Installing Satellite Server in a disconnected network environment Red Hat Satellite 6.15 | Red Hat Customer Portal (2024)

Prerequisites

• Ensure your host has access to the BaseOS repositories of RedHat Enterprise Linux.

Procedure

1. Install fapolicyd:

   # dnf install fapolicyd

2. Start the fapolicyd service:

   # systemctl enable --now fapolicyd

Verification

• Verify that the fapolicyd service is running correctly:

  # systemctl status fapolicyd

New SatelliteServer or CapsuleServer installations

In case of new SatelliteServer or CapsuleServer installation, follow the standard installation procedures after installing and enabling fapolicyd on your RedHat Enterprise Linux host.

Additional resources

For more information on fapolicyd, see Blocking and allowing applications using fapolicyd in Red Hat Enterprise Linux 8 Security hardening.

Considerations

• Use the satellite-installer --scenario satellite --help command to display the available options and any default values. If you do not specify any values, the default values are used.
• Specify a meaningful value for the option: --foreman-initial-organization. This can be your company name. An internal label that matches the value is also created and cannot be changed afterwards. If you do not specify a value, an organization called Default Organization with the label Default_Organization is created. You can rename the organization name but not the label.
• By default, all configuration files configured by the installer are managed. When satellite-installer runs, it overwrites any manual changes to the managed files with the intended values. This means that running the installer on a broken system should restore it to working order, regardless of changes made. For more information on how to apply custom configuration on other services, see Applying Custom Configuration to Satellite.

Procedure

1. Enter the following command with any additional options that you want to use:

   # satellite-installer --scenario satellite \--foreman-initial-organization "My_Organization" \--foreman-initial-location "My_Location" \--foreman-initial-admin-username admin_user_name \--foreman-initial-admin-password admin_password

   The script displays its progress and writes logs to /var/log/foreman-installer/satellite.log.

2. Unmount the ISO images:

   # umount /media/sat6# umount /media/rhel8

• The upstream SatelliteServer is connected to the Internet. This server consumes content from the Red Hat Content Delivery Network (CDN) or custom sources.
• The downstream SatelliteServer is completely isolated from all external networks.
• The downstream SatelliteServer can communicate with a connected upstream SatelliteServer over an internal network.

Figure3.1.Satellite ISS disconnected scenario

• The upstream SatelliteServer is connected to the Internet. This server consumes content from the Red Hat CDN or custom sources.
• The downstream SatelliteServer is completely isolated from all external networks.
• The downstream SatelliteServer does not have a network connection to a connected upstream SatelliteServer.

Figure3.2.Satellite ISS air-gapped scenario

Procedure

1. Navigate to the RedHat Customer Portal at access.redhat.com/downloads and log in.
2. Click RedHat Enterprise Linux.
3. Select a product variant and a product version from the list. For example, product variant RedHat Enterprise Linux for x86_64 and product version 9.0.
4. Locate the full installation image, for example, RedHat Enterprise Linux 9.0 Binary DVD, and click Download Now. Note that you cannot provision hosts using the minimal ISO.
5. When the download completes, copy the ISO image to SatelliteServer.

6. On SatelliteServer, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso# mount -o loop rhel-binary-dvd.iso /mnt/iso

   Replace rhel-binary-dvd.iso with the name of your ISO image.

7. Create directories for RedHat Enterprise Linux 9 AppStream and BaseOS Kickstart repositories:

   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart# mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart

8. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/AppStream/* /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart# cp -a /mnt/iso/BaseOS/* /mnt/iso/images/ /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart

   Note that for BaseOS, you must also copy the contents of the /mnt/iso/images/ directory.

9. Add the following entries to the listing files:

   To the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/listing file, append the version number with a new line. For example, for the RedHat Enterprise Linux 9.0 binary ISO, append 9.0.

10. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart/treeinfo# cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart/treeinfo

11. Open the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart/treeinfo file for editing.

12. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variant = AppStream to variant = BaseOS
    • Change variants = AppStream,BaseOS to variants = BaseOS
13. In the [tree] section, change variants = AppStream,BaseOS to variants = BaseOS.

14. In the [variant-BaseOS] section, make the following changes:

    • Change packages = BaseOS/Packages to packages = Packages
    • Change repository = BaseOS to repository = .
15. Delete the [media] and [variant-AppStream] sections.
16. Save and close the file.

17. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/baseos/kickstart/treeinfo file has the following format:

    [checksums]images/efiboot.img = sha256:c01c18acc6778d6e66c8d0872bac59bfd7219ccf3cfa70a5c605c0fb37f33a83images/install.img = sha256:ddd08e5a5d92edee150f91ff4f12f39253eae72ff496465cf1b2766fe4a4df49images/pxeboot/initrd.img = sha256:a09a8ec89d485d71ed1bdad83584d6d816e67448221172d9aad97886cd70adcaimages/pxeboot/vmlinuz = sha256:6e523d7c3266e26c695923ab12b2873b16b0c61fb2e48ade608ad8998821584b[general]; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.; WARNING.1 = Read productmd documentation for details about new format.arch = x86_64family = RedHat Enterprise Linuxname = RedHat Enterprise Linux 9.0.0packagedir = Packagesplatforms = x86_64,xenrepository = .timestamp = 1571146127variant = BaseOSvariants = BaseOSversion = 9.0.0[header]type = productmd.treeinfoversion = 1.2[images-x86_64]efiboot.img = images/efiboot.imginitrd = images/pxeboot/initrd.imgkernel = images/pxeboot/vmlinuz[images-xen]initrd = images/pxeboot/initrd.imgkernel = images/pxeboot/vmlinuz[release]name = RedHat Enterprise Linuxshort = RHELversion = 9.0.0[stage2]mainimage = images/install.img[tree]arch = x86_64build_timestamp = 1571146127platforms = x86_64,xenvariants = BaseOS[variant-BaseOS]id = BaseOSname = BaseOSpackages = Packagesrepository = .type = variantuid = BaseOS

18. Open the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart/treeinfo file for editing.

19. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variants = AppStream,BaseOS to variants = AppStream
20. In the [tree] section, change variants = AppStream,BaseOS to variants = AppStream

21. In the [variant-AppStream] section, make the following changes:

    • Change packages = AppStream/Packages to packages = Packages
    • Change repository = AppStream to repository = .
22. Delete the following sections from the file: [checksums], [images-x86_64], [images-xen], [media], [stage2], [variant-BaseOS].
23. Save and close the file.

24. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel9/9.0/x86_64/appstream/kickstart/treeinfo file has the following format:

    [general]; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.; WARNING.1 = Read productmd documentation for details about new format.arch = x86_64family = RedHat Enterprise Linuxname = RedHat Enterprise Linux 9.0.0packagedir = Packagesplatforms = x86_64,xenrepository = .timestamp = 1571146127variant = AppStreamvariants = AppStreamversion = 9.0.0[header]type = productmd.treeinfoversion = 1.2[release]name = RedHat Enterprise Linuxshort = RHELversion = 9.0.0[tree]arch = x86_64build_timestamp = 1571146127platforms = x86_64,xenvariants = AppStream[variant-AppStream]id = AppStreamname = AppStreampackages = Packagesrepository = .type = variantuid = AppStream

25. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso# rmdir /mnt/iso

26. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. Navigate to the RedHat Customer Portal at access.redhat.com/downloads and log in.
2. Click RedHat Enterprise Linux.
3. Select a product variant and a product version from the list. For example, product variant RedHat Enterprise Linux for x86_64 and product version 8.1.
4. Locate the full installation image, for example, RedHat Enterprise Linux 8.1 Binary DVD, and click Download Now.
5. When the download completes, copy the ISO image to SatelliteServer.

6. On SatelliteServer, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso# mount -o loop rhel-binary-dvd.iso /mnt/iso

   Replace rhel-binary-dvd.iso with the name of your ISO image.

7. Create directories for RedHat Enterprise Linux 8 AppStream and BaseOS Kickstart repositories:

   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart# mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

8. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/AppStream/* /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart# cp -a /mnt/iso/BaseOS/* /mnt/iso/images/ /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart

   Note that for BaseOS, you must also copy the contents of the /mnt/iso/images/ directory.

9. Add the following entries to the listing files:

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/listing file, append kickstart with a new line.

   To the /var/www/html/pub/satellite-import/content/dist/rhel8/listing file, append the version number with a new line. For example, for the RedHat Enterprise Linux 8.1 binary ISO, append 8.1.

10. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo# cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo

11. Open the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file for editing.

12. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variant = AppStream to variant = BaseOS
    • Change variants = AppStream,BaseOS to variants = BaseOS
13. In the [tree] section, change variants = AppStream,BaseOS to variants = BaseOS.

14. In the [variant-BaseOS] section, make the following changes:

    • Change packages = BaseOS/Packages to packages = Packages
    • Change repository = BaseOS to repository = .
15. Delete the [media] and [variant-AppStream] sections.
16. Save and close the file.

17. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/baseos/kickstart/treeinfo file has the following format:

    [checksums]images/efiboot.img = sha256:c01c18acc6778d6e66c8d0872bac59bfd7219ccf3cfa70a5c605c0fb37f33a83images/install.img = sha256:ddd08e5a5d92edee150f91ff4f12f39253eae72ff496465cf1b2766fe4a4df49images/pxeboot/initrd.img = sha256:a09a8ec89d485d71ed1bdad83584d6d816e67448221172d9aad97886cd70adcaimages/pxeboot/vmlinuz = sha256:6e523d7c3266e26c695923ab12b2873b16b0c61fb2e48ade608ad8998821584b[general]; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.; WARNING.1 = Read productmd documentation for details about new format.arch = x86_64family = RedHat Enterprise Linuxname = RedHat Enterprise Linux 8.1.0packagedir = Packagesplatforms = x86_64,xenrepository = .timestamp = 1571146127variant = BaseOSvariants = BaseOSversion = 8.1.0[header]type = productmd.treeinfoversion = 1.2[images-x86_64]efiboot.img = images/efiboot.imginitrd = images/pxeboot/initrd.imgkernel = images/pxeboot/vmlinuz[images-xen]initrd = images/pxeboot/initrd.imgkernel = images/pxeboot/vmlinuz[release]name = RedHat Enterprise Linuxshort = RHELversion = 8.1.0[stage2]mainimage = images/install.img[tree]arch = x86_64build_timestamp = 1571146127platforms = x86_64,xenvariants = BaseOS[variant-BaseOS]id = BaseOSname = BaseOSpackages = Packagesrepository = .type = variantuid = BaseOS

18. Open the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file for editing.

19. In the [general] section, make the following changes:

    • Change packagedir = AppStream/Packages to packagedir = Packages
    • Change repository = AppStream to repository = .
    • Change variants = AppStream,BaseOS to variants = AppStream
20. In the [tree] section, change variants = AppStream,BaseOS to variants = AppStream

21. In the [variant-AppStream] section, make the following changes:

    • Change packages = AppStream/Packages to packages = Packages
    • Change repository = AppStream to repository = .
22. Delete the following sections from the file: [checksums], [images-x86_64], [images-xen], [media], [stage2], [variant-BaseOS].
23. Save and close the file.

24. Verify that the /var/www/html/pub/satellite-import/content/dist/rhel8/8.1/x86_64/appstream/kickstart/treeinfo file has the following format:

    [general]; WARNING.0 = This section provides compatibility with pre-productmd treeinfos.; WARNING.1 = Read productmd documentation for details about new format.arch = x86_64family = RedHat Enterprise Linuxname = RedHat Enterprise Linux 8.1.0packagedir = Packagesplatforms = x86_64,xenrepository = .timestamp = 1571146127variant = AppStreamvariants = AppStreamversion = 8.1.0[header]type = productmd.treeinfoversion = 1.2[release]name = RedHat Enterprise Linuxshort = RHELversion = 8.1.0[tree]arch = x86_64build_timestamp = 1571146127platforms = x86_64,xenvariants = AppStream[variant-AppStream]id = AppStreamname = AppStreampackages = Packagesrepository = .type = variantuid = AppStream

25. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso# rmdir /mnt/iso

26. In the Satellite web UI, enable the Kickstart repositories.

Procedure

1. Navigate to the RedHat Customer Portal at access.redhat.com/downloads and log in.
2. Click RedHat Enterprise Linux.
3. Click Switch to version 7 and below above the Product Variant list.
4. Select a product variant and a product version from the list. For example, product variant RedHat Enterprise Linux for x86_64 and product version 7.9.
5. Locate the full installation image, for example, RedHat Enterprise Linux 7.9 Binary DVD, and click Download Now.
6. When the download completes, copy the ISO image to SatelliteServer.

7. On SatelliteServer, create a mount point and temporarily mount the ISO image at that location:

   # mkdir /mnt/iso# mount -o loop rhel-binary-dvd.iso /mnt/iso

   Replace rhel-binary-dvd.iso with the name of your ISO image.

8. Create Kickstart directories:

   # mkdir --parents /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/kickstart/

9. Copy the kickstart files from the ISO image:

   # cp -a /mnt/iso/* /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/kickstart/

10. Add the following entries to the listing files:

    To the /var/www/html/pub/satellite-import/content/dist/rhel/server/7/listing file, append the version number with a new line. For example, for the RedHat Enterprise Linux 7.9 ISO, append 7.9.

    To the /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/listing file, append the architecture with a new line. For example, x86_64.

    To the /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/listing file, append kickstart with a new line.

11. Copy the .treeinfo files from the ISO image:

    # cp /mnt/iso/.treeinfo /var/www/html/pub/satellite-import/content/dist/rhel/server/7/7.9/x86_64/kickstart/treeinfo

12. If you do not plan to use the mounted binary DVD ISO image, unmount and remove the directory:

    # umount /mnt/iso# rmdir /mnt/iso

13. In the Satellite web UI, enable the Kickstart repositories.

• CLI procedure for RedHat Enterprise Linux 9
• CLI procedure for RedHat Enterprise Linux 8

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the RedHat Enterprise Linux for x86_64 product to view available content.
3. Select RedHat Satellite Client 6 for RHEL 9 x86_64 RPMs or RedHat Satellite Client 6 for RHEL 8 x86_64 RPMs.
4. Click Synchronize Now.

CLI procedure for RedHat Enterprise Linux 9

• Synchronize your Satellite Client 6 repository:

  # hammer repository synchronize \--name "RedHat Satellite Client 6 for RHEL 9 x86_64 RPMs" \--organization "My_Organization" \--product "RedHat Enterprise Linux for x86_64"

CLI procedure for RedHat Enterprise Linux 8

• Synchronize your Satellite Client 6 repository:

  # hammer repository synchronize \--name "RedHat Satellite Client 6 for RHEL 8 x86_64 RPMs" \--organization "My_Organization" \--product "RedHat Enterprise Linux for x86_64"

Additional resources

• For details about the hammer repository synchronize command, enter hammer repository synchronize --help.

Note

• CLI procedure for RedHat Enterprise Linux 7
• CLI procedure for RedHat Enterprise Linux 6

Procedure

1. In the Satellite web UI, navigate to Content > Sync Status.
2. Click the arrow next to the RedHat Enterprise Linux Server or RedHat Enterprise Linux Server - Extended Lifecycle Support.
3. Select RedHat Satellite Client 6 (for RHEL 7 Server) RPMs x86_64 or RedHat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64 based on your operating system version.
4. Click Synchronize Now.

CLI procedure for RedHat Enterprise Linux 7

• Synchronize your Satellite Client 6 repository:

  # hammer repository synchronize \--async \--name "RedHat Satellite Client 6 for RHEL 7 Server RPMs x86_64" \--organization "My_Organization" \--product "RedHat Enterprise Linux Server"

CLI procedure for RedHat Enterprise Linux 6

• Synchronize your Satellite Client 6 repository:

  # hammer repository synchronize \--async \--name "RedHat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64" \--organization "My_Organization" \--product "RedHat Enterprise Linux Server - Extended Lifecycle Support"

Additional resources

• For details about the hammer repository synchronize command, enter hammer repository synchronize --help.

• CLI procedure for RedHat Enterprise Linux 9
• CLI procedure for RedHat Enterprise Linux 8

Prerequisites

• Ensure that you import all content ISO images that you require into SatelliteServer.

Procedure

1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
2. In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories.
3. Click RedHat Satellite Client 6 for RHEL 9 x86_64 (RPMs) or RedHat Satellite Client 6 for RHEL 8 x86_64 (RPMs) to expand the repository set.

4. For the x86_64 architecture, click the + icon to enable the repository.

   If the Satellite Client 6 items are not visible, it may be because they are not included in the RedHat subscription manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the RedHat subscription manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing content.

   Enable the Satellite Client 6 repository for every supported major version of RedHat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created.

CLI procedure for RedHat Enterprise Linux 9

• Enable the Satellite Client 6 repository:

  # hammer repository-set enable \--basearch="x86_64" \--name "RedHat Satellite Client 6 for RHEL 9 x86_64 (RPMs)" \--organization "My_Organization" \--product "RedHat Enterprise Linux for x86_64"

CLI procedure for RedHat Enterprise Linux 8

• Enable the Satellite Client 6 repository:

  # hammer repository-set enable \--basearch="x86_64" \--name "RedHat Satellite Client 6 for RHEL 8 x86_64 (RPMs)" \--organization "My_Organization" \--product "RedHat Enterprise Linux for x86_64"

Additional resources

• For details about the hammer repository-set enable command, enter hammer repository-set enable --help.

Note

• CLI procedure for RedHat Enterprise Linux 7
• CLI procedure for RedHat Enterprise Linux 6

Prerequisites

• Ensure that you import all content ISO images that you require into SatelliteServer. .Procedure

  1. In the Satellite web UI, navigate to Content > Red Hat Repositories.
  2. In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories.

  3. In the Available Repositories pane, click on Satellite Client 6 (for RHEL 7 Server) (RPMs) or Satellite Client 6 (for RHEL 6 Server - ELS) (RPMs) to expand the repository set.

     If the Satellite Client 6 items are not visible, it may be because they are not included in the RedHat subscription manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the RedHat subscription manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing content.

  4. For the x86_64 architecture, click the + icon to enable the repository. Enable the Satellite Client 6 repository for every supported major version of RedHat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created.

CLI procedure for RedHat Enterprise Linux 7

• Enable the Satellite Client 6 repository:

  # hammer repository-set enable \--basearch="x86_64" \--name "RedHat Satellite Client 6 (for RHEL 7 Server) (RPMs)" \--organization "My_Organization" \--product "RedHat Enterprise Linux Server"

CLI procedure for RedHat Enterprise Linux 6

• Enable the Satellite Client 6 repository:

  # hammer repository-set enable \--basearch="x86_64" \--name "RedHat Satellite Client 6 (for RHEL 6 Server - ELS) (RPMs)" \--organization "My_Organization" \--product "RedHat Enterprise Linux Server - Extended Lifecycle Support"

Additional resources

• For details about the hammer repository-set enable command, enter hammer repository-set enable --help.

Prerequisites

• Ensure that the following information is available to you:

  • DHCP IP address ranges
  • DHCP gateway IP address
  • DHCP nameserver IP address
  • DNS information
  • TFTP server name
• Use the FQDN instead of the IP address where possible in case of network changes.
• Contact your network administrator to ensure that you have the correct settings.

Procedure

• Enter the satellite-installer command with the options appropriate for your environment. The following example shows configuring full provisioning services:

  # satellite-installer \--foreman-proxy-dns true \--foreman-proxy-dns-managed true \--foreman-proxy-dns-zone example.com \--foreman-proxy-dns-reverse 2.0.192.in-addr.arpa \--foreman-proxy-dhcp true \--foreman-proxy-dhcp-managed true \--foreman-proxy-dhcp-range "192.0.2.100 192.0.2.150" \--foreman-proxy-dhcp-gateway 192.0.2.1 \--foreman-proxy-dhcp-nameservers 192.0.2.2 \--foreman-proxy-tftp true \--foreman-proxy-tftp-managed true \--foreman-proxy-tftp-servername 192.0.2.3

Additional resources

• For more information about the satellite-installer --scenario satellite command, enter satellite-installer --scenario satellite --help.

Procedure

1. On SatelliteServer, enter the following command:

   # satellite-installer --foreman-proxy-dhcp false \--foreman-proxy-dns false \--foreman-proxy-tftp false

2. In the Satellite web UI, navigate to Infrastructure > Subnets and select a subnet.
3. Click the Capsules tab and clear the DHCP Capsule, TFTP Capsule, and Reverse DNS Capsule fields.
4. In the Satellite web UI, navigate to Infrastructure > Domains and select a domain.
5. Clear the DNS Capsule field.

6. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options:

   Option 66: IP address of Satellite or CapsuleOption 67: /pxelinux.0

   For more information about DHCP options, see RFC 2132.

Note

Satellite does not perform orchestration when a Capsule is not set for a given subnet and domain. When enabling or disabling Capsule associations, orchestration commands for existing hosts can fail if the expected records and configuration files are not present. When associating a Capsule to turn orchestration on, ensure the required DHCP and DNS records as well as the TFTP files are in place for the existing Satellite hosts in order to prevent host deletion failures in the future.

• For more information about configuring DNS, DHCP, and TFTP externally, see Chapter4, Configuring SatelliteServer with external services.
• For more information about configuring DHCP, DNS, and TFTP services, see Configuring Network Services in Provisioning hosts.

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/satellite_cert

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this SatelliteServer, skip this step.

   # openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096

3. Create the /root/satellite_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]req_extensions = v3_reqdistinguished_name = req_distinguished_nameprompt = no[ req_distinguished_name ]commonName = satellite.example.com[ v3_req ]basicConstraints = CA:FALSEkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEnciphermentextendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtectionsubjectAltName = @alt_names[ alt_names ]DNS.1 = satellite.example.com

4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]CN = satellite.example.comcountryName =My_Country_Name 1stateOrProvinceName = My_State_Or_Province_Name 2localityName = My_Locality_Name 3organizationName = My_Organization_Or_Company_NameorganizationalUnitName = My_Organizational_Unit_Name 4

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

5. Generate CSR:

   # openssl req -new \-key /root/satellite_cert/satellite_cert_key.pem \ 1-config /root/satellite_cert/openssl.cnf \ 2-out /root/satellite_cert/satellite_cert_csr.pem 3

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for SatelliteServer and CapsuleServer.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Important

Do not store the SSL certificates or .tar bundles in /tmp or /var/tmp directory. The operating system removes files from these directories periodically. As a result, satellite-installer fails to execute while enabling features or upgrading SatelliteServer.

Procedure

1. Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of SatelliteServer.

   # katello-certs-check \-c /root/satellite_cert/satellite_cert.pem \ 1-k /root/satellite_cert/satellite_cert_key.pem \ 2-b /root/satellite_cert/ca_cert_bundle.pem 3

   1

   Path to SatelliteServer certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign SatelliteServer certificate.

   3

   Path to the Certificate Authority bundle.

   If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to SatelliteServer.

   Example output of katello-certs-check

   Validation succeeded.To install the Red Hat Satellite Server with the custom certificates, run: satellite-installer --scenario satellite \ --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \ --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \ --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem"To update the certificates on a currently running Red Hat Satellite installation, run: satellite-installer --scenario satellite \ --certs-server-cert "/root/satellite_cert/satellite_cert.pem" \ --certs-server-key "/root/satellite_cert/satellite_cert_key.pem" \ --certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem" \ --certs-update-server --certs-update-server-ca

   Note that you must not access or modify /root/ssl-build.

2. From the output of the katello-certs-check command, depending on your requirements, enter the satellite-installer command that installs a new Satellite with custom SSL certificates or updates certificates on a currently running Satellite.

   If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates.

   Important

   satellite-installer needs the certificate archive file after you deploy the certificate. Do not modify or delete it. It is required, for example, when upgrading SatelliteServer.

3. On a computer with network access to SatelliteServer, navigate to the following URL: https://satellite.example.com.
4. In your browser, view the certificate details to verify the deployed certificate.

Procedure

• Update the SSL certificate on each host:

  # dnf install http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

Advantages of external PostgreSQL

• Increase in free memory and free CPU on Satellite
• Flexibility to set shared_buffers on the PostgreSQL database to a high number without the risk of interfering with other services on Satellite
• Flexibility to tune the PostgreSQL server’s system without adversely affecting Satellite operations

Disadvantages of external PostgreSQL

• Increase in deployment complexity that can make troubleshooting more difficult
• The external PostgreSQL server is an additional system to patch and maintain
• If either Satellite or the PostgreSQL database server suffers a hardware or storage failure, Satellite is not operational
• If there is latency between the Satellite server and database server, performance can suffer

Prerequisites

• The prepared host must meet Satellite’s Storage Requirements.

Procedure

1. Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server.

2. Disable all repositories and enable only the following repositories:

   # subscription-manager repos --disable '*'# subscription-manager repos \--enable=satellite-6.15-for-rhel-8-x86_64-rpms \--enable=satellite-maintenance-6.15-for-rhel-8-x86_64-rpms \--enable=rhel-8-for-x86_64-baseos-rpms \--enable=rhel-8-for-x86_64-appstream-rpms

3. Enable the following module:

   # dnf module enable satellite:el8

   Note

   Enablement of the module satellite:el8 warns about a conflict with postgresql:10 and ruby:2.5 as these modules are set to the default module versions on RedHat Enterprise Linux 8. The module satellite:el8 has a dependency for the modules postgresql:12 and ruby:2.7 that will be enabled with the satellite:el8 module. These warnings do not cause installation process failure, hence can be ignored safely. For more information about modules and lifecycle streams on RedHat Enterprise Linux 8, see RedHat Enterprise Linux Application Streams Lifecycle.

Procedure

1. To install PostgreSQL, enter the following command:

   # dnf install postgresql-server postgresql-evr postgresql-contrib

2. To initialize PostgreSQL, enter the following command:

   # postgresql-setup initdb

3. Edit the /var/lib/pgsql/data/postgresql.conf file:

   # vi /var/lib/pgsql/data/postgresql.conf

   Note that the default configuration of external PostgreSQL needs to be adjusted to work with Satellite. The base recommended external database configuration adjustments are as follows:

   • checkpoint_completion_target: 0.9
   • max_connections: 500
   • shared_buffers: 512MB
   • work_mem: 4MB

4. Remove the # and edit to listen to inbound connections:

   listen_addresses = '*'

5. Edit the /var/lib/pgsql/data/pg_hba.conf file:

   # vi /var/lib/pgsql/data/pg_hba.conf

6. Add the following line to the file:

    host all all Satellite_ip/32 md5

7. To start, and enable PostgreSQL service, enter the following commands:

   # systemctl enable --now postgresql

8. Open the postgresql port on the external PostgreSQL server:

   # firewall-cmd --add-service=postgresql

9. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

10. Switch to the postgres user and start the PostgreSQL client:

    $ su - postgres -c psql

11. Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp:

    CREATE USER "foreman" WITH PASSWORD 'Foreman_Password';CREATE USER "candlepin" WITH PASSWORD 'Candlepin_Password';CREATE USER "pulp" WITH PASSWORD 'Pulpcore_Password';CREATE DATABASE foreman OWNER foreman;CREATE DATABASE candlepin OWNER candlepin;CREATE DATABASE pulpcore OWNER pulp;

12. Connect to the Pulp database:

    postgres=# \c pulpcoreYou are now connected to database "pulpcore" as user "postgres".

13. Create the hstore extension:

    pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore";CREATE EXTENSION

14. Exit the postgres user:

    # \q

15. From SatelliteServer, test that you can access the database. If the connection succeeds, the commands return 1.

    # PGPASSWORD='Foreman_Password' psql -h postgres.example.com -p 5432 -U foreman -d foreman -c "SELECT 1 as ping"# PGPASSWORD='Candlepin_Password' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping"# PGPASSWORD='Pulpcore_Password' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"

Prerequisites

• You have installed and configured a PostgreSQL database on a RedHat Enterprise Linux server.

Procedure

1. To configure the external databases for Satellite, enter the following command:

   # satellite-installer --scenario satellite \--foreman-db-database foreman \--foreman-db-host postgres.example.com \--foreman-db-manage false \--foreman-db-password Foreman_Password \--foreman-proxy-content-pulpcore-manage-postgresql false \--foreman-proxy-content-pulpcore-postgresql-db-name pulpcore \--foreman-proxy-content-pulpcore-postgresql-host postgres.example.com \--foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password \--foreman-proxy-content-pulpcore-postgresql-user pulp \--katello-candlepin-db-host postgres.example.com \--katello-candlepin-db-name candlepin \--katello-candlepin-db-password Candlepin_Password \--katello-candlepin-manage-db false

   To enable the Secure Sockets Layer (SSL) protocol for these external databases, add the following options:

   --foreman-db-root-cert <path_to_CA>--foreman-db-sslmode verify-full--foreman-proxy-content-pulpcore-postgresql-ssl true--foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA>--katello-candlepin-db-ssl true--katello-candlepin-db-ssl-ca <path_to_CA>--katello-candlepin-db-ssl-verify true

Note

If you use dnsmasq as an external DHCP server, enable the dhcp-no-override setting. This is required because Satellite creates configuration files on the TFTP server under the grub2/ subdirectory. If the dhcp-no-override setting is disabled, hosts fetch the bootloader and its configuration from the root directory, which might cause an error.

Procedure

1. On your RedHat Enterprise Linux host, install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) utilities packages:

   # dnf install dhcp-server bind-utils

2. Generate a security token:

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   As a result, a key pair that consists of two files is created in the current directory.

3. Copy the secret hash from the key:

   # grep ^Key Komapi_key.+*.private | cut -d ' ' -f2

4. Edit the dhcpd configuration file for all subnets and add the key. The following is an example:

   # cat /etc/dhcp/dhcpd.confdefault-lease-time 604800;max-lease-time 2592000;log-facility local7;subnet 192.168.38.0 netmask 255.255.255.0 {range 192.168.38.10 192.168.38.100;option routers 192.168.38.1;option subnet-mask 255.255.255.0;option domain-search "virtual.lan";option domain-name "virtual.lan";option domain-name-servers 8.8.8.8;}omapi-port 7911;key omapi_key {algorithm HMAC-MD5;secret "My_Secret";};omapi-key omapi_key;

   Note that the option routers value is the IP address of your SatelliteServer or CapsuleServer that you want to use with an external DHCP service.

5. Delete the two key files from the directory that they were created in.

6. On SatelliteServer, define each subnet. Do not set DHCP Capsule for the defined Subnet yet.

   To prevent conflicts, set up the lease and reservation ranges separately. For example, if the lease range is 192.168.38.10 to 192.168.38.100, in the Satellite web UI define the reservation range as 192.168.38.101 to 192.168.38.250.

7. Configure the firewall for external access to the DHCP server:

   # firewall-cmd --add-service dhcp

8. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

9. On SatelliteServer, determine the UID and GID of the foreman user:

   # id -u foreman993# id -g foreman990

10. On the DHCP server, create the foreman user and group with the same IDs as determined in a previous step:

    # groupadd -g 990 foreman# useradd -u 993 -g 990 -s /sbin/nologin foreman

11. To ensure that the configuration files are accessible, restore the read and execute flags:

    # chmod o+rx /etc/dhcp/# chmod o+r /etc/dhcp/dhcpd.conf# chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

12. Enable and start the DHCP service:

    # systemctl enable --now dhcpd

13. Export the DHCP configuration and lease files using NFS:

    # dnf install nfs-utils# systemctl enable --now nfs-server

14. Create directories for the DHCP configuration and lease files that you want to export using NFS:

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

15. To create mount points for the created directories, add the following line to the /etc/fstab file:

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0/etc/dhcp /exports/etc/dhcp none bind,auto 0 0

16. Mount the file systems in /etc/fstab:

    # mount -a

17. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)/exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)/exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

    Note that the IP address that you enter is the Satellite or Capsule IP address that you want to use with an external DHCP service.

18. Reload the NFS server:

    # exportfs -rva

19. Configure the firewall for DHCP omapi port 7911:

    # firewall-cmd --add-port=7911/tcp

20. Optional: Configure the firewall for external access to NFS. Clients are configured using NFSv3.

    # firewall-cmd \--add-service mountd \--add-service nfs \--add-service rpc-bind \--zone public

21. Make the changes persistent:

    # firewall-cmd --runtime-to-permanent

Prerequisites

• Ensure that you have configured an external DHCP server and that you have shared the DHCP configuration and lease files with SatelliteServer. For more information, see Section4.2.1, “Configuring an external DHCP server to use with SatelliteServer”.

Procedure

1. Install the nfs-utils package:

   # satellite-maintain packages install nfs-utils

2. Create the DHCP directories for NFS:

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner:

   # chown -R foreman-proxy /mnt/nfs

4. Verify communication with the NFS server and the Remote Procedure Call (RPC) communication paths:

   # showmount -e DHCP_Server_FQDN# rpcinfo -p DHCP_Server_FQDN

5. Add the following lines to the /etc/fstab file:

   DHCP_Server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfsro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0DHCP_Server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfsro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems on /etc/fstab:

   # mount -a

7. To verify that the foreman-proxy user can access the files that are shared over the network, display the DHCP configuration and lease files:

   # su foreman-proxy -s /bin/bash$ cat /mnt/nfs/etc/dhcp/dhcpd.conf$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases$ exit

8. Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file:

   # satellite-installer \--enable-foreman-proxy-plugin-dhcp-remote-isc \--foreman-proxy-dhcp-provider=remote_isc \--foreman-proxy-dhcp-server=My_DHCP_Server_FQDN \--foreman-proxy-dhcp=true \--foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \--foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \--foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \--foreman-proxy-plugin-dhcp-remote-isc-key-secret=My_Secret \--foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911

9. Associate the DHCP service with the appropriate subnets and domain.

Prerequisites

• You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements for IdM in the Installing Identity Management Guide.
• You must contact the IdM server administrator to ensure that you obtain an account on the IdM server with permissions to create zones on the IdM server.
• You should create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see Configuring SatelliteServer.

Procedure

To configure dynamic DNS update with GSS-TSIG authentication, complete the following steps:

Creating a Kerberos principal on the IdM server

1. Obtain a Kerberos ticket for the account obtained from the IdM administrator:

   # kinit idm_user

2. Create a new Kerberos principal for SatelliteServer to use to authenticate on the IdM server:

   # ipa service-add capsule/satellite.example.com

Installing and configuring the idM client

1. On the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment, install the ipa-client package:

   # satellite-maintain packages install ipa-client

2. Configure the IdM client by running the installation script and following the on-screen prompts:

   # ipa-client-install

3. Obtain a Kerberos ticket:

   # kinit admin

4. Remove any preexisting keytab:

   # rm /etc/foreman-proxy/dns.keytab

5. Obtain the keytab for this system:

   # ipa-getkeytab -p capsule/satellite.example.com@EXAMPLE.COM \-s idm1.example.com -k /etc/foreman-proxy/dns.keytab

   Note

   When adding a keytab to a standby system with the same host name as the original system in service, add the r option to prevent generating new credentials and rendering the credentials on the original system invalid.

6. For the dns.keytab file, set the group and owner to foreman-proxy:

   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab

7. Optional: To verify that the keytab file is valid, enter the following command:

   # kinit -kt /etc/foreman-proxy/dns.keytab \capsule/satellite.example.com@EXAMPLE.COM

Configuring DNS zones in the IdM web UI

1. Create and configure the zone that you want to manage:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Select Add and enter the zone name. For example, example.com.
   3. Click Add and Edit.

   4. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

   5. Set Dynamic update to True.
   6. Enable Allow PTR sync.
   7. Click Save to save the changes.

2. Create and configure the reverse zone:

   1. Navigate to Network Services > DNS > DNS Zones.
   2. Click Add.
   3. Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups.
   4. Click Add and Edit.

   5. Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list:

      grant capsule\047satellite.example.com@EXAMPLE.COM wildcard * ANY;

   6. Set Dynamic update to True.
   7. Click Save to save the changes.

Configuring the Satellite or CapsuleServer that manages the DNS service for the domain

1. Use the satellite-installer command to configure the Satellite or Capsule that manages the DNS Service for the domain:

   • On Satellite, enter the following command:

     # satellite-installer --scenario satellite \--foreman-proxy-dns-managed=false \--foreman-proxy-dns-provider=nsupdate_gss \--foreman-proxy-dns-server="idm1.example.com" \--foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \--foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \--foreman-proxy-dns=true

   • On Capsule, enter the following command:

     # satellite-installer --scenario capsule \--foreman-proxy-dns-managed=false \--foreman-proxy-dns-provider=nsupdate_gss \--foreman-proxy-dns-server="idm1.example.com" \--foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \--foreman-proxy-dns-tsig-principal="capsule/satellite.example.com@EXAMPLE.COM" \--foreman-proxy-dns=true

Updating the configuration in the Satellite web UI

1. In the Satellite web UI, navigate to Infrastructure > Capsules, locate the SatelliteServer, and from the list in the Actions column, select Refresh.

2. Configure the domain:

   1. In the Satellite web UI, navigate to Infrastructure > Domains and select the domain name.
   2. In the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

3. Configure the subnet:

   1. In the Satellite web UI, navigate to Infrastructure > Subnets and select the subnet name.
   2. In the Subnet tab, set IPAM to None.
   3. In the Domains tab, select the domain that you want to manage using the IdM server.
   4. In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.

Prerequisites

• You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide.
• You must obtain root user access on the IdM server.
• You must confirm whether SatelliteServer or CapsuleServer is configured to provide DNS service for your deployment.
• You must configure DNS, DHCP and TFTP services on the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment.
• You must create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see Configuring SatelliteServer.

Procedure

To configure dynamic DNS update with TSIG authentication, complete the following steps:

Enabling external updates to the DNS zone in the IdM server

1. On the IdM Server, add the following to the top of the /etc/named.conf file:

   ########################################################################include "/etc/rndc.key";controls {inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; };};########################################################################

2. Reload the named service to make the changes take effect:

   # systemctl reload named

3. In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes:

   1. Add the following in the BIND update policy box:

      grant "rndc-key" zonesub ANY;

   2. Set Dynamic update to True.
   3. Click Update to save the changes.

4. Copy the /etc/rndc.key file from the IdM server to the base operating system of your SatelliteServer. Enter the following command:

   # scp /etc/rndc.key root@satellite.example.com:/etc/rndc.key

5. To set the correct ownership, permissions, and SELinux context for the rndc.key file, enter the following command:

   # restorecon -v /etc/rndc.key# chown -v root:named /etc/rndc.key# chmod -v 640 /etc/rndc.key

6. Assign the foreman-proxy user to the named group manually. Normally, satellite-installer ensures that the foreman-proxy user belongs to the named UNIX group, however, in this scenario Satellite does not manage users and groups, therefore you need to assign the foreman-proxy user to the named group manually.

   # usermod -a -G named foreman-proxy

7. On SatelliteServer, enter the following satellite-installer command to configure Satellite to use the external DNS server:

   # satellite-installer --scenario satellite \--foreman-proxy-dns-managed=false \--foreman-proxy-dns-provider=nsupdate \--foreman-proxy-dns-server="IdM_Server_IP_Address" \--foreman-proxy-dns-ttl=86400 \--foreman-proxy-dns=true \--foreman-proxy-keyfile=/etc/rndc.key

Testing external updates to the DNS zone in the IdM server

1. Ensure that the key in the /etc/rndc.key file on SatelliteServer is the same key file that is used on the IdM server:

   key "rndc-key" { algorithm hmac-md5; secret "secret-key==";};

2. On SatelliteServer, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1.

   # echo -e "server 192.168.25.1\n \update add test.example.com 3600 IN A 192.168.25.20\n \send\n" | nsupdate -k /etc/rndc.key

3. On SatelliteServer, test the DNS entry:

   # nslookup test.example.com 192.168.25.1Server:192.168.25.1Address:192.168.25.1#53Name:test.example.comAddress: 192.168.25.20

4. To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones. Click the name of the zone and search for the host by name.

5. If resolved successfully, remove the test DNS entry:

   # echo -e "server 192.168.25.1\n \update delete test.example.com 3600 IN A 192.168.25.20\n \send\n" | nsupdate -k /etc/rndc.key

6. Confirm that the DNS entry was removed:

   # nslookup test.example.com 192.168.25.1

   The above nslookup command fails and returns the SERVFAIL error message if the record was successfully deleted.

Procedure

On the Satellite or CapsuleServer that you want to configure to manage DNS service for the domain, complete the following steps:

Configuring Satellite or Capsule as a DNS server

• If you have created a backup of the answer file before configuring external DNS, restore the answer file and then enter the satellite-installer command:

  # satellite-installer

• If you do not have a suitable backup of the answer file, create a backup of the answer file now. To configure Satellite or Capsule as DNS server without using an answer file, enter the following satellite-installer command on Satellite or Capsule:

  # satellite-installer \--foreman-proxy-dns-managed=true \--foreman-proxy-dns-provider=nsupdate \--foreman-proxy-dns-server="127.0.0.1" \--foreman-proxy-dns=true

  For more information, see Configuring DNS, DHCP, and TFTP on CapsuleServer.

Updating the configuration in the Satellite web UI

1. In the Satellite web UI, navigate to Infrastructure > Capsules.
2. For each Capsule that you want to update, from the Actions list, select Refresh.

3. Configure the domain:

   1. In the Satellite web UI, navigate to Infrastructure > Domains and click the domain name that you want to configure.
   2. In the Domain tab, set DNS Capsule to the Capsule where the subnet is connected.

4. Configure the subnet:

   1. In the Satellite web UI, navigate to Infrastructure > Subnets and select the subnet name.
   2. In the Subnet tab, set IPAM to DHCP or Internal DB.
   3. In the Domains tab, select the domain that you want to manage using Satellite or Capsule.
   4. In the Capsules tab, set Reverse DNS Capsule to the Capsule where the subnet is connected.
   5. Click Submit to save the changes.