2.3. Configuring Red Hat Satellite Manually

Procedure 2.2. Running the Installer Script

1. As the root user, configure Red Hat Satellite Server manually by running the katello-installer script:

   katello-installer --foreman-admin-username desired_username --foreman-admin-password desired_password

   Where:
   1. desired_username is the username that will replace the default "admin" user.
   2. desired_password is the password that will replace the default password generated.
   Additional configuration options can be passed to the katello-installer command to adjust various aspects of the configuration. View a complete list of options using the command:

   # katello-installer --help
   

   This script can be run multiple times without any issues.

   Important

   The default username is admin. The default organization name is Default Organization. It is strongly recommended that you override these default settings once you log in to the Satellite Server interface and navigate to Administer Users and Administer Organizations.
   When the configuration script has completed successfully, it displays:

   # katello-installer
   Installing             Done
      [100%] [........................................]
      Success!
      * Katello is running at https://sat6.example.com
          Default credentials are 'admin:changeme'
      * Capsule is running at
   https://sat6.example.com:9090
      * To install additional capsule on separate machine continue by running:"
   
          capsule-certs-generate --capsule-fqdn "$CAPSULE" --certs-tar
   "~/$CAPSULE-certs.tar"
   
      The full log is at /var/log/katello/installer/katello-installer.log
   

2. After configuration, run the following commands to configure the firewall to limit elasticsearch to the foreman, katello and root users and make these rules persistent during reboots:
   • For Red Hat Enterprise Linux 6:

     iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner katello -j ACCEPT \
     && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -j DROP
     iptables-save > /etc/sysconfig/iptables
     

   • For Red Hat Enterprise Linux 7:

     firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner katello -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner katello -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \
     && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP \
     && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP