capsule.
   4. In the Capsules tab, set Reverse DNS Capsule to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.