Joonas Lehtimäki

Implementing
InfrastructureSpacewalkHelsinki Metropolia University of Applied Sciences
Bachelor of Engineering
Information Technology
Thesis5 June 2013

into

CompanyAbstract

Author(s)Title

Joonas Lehtimäki
Implementing Spacewalk into company infrastructure

Number of Pages
Date

49 pages
5 June 2013

DegreeBachelor of Engineering

Degree ProgrammeInformation Technology

Specialisation option

Network Engineering

Instructor(s)Mika Laasasenaho, Senior Specialist
Markku Nuutinen, Principal Lecturer

The aim of this thesis was to create Spacewalk Linux management software. Capgemini
Finland ordered this software to optimize the working processes for Linux systems. The
main goal was to successfully install and configure Spacewalk so it could be used as themain management software for Linux operating systems. The thesis goes through theplanning, installation, configuration and deployment phases of Spacewalk.
In general management software help administrators to work on multiple systems at atime. Administrators can schedule maintenance tasks, for example updates or scripts.
Spacewalk saves the time and effort of each administrator and therefore saves costs.
Giving features that Capgemini had specified was an important part of this thesis. Thesefeatures were RBAC, configuration file management, update deployment and automatedinstallations. Some of the features were hard to implement because of Capgeminis’ highsecurity standards and processes. All features were documented with instructions on how
to use them.
The result of the project was a functional Spacewalk software with all the required featuresand documentation. Spacewalk is now embedded in the Capgemini infrastructure andbeing used as the main Linux management software.

Keywords

Spacewalk, Linux, Management

Abstract

Tekijä
OtsikkoSivumäärä
Aika

Joonas Lehtimäki
Spacewalksovelluksen
infrastruktuuriin

implementointi

yrityksen

49 sivua
5.6.2013

Tutkinto

Insinööri (AMK)

Koulutusohjelma

Tietotekniikka

Suuntautumisvaihtoehto

Tietoverkot

OhjaajatMika Laasasenaho, Vanhempi asiantuntija
Markku Nuutinen, Yli opettaja

Insinöörityön aiheena oli tehdä Spacewalk Linux hallinta sovellus. Capgemini Suomi tilasi
kyseisen sovelluksen optimoidakseen Linux palvelinten työprosessin. Tavoitteena oli
asentaa ja konfiguroida Spacewalk, jotta sitä pystyttäisiin käyttämään Linux hallinta
sovelluksena. Insinöörityössä käsitellään Spacewalkin suunnittelu, asennus, konfigurointi
ja käyttöönotto vaiheet.
Hallintasovellukset auttavat ylläpitäjiä hallitsemaan useita palvelimia samanaikaisesti.
Ylläpitäjät voivat ajoittaa palvelimille ylläpitotehtäviä kuten päivityksiä tai skriptejä.
Spacewalk tulee säästämään jokaisen ylläpitäjän aikaa ja vaivaa ja näin ollen myös
yrityksen kustannuksia.
Insinöörityön tärkeä osa-alue oli toimittaa Capgemini Suomelle sen vaatimat Linuxhallintasovellus ominaisuudet. Nämä ominaisuudet ovat RBAC, konfiguraatio tiedostojen
hallinta, päivitysten toimittaminen ja automaattiset asennukset. Capgeminin korkeiden
tietoturvavaatimusten vuoksi, osa ominaisuuksista oli haastavampia toteuttaa. Kaikki
hallintasovellus ominaisuudet dokumentoitiin.
Projektin lopputulos oli toimiva Spacewalk ohjelma kaikilla vaadituilla ominaisuuksilla ja
dokumenttien tuottaminen. Spacewalk on implementoitu Capgemini Suomen ympäristöön
ja sitä käytetään Linuxin päähallintasovelluksena.

Avainsanat

Spacewalk, Linux, Management1 (3)

Contents
1

Introduction

1

2

Product Introduction

2

3

Planning

34

Implementation

8

4.1

Installation

8

4.2

Configuration

11

4.2.1

Creating New Organization

14

4.2.2

Creating New User

16

4.2.3

Creating Software Channel

18

4.2.4

Creating Repository for Software Channel

20

4.2.5

Creating Activation Keys

22

4.2.6

Enabling Kickstart for Spacewalk

25

4.2.7

Creating Configuration Channels

31

4.2.8

Managing Errata

34

5

Testing37

5.1

Installing New Systems

37

5.2

Updating Systems with Spacewalk

39

5.2.1

Patching Security, Bug and Enhancement Packages

39

5.2.2

Patching All Packages

40

Managing Configuration Files

41

Deployment Planning & Implementation

42

6.1

Planning

42

6.2

Implementation

42

6.2.1

42

5.3
6

7

8

Registering Systems into Spacewalk

Maintenance

45

7.1

Updating Spacewalk

45

7.2

Manage Spacewalk

47

Conclusion

References48
49

2 (3)

Abbreviations

SLES

SUSE Linux Enterprise Server, Linux operating system developed by
SUSE.

RBAC

Role Based Access Control, approach to restricting system control for
authorized users.

PXE

Pre-boot Execution Environment, environment to boot computers using
network interface.

DHCP

Dynamic Host Configuration Protocol, network protocol that is used toconfigure devices connected to network.

RDP

Remote Desktop Protocol, protocol developed by Microsoft which is used
to connect another machine with a graphical interface.

HTTP

Hypertext

TransferProtocol,communication

protocol

used

for

communication over computer network.

HTTPS

Hypertext Transfer Protocol Secure, communication protocol used for
secure communication over a computer network.

TCP

Transmission Control Protocol, one of the two protocols used in theInternet protocol suite.

GB

Gigabyte, unit of measurement of digital information storage.

FQDN

Fully Qualified Domain Name, domain name that specifies the exact
location in the tree hierarchy of the domain name system.

CPU

Central Processing Unit, hardware within a computer that carries out
instructions of a computer.

HDD

Hard Disk Drive, data storage device used for storing and retrieving digital
information.

3 (3)

NIC

Network Interface Controller, network adapter which connects computers
into routers with a LAN or Fiber cable.

SCSI

Small Computer System Interface, standard for delivering information
between a computer and peripheral devices.

ESX

VMware product, bare metal embedded hypervisor used as a
virtualization platform.

VMXNET

Network interface adapter from VMware team. It is used in virtual
machines running on ESX hosts.

SSL

Secure Sockets Layer, protocol for encrypting information over theInternet.

ID

Identifier, name that identifies either a unique object or a unique class ofobjects.

RHEL

Red Hat Enterprise Linux, Linux distribution developed by Red Hat.
Targeted for commercial use.

URL

Uniform Resource Locator, web address given as a string of characters.

1 (49)1

Introduction

Big hosting companies such as Capgemini struggle nowadays with management
software to make hosting services cost effective and efficient. Management software
helps administrators work with large amount of systems one at a time which saves
effort and costs.

This thesis presents the installation and configuration of Linux management software
called Spacewalk which was ordered by Capgemini Finland Oy. There are many
software for management purposes but the reason why Spacewalk was chosen is that
it is a pioneer in Linux management mostly because of an active community, Red Hat
developers and it being open source. The thesis goes through planning, deployment,
configuration and maintenance steps for the product. Capgemini has a large amount ofLinux servers with numerous clients. The management software helps Capgemini be
more cost effective and competitive.

2 (49)2

Product Introduction

Spacewalk is an open source based Linux server administration tool. It is registeredunder the open source license GPLv2. Spacewalk is community driven software fromwhich few commercial products as Red Hat Satellite and Novell SUSE Manager havederived. Spacewalk started in June 2008 when it became officially an open source
project. It is based on Red Hat Network which was started in 2001 and it later spawned
into a stand-alone Red Hat Satellite product. [1.]Spacewalk has many features that allow Linux administrators to manage hardware andsoftware information, install and update systems, manage systems as a group,
provision systems, configuration file management and deployment and monitoring.
Spacewalk works with virtualization platforms such as VMware and Xen to create andconfigure virtual guests and manage systems efficiently in multiple geographicallocations. Spacewalk is managed through a web interface where all the information
about servers is located. Administration software supports many Linux distributions
such as Fedora, CentOS, SLES and Debian with both versions of architecture, 32-bit
and 64-bit. [1.]

3 (49)3

Planning

Capgemini has two infrastructures, one is for case sensitive customers and the otherone is for other customers. These infrastructures are called SUOJA and Common.
Capgemini also has many people working in India and their access to the SUOJA
infrastructure is restricted. Indian specialists handle almost all customers in the
Commoninfrastructure.

Capgemini

needs

software

that

could

handlebothinfrastructures without compromising the SUOJA infrastructure. [1.]Capgemini had features which were wanted for the selected product, RBAC which
stands for role based access control. This was needed because of the two
infrastructure environments that Capgemini has. Only Finnish specialists can accessSUOJA servers and other workers can access and see only systems in the Common
infrastructure. For software to work securely in two infrastructures, a proxy server isneeded between the environments. Spacewalk Proxy enables this feature without
firewall vulnerabilities because Spacewalk and proxy talk with each other with one
protocol. Linux automated patch management helps specialists to schedule patch
operations. This feature brings down time that specialists have to take when updating
Linux systems one at a time. Provisioning enables virtual and physical systems to beinstalled from kickstart profiles. This feature ensures that all new servers are installedin the same way with pre-configurations which saves specialists’ work effort.
Provisioning is done with PXE boot protocol which directs servers to a remote location
for installation images. PXE boot needs DHCP service enabled for the network
interface of servers. Specialists also need systems to be managed as a group. This
helps specialists to work more than one system at a time which brings down time andcosts. Deployment and modification of systems configuration files are a wanted feature
in a hosting service. Specialists can run scripts or change configuration file parameters
on multiple systems at the same time. Installing third party software as in monitoring or
backup software is a nice feature to have. Spacewalk offers all the features that
Capgemini had specified and more. [1.]Spacewalk will be placed in the SUOJA infrastructure because of security reasons sothat only Finnish specialists could access the host itself. Figure 1 shows how
Spacewalk is planted and how specialists use it.

4 (49)Figure 1. Architecture design of Spacewalk in Capgemini. [2.]Specialists connect a terminal server using Remote Desktop Protocol (RDP). The
terminal server is accessible for all Capgemini UNIX specialists. From there thespecialists use a web browser to start a session with the Spacewalk server using a
HTTPS protocol and then authenticate with it. All actions that specialists do are done
from the web interface. Spacewalk has access to the internet via the Capgemini proxy
server. The proxy is an intermediary for servers connected to the Internet and these
are used because systems are not allowed to access directly to the Internet because of
security risks. Spacewalk communicates protocols HTTP/HTTPS with the proxy server.
Spacewalk software commands client systems in the Common infrastructure via
Spacewalk proxy server. This obviates the need of two Spacewalk servers. The role ofthe proxy server is to deploy assigned commands to the systems in the Common
infrastructure. Spacewalk and proxy communicate with a static protocol TCP 5269.
Spacewalk communicates with the same protocol (TCP 5222) to the client systems as
the proxy does. Protocol TCP 69 is used for the PXE boot option. This enables systemprovisioning so that virtual and physical servers can be installed using Spacewalk
kickstart configuration files. All these ports must be opened from the firewall forSpacewalk to work.

5 (49)Spacewalk requires a couple of special software repositories. These repositories help
the installation of Spacewalk management software. The repositories that are required
are Spacewalk, EPEL and Jpackage because The Spacewalk is installed on the
CentOS operating system. [2;3]Spacewalk has hardware specifications. Capgemini uses VMware as a main
virtualization platform where management software will be installed. The spacewalk
server and proxy server specifications are introduced in the table below.
Spacewalk

Proxy server

FQDN

suo-swk-01.suoja.local

cap-spx-01.cap.local

CPU

2

1

Memory

4Gb

2Gb

HDD

100Gb

50Gb

Disk Provisioning

Thick Provision

Thick Provision

Management Network

xxx.xxx.xxx.xxx/xx

xxx.xxx.xxx.xxx/xx

Backup Network

xxx.xxx.xxx.xxx/xx

xxx.xxx.xxx.xxx/xx

Installation Network

xxx.xxx.xxx.xxx/xx

Operating System

CentOS 6.3 64-bit

CentOS 6.3 64-bit

Database

PostgreSQL

N/A

NIC amount3

2

Network Adapter

VMXNET 3

VMXNET 3

Host Provider

VMwareVMwareHardware Version

Version 8

Version 8

SCSI Controller

LSI Logic Parallel

LSI Logic Parallel

Table 1. Spacewalk and Proxy server hardware specifications. [2;3]

FQDN as a fully qualified domain name was given to Spacewalk and the proxy server.
The name was based on the naming standard of Capgemini. Spacewalk community
specified that the server can manage with two virtual CPUs and the proxy server with
one virtual CPU. The memory amount is specified to 4 GB for Spacewalk and 2 GB for
Proxy. HDD amount was specified as 6 GB per software channel and because
Capgemini uses many different Linux distributions, so 100 GB of VMware High End
storage was given to the server. Red Hat recommends that Spacewalk should have atleast 80 GB of HDD. The proxy server as it also holds packages and cache files 50 GB
HDD is specified for it. VMWare has two disk provisioning types: thick and thin

6 (49)provision. Thin provision means that storage is dynamically allocated from data storage
while thick allocates the whole size of data storage. Thick is preferred because of
performance factors. A management interface is the network where all the main traffic
moves. Backup network is dedicated for system backups only. Spacewalk is backed up
weekly and differential backups are done daily. Installation network is used for PXE
boots. Installation network has DHCP service which is running on the same Spacewalk
server. For security reasons network information cannot be shared. The operating
system is CentOS 6.3 which was the newest version of the community enterprise
operating system. Spacewalk will be installed as a minimal version of CentOS because
there is no need for extra packages. CentOS is a free open source derivative of Red
Hat Enterprise Linux. This operating system was selected because it is Spacewalk
recommended and it is a very stable Linux distribution. Spacewalk requires a database
where it stores all channel and system data. PostgreSQL was recommended by theSpacewalk community. As there are management, installation and backup networks,
three network interface controllers are needed. VMXNET 3 adapters of VMware areused for all NICs. VMXNET 3 provides the highest performance and it does not load
the CPU on high traffic. As VMware is the platform, virtual machines are using VMware
hardware version 8, which is the newest stable release. Different hardware versions
enable virtual machines to have more RAM, graphics support and for example CPU hot
swap. VMware SCSI controller LSI Logic Parallel was selected as it works perfectly on
Linux distributions. [2;3]

Kickstart will be used when deploying new systems. Kickstart is a configuration of
automatic system installation. It uses “answer files” to automate the installation
process. These features are configured from Spacewalk. A new installation network willbe created to Capgemini infrastructure to make the installation procedure as secureand easy as possible. Network mask will be of size 27 so it can hold 29 simultaneous
installation systems and one Spacewalk server. The network will have its own VLAN
which will be provided and configured to all ESX hosts and switches. The PXE bootrequires DHCP service which the Spacewalk server will provide. Systems connected tothe installation network get an IP address from Spacewalk server with DHCP service.
The systems will be connected to the installation network and boot with the PXE
protocol to cobbler and use kickstart files which are created in Spacewalk. The PXE
protocol can use a HTTP or TFTP protocol for installation. Capgemini will use the TFTP
protocol because it is the recommended one. The administrator will then select thecorrect installation template and kickstart profile will do the rest of the installation.

7 (49)Systems interface installation VLAN will be changed to production VLAN after
installation, and the correct production IP address is given.[4.]The Capgemini infrastructure uses distributions CentOS and SUSE Linux EnterpriseServer one local repository server is needed. This server will have 70Gb of HDD with 1
CPU and 2Gb of RAM. The system will create a local repository of SLES packages.
Local repositories are needed because SLES is a commercial version of Linux andpackages need to be retrieved by SLES servers and then deployed to Spacewalk. [2.]

8 (49)4

Implementation

This section will describe how Spacewalk was installed and configured to theCapgemini infrastructure. Detailed steps are introduced with photos.
4.1

Installation

Spacewalk is installed on VMware ESX host with planned hardware specifications.
After CentOS is set up and all basic configurations and security hardenings are done,
Spacewalk installation can start. Spacewalk requires a couple of special repositories
where installation packages are downloaded from. Spacewalk installation files arebrought to Linux system with the following command:
#rpm

-Uvh

http://yum.spacewalkproject.org/1.9/RHEL/6/x86_64/spacewalk-repo-1.9-1.el6.noarch.rpm
Listing 1. Spacewalk repository installation command. [2.]Spacewalk needs Java Virtual Machine 1.6.0 or greater and therefore EPEL
repositories need to be installed. EPEL repositories also provide other dependencies
that are installed with Spacewalk. Repository can be installed with the following
command:#rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/i386/epelrelease-6-8.noarch.rpm
Listing 2. Epel repository installation command. [2.]Because CentOS 6 version is used, Spacewalk requires a few dependencies fromjpackage repositories. A jpackage repository can be configured with the a following
command:9 (49)#cat > /etc/yum.repos.d/jpackage-generic.repo << EOF[jpackage-generic]
name=JPackage generic#baseurl=http://mirrors.dotsrc.org/pub/jpackage/5.0/generic/free/
mirrorlist=http://www.jpackage.org/mirrorlist.php?dist=gene
ric&type=free&release=5.0
enabled=1
gpgcheck=1
gpgkey=http://www.jpackage.org/jpackage.asc
EOF
Listing 3. Jpackage repository installation command. [2.]After all Spacewalk required dependencies are installed and configured, the software
itself can be installed. First, the PostgreSQL database is installed as listing 4 suggests:#yum install spacewalk-setup-embedded-postgresql
Listing 4. Spacewalk postgreSQL installation command. [2.]Subsequently, the Spacewalk software is installed with PostgreSQL as the database,as listing 5 demonstrates:#yum install spacewalk-postgresql
Listing 5. Spacewalk installation command. [2.]The installation will begin, and about 240Mb of files are downloaded from the different
repositories. After packages are installed iptables are turned off. This is because
Capgemini uses hardware based firewalls so software firewalls are not required, assuggested by listing 6:#service iptables stop
#chkconfig iptables off
Listing 6. IPtables service disable command. [2.]

10 (49)

The first command stops the iptables service and the second one will prevent it fromstarting on system startup. Spacewalk is now ready for the configuration phase. The
Spacewalk configuration needs to be started with the following command:#spacewalk-setup –disconnected[2.]Listing 7. Spacewalk configuration command.

The installation will go through a few steps, for example admin email address, SSL andcertificate configuration. In SSL certification, several sections must be filled for thecertificate work properly as listing 8 shows:CA certificate password? < Password for the certificate >Re-enter CA certificate password? < Confirm the password >Organization? < Organization name i.e. Capgemini >Organization Unit < Organizations team i.e. UNIX >Email Address [joonas.lehtimaki@gmail.com]? < email address
which is represented in the certificate >City? < City where Spacewalk is located i.e. Espoo >State? < State where Spacewalk is located i.e. Espoo >Country code (Examples: "US", "JP", "IN", or type "?" tosee a list)? < Country code i.e. FI for Finland >Listing 8. Spacewalk setup SSL phase. [2.]After SSL configuration, the installation asks if the cobbler should be enabled. Y or
YES has to be entered to that section. After that the installation finishes and theconfiguration phase can be started. [2;3]11 (49)

4.2

Configuration

This section describes how Spacewalk is configured for use. The software isconfigured and managed from the web interface. Administration credentials are createdon the first login to Spacewalk as shown in figure 2.

Figure 2 Spacewalk first login. Screenshot [5].

Creation of new administrative user account requires filling the desired information.
This becomes the default administration account for Spacewalk. After filling in theinformation, clicking the Create Login button to finishes the setup. [5]The Spacewalk default view is quite simple. It is very easy to read, and it informs about
every problem, scheduled tasks or updates on the first page.

12 (49)

Figure 3 Spacewalk default view. Screenshot [5].

Spacewalk is managed through several tabs. The overview tab shows if the systemneeds attention, provides a quick link to systems and displays the most recent errata
information available for the account. The overview tab also has links to different
configuration pages which are very useful. For example Your Account link goes directly
to the personal profile which can be modified. All hosts are managed from the systems
tab. From there administrators can create and view systems, create system groups,
create activation keys, create kickstart configuration profiles and use the system set
manager. The errata page is for viewing errata alerts, managing and cloning errata.
The channels tab is where managing and viewing software channels is done. Software
channels are local package databases for registered systems. Package search canalso be executed from the channels tab. On the configuration page, specialists canmanage configuration channels, actions and individual configuration files. The
configuration channel is a database for configuration files which cab be deployed to theregistered systems. The schedule tab shows all scheduled actions happening inSpacewalk. A specialist can view pending, failed, completed and archived actions. The
users page shows all users in the organization which can be managed byadministrators. The monitor tab is where monitoring probes and notifications are
displayed. Probe suites can be created which are a set of probes. The admin page isonly visible for Spacewalk administrators. There administrators can list, create andmanage one or more Spacewalk organizations and assign channel entitlements forthem. Administrator account creation is also done from this page. The Spacewalk
administrator can assign administrator rights for other accounts in all organizations.

13 (49)

The admin page also has a Spacewalk configuration sub-tab which allows to makegeneral configurations to Spacewalk including proxy settings, certificate configuration,bootstrap script configuration, organization changes and restarting the Spacewalk
server. On the overview page, a list of different images is shown (see Figure 4). [6.]Figure 4 Spacewalk legend information. Screenshot [5].

The system legend field is where information about different images is displayed. An
OK image is displayed when the system has no updates or errata available. A warning
image is displayed when updates are available, and a red critical image is displayedwhen critical updates are available. An unknown image means that Spacewalk was
unable to receive information about the system for example monitoring has failed due
to firewall blocking. A lock image is displayed when the system is in lock down.
Systems that are in lock down cannot be updated or scheduled with any activity.
Kickstarting an image means that the system is being installed from the kickstart
profile. A pending actions image is shown when the system has one or several
scheduled activities. An unentitled image is shown to the systems that are no longer
connected to Spacewalk. A monitoring status means that the server is being monitored
or information is being polled. A virtual host is a virtual platform system such as

14 (49)

VMware ESX or Citrix Xenserver. A virtual guest is a virtual machine running under thevirtual host. Non-virtual means that the system is physical server. [6.]4.2.1

Creating New Organization

Organizations in Spacewalk are like different environments. Every organization has its
own user database, repositories and software channels. Organizations can share
information, objects and configurations with each other. Creating a new organization isdone from the Spacewalk web interface as shown in figure 5.

Figure 5 Spacewalk organization view. Screenshot [5].

A link for creating an organization can be found from the Admin tab. The organization
view shows all the existing organizations in Spacewalk. A spacewalk defaultorganization is the main organization of the Spacewalk. It holds all entitlements but theadministrator can give entitlements to other organizations and those will be subtracted
from the default organization. By clicking the Create New Organization button, thecreation of an organization starts. Only Spacewalk administrators can create neworganizations.

15 (49)

Figure 6 Spacewalk create new organization form. Screenshot [5].

The organization name can be from three characters up to 128 characters long. It is
recommended that organization names are kept as specific as possible. An
administrator account name for the organization is specified in the Desire Loginsection. The administrator can manage all assets in the organization. The
administrator’s password is defined in the Desired Password and Confirm Password
section. Spacewalk also requires that email, first and last names are given. It is wise to
put a team’s information for the organization administrator. After filling in the requested
information, next step is displayed by clicking the Create Organization button.

Figure 7 Spacewalk organization subscriptions. Screenshot [5].

16 (49)

Subsequently, organization subscription amounts are defined. There are overall 20,000
subscriptions available in Spacewalk. Usually 1,000 entitlements is enough for most oforganizations. Entitlement amounts can be changed to the proposed section and byclicking update organization finishes the creation phase. [6.]Organizations also need configuration which can be done from the admin tab andselecting the organization from the organization view. The page shows details, users,
subscriptions, trust and configuration tabs. The details page is where administrators
can configure the organizations name, ID, users, systems, system groups, activation
keys, kickstart profiles and configuration channels. The users tab shows all users in theorganization. On this page users passwords, information and access rights can be
modified. Administrators can modify the amount of subscriptions in the organization
and also software channel entitlements in the subscription section. The trust pageenables organizations to share content and migrate systems between trusted
organizations. Adding a trusted organization is done by checking the box for thatorganization and clicking modify trust button which saves the settings. The
configuration tab allows organizations to stage content and limit crash file size.
Administrators can set crash file to be limitless by adding zero to the limit section. [6.]4.2.2

Creating New User

It is recommended that all administrators have their own account. This way
troubleshooting is made easier when administrators can see who has made changes toSpacewalk and when. Creating a new user is possible through the users tab and canbe done by clicking create new user link. Users will automatically join the organization
which the administrator is in. Basic account information is requested. Remember toselect the correct time zone. For example, the Finnish time zone is GMT +0200. After
creating the user, the account needs to be modified. The modify page is opened whenclicking the user account. The following page will be displayed.

17 (49)

Figure 8 Spacewalk user modification page. Screenshot [5].

The details page shows user information and roles that the user has. The organization
administrator role should only be given to appropriate employees because they have all
permissions to all system groups and their settings in that organization. Note that only
Spacewalk administrators can grant Spacewalk administrator roles to accounts. Users
can have several roles like system group, channel, activation key, configuration andmonitoring administrator. The system group administrator can manage all systems inspecific group and the users’ information. Channels provide packages for systems.
Users that are in a channel administration group can create, delete and modify thesechannels. Activation key administrators can manage activation keys which are used for
attaching systems into Spacewalk with the correct group and software channel
settings. Configuration administrators can manage configuration channels which are
used

for

synchronizing

multipleconfiguration

files

for

systems.

Monitoring

administrators can create, delete and modify monitoring profiles for system and also
create new probing settings. Attaching users to certain administrator groups is done bychecking preferred groups and saving the settings. Users can be attached to systemgroups from the system groups tab by checking groups and clicking the Update
Permissions button. Users can then view, create and modify all systems in that systemgroup. Administrators can also give access only to the selected systems from thesystems tab but users must first be added to the system group where the system lies.

18 (49)

On the channel permissions tab, administrators can restrict user permissions inchannel management. Users have access to subscribe all channels that are available
in the organization but channel management can be and should be restricted. The
preferences tab shows settings about email notifications, list sizes and the overview
page. Users can modify these setting for their liking. The addresses tab shows user
contact information like phone number, address, fax number, city, state, zip code andcountry of origin. The notification method page requires that monitoring entitlements
are in place. This tab lists email and pager addresses which will get alerts frommonitoring probes. Users can create new methods of notification by clicking create new
method and completing required fields. Users can also delete their notification methods
from this page. [6.]4.2.3

Creating Software Channel

Software channels provide packages for systems. Channels must be dedicated forcorrect Linux distribution and architecture for example CentOS 6.3-x86_64 operating
system should only have CentOS packages with 64-bit architecture. All channels haverepositories attached to them. Spacewalk repositories are links to the repositories
located on the Internet. Spacewalk downloads these packages and stores them on thelocal HDD. Software channels can be found in the manage software channels under
the Channels tab. Channels can be created from manage software channels under the
Channels tab and by clicking the create new channel button. The following page will beshown:

19 (49)

Figure 9 Spacewalk create software channel. Screenshot [5].

Channels should be named after the operating system name, version and architecturesuch as centos_5-x86_64. This helps administrators to select the correct software
channel for their systems. The channel label should be named in the same way. The
parent channel is the base channel for the child channel. Base channels consist of alist of packages based on a specified architecture and Linux distribution version. The
child channel is associated with the base channel, and it contains extra packages.
Architecture configures what packages the software channels can have. The yum
repository checksum type shows which algorithm is used when obtaining packages
with the spacewalk-repository-sync command. The SHA1 algorithm can be used foralmost every client repository because it is most compatible but SHA-256 and stronger20 (49)

ones offer higher security; however, they are less compatible with clients. Nowadays
SHA-256 is strongly recommended because SHA1 is too vulnerable. The channelsummary is for a short description of the software channel. All the description can be
written in the channel description section. The Contact/Support information section
should hold information about the creator of the software channel so if questions or
problems arise, administrators can easily find whom to contact. Channel access control
has restriction settings for the channel. Administrators can select that all or selected
users can subscribe the channel. Organization sharing settings show options as
private, protected and public. Private means that other organizations cannot access thesoftware channel and its contents. Selecting the protected option grants access to thechannel for specific trusted organizations and the public option gives permissions to all
trusted organizations. URL of the GPG key must be situated on the server. GPG key ID
is the unique identifier which makes sure that packages come from the right source.
GPG information can be retrieved from repository server of the distribution. Software
channel installation needs to be finished by clicking the create channel button. [7.]4.2.4Creating Repository for Software Channel

Repositories provide links to packages for software channels. Spacewalk uses thecommand spacewalk-repo-sync to retrieve packages using a link the repository has.
Repositories can be created from manage repositories under manage software
channels on the channels tab as shown in figure 10.

Figure 10 Spacewalk create new repository. Screenshot [5].

The repository label should be named after the channel that it is attached to. The
repository URL contains the HTTP path to the repository which in this case is21 (49)

http://ftp.funet.fi/index/Centos/5/updates/x86_64/. Enter the information and click thecreate repository button to finish the creating phase. [8.]Spacewalk repositories need to be attached to software channels and they need to besynchronized with Linux repositories regularly so that the newest packages are always
available. Attaching happens in the software channel management window as shown infigure 11.

Figure 11 Spacewalk attaching repository. Screenshot [5].

To attach the repository click the select box for wanted repositories and click the
update repositories button to save the settings. All packages coming from that
repository now belong to that software channel. All packages need to be retrieved fromthe source. [8.]The Spacewalk repository synchronization from web interface does not always work
perfectly. A good way to make sure that the packages are up to date is to make a script
which runs in Cron. Cron is a Linux operating systems scheduler. Synchronizations arescheduled to start daily at 03:00 a.m. with the script running in Cron. The script iswritten is bash:22 (49)#!/bin/bash## Spacewalk repository sync ##spacewalk-repo-sync --channel centos5-x86_64
spacewalk-repo-sync --channel centos6-x86_64
spacewalk-repo-sync --channel centos5-i386
spacewalk-repo-sync --channel centos6-i386
Listing 9. Spacewalk repository sync script. [8.]As listing 9 shows, the script starts with the definition of bash language. Spacewalkrepo-sync commands tell Spacewalk to start synchronizing the provided channel. The
script will run synchronization command for each channel individually and log the
progress in /var/log/rhn/reposync directory. [8.]4.2.5Creating Activation Keys

Activation keys are used for attaching systems into Spacewalk. Each Linux distribution
and architecture should have its own activation key, so when a registering system, it
goes to the right system category. An activation key is created on the systems tab andby clicking the activation keys link. The page shows all activation keys available in theorganization as shown in figure 12.

Figure 12 Spacewalk activation keys. Screenshot [5].

23 (49)

The enabled section tells if keys are usable in the organization. The description section
shows the name of the activation key. It is recommended that the name includes Linux
distribution,architecture,

infrastructureandcustomer

information.

This

way

administrators can easily pick the correct key for the systems. The actual activation key
is presented in the key section. It is covered for security reasons. Administrators will
use that key in the activation phase to identify the correct key. Usage tells how manysystems are registered to that key and if there are any limitations the centos6_x86_64suoja-capgemini key has one system registered and no limitations of usage. Creating a
new activation key is done by clicking create new key link in the upper right corner. The
following page will be displayed.

Figure 13 Spacewalk create activation key. Screenshot [5].

The description field should have a name that consists of Linux distribution andversion, architecture, infrastructure and client. The key section is recommended to beleft blank for security reasons. When blank it creates a random 32 character long key.
The usage field is for restricting available licenses for a specific key but because theorganization usually has enough licenses, restriction is not mandatory. Blank means
the activation key has unlimited usage. The base channel defines what channel system
is attached. For example, centos5_i686-suoja-capgemini key should be attached to thecentos-i686 base channel so that Linux distribution and architecture matches to thesystems. The add-on entitlements section defines to what service attached systems
are connected. The universal default key is the main key of the organization. This is24 (49)

recommended to be left blank. When done, clicking the create activation key finishes
creation phase. [6.]Activation keys must also be configured. Keys need to have a proper child channel andgroup so they can categorize systems properly as shown in figure 14.

Figure 14 Spacewalk activation key child channel. Screenshot [5].

The child channels tab is for attaching systems into the proper channel behind the basechannel so that systems will get correct packages. Select the wanted child channel andclick the update key to save the selection. On the packages tab, administrators can list
packages that attached systems will have. When systems are registered with theactivation key, packages will be installed from that list. Packages must exist in thechannel repository; otherwise, they are not installed. Packages can be listed as just aname or name with the extension such as nmap or nmap-5.51-2.el6.x86_64. Only one
package name should be included per line.

Figure 15 Spacewalk activation key system group. Screenshot [5].

25 (49)

The group information of activation keys is configured on the Groups tab. New
activation keys have not joined by default any group, therefore nothing is displayed on
the List/Leave tab. Group joining is done from the Join tab. Select the correct groupand click join the selected groups button to finish joining. Now all newly registeredsystems will join the specific key to the attached group. The activated systems tab
shows all systems which are registered with that activation key. The activation key is
now ready to be used. [6.]4.2.6Enabling Kickstart for Spacewalk

Spacewalk supports kickstart profiles as main its installation platform. Kickstarting
requires Cobbler and installation media. Configuration is done from the Spacewalk webinterface. First, the Spacewalk configuration files need to be changed because theinstallation network resides in a subnet other than Spacewalk management network.
The value cobbler.host in the /etc/rhn/rhn.conf file needs to match the address ofSpacewalk installation network. The values server and redhat_management_server in
the /etc/cobbler/settings file need to be corrected. Next, the Cobbler needs to get its
loaders. This is done with the following command:#cobbler get-loaders
Listing 10. Cobbler loader installation command. [9.]This command will download several files from the Internet. Next cobbler needs to bebuild:#cobbler buildiso
Listing 11. Cobbler build command. [9.]This command creates a file called generated.iso in the directory where the command
was executed. Installation files need to be added to the system. Mount Linux
installation media to the folder /mnt/ and execute the following command:#mkdir –p /var/distro-trees/<linux distribution>#cp –R /mnt/* /var/distro-trees/<linux-distribution>
Listing 12. Commands to copy image files. [9.]

26 (49)

The first command will create two folders. The first folder is where all installation media
should reside. The second command will copy all files from the installation media tothat folder. Kickstart needs DHCP and TFTP service to be enabled. A working DHCP
example is given below:## DHCP Server Configuration file.
default-lease-time 600;
max-lease-time 7200;
log-facility local7;
allow booting;allow bootp;
filename "pxelinux.0";
subnet xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx {range xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx;
option broadcast-address xxx.xxx.xxx.xxx;
option routers xxx.xxx.xxx.xxx;}
Listing 13. DHCP configuration file. [9.]Listing 3 shows different parameters in the file. Lease times can be altered as wanted.
Allow booting and bootp are necessary options for PXE boot to work. Filename is thesyslinux file which should be located in the /var/lib/tftpboot folder. If the file is missing,make sure that the system has syslinux rpm installed. The file can be found in the/usr/share/syslinux/ folder. Ensure also that the menu.c32 file is located in the tftpboot
folder. Subnet configuration can also be altered as wanted. Ensure that TFTP service
is running under xinetd service with the following command:#netstat –lnp | grep 69
Listing 14. Command to check status of TFTP service. [9.]

27 (49)

The command shows all ports that are in listening mode and the program that controls
them. If TFTP service is down, make sure that tftp configuration looks like the following:
service tftp{
disable = nosocket_type= dgramprotocol

= udp

wait

= yes

user

= rootserver= /usr/sbin/in.tftpd

server_args= -s /var/lib/tftpboot

per_source

= 11

cps

= 100 2flags

= IPv4}
Listing 15. TFTP configuration example. [9.]TFTP configuration file can be found in the /etc/xinetd.d/tftp folder. If necessary,change the configuration and restart xinetd service with the command given below:# service xinetd restart
Listing 16. Xinetd service restart command. [9.]

28 (49)

After that kickstart configuration can be done. Kickstart can be setup under the
Systems tab and kickstart.

Figure 16 Spacewalk Kickstart Overview. Screenshot [5].

The overview page displays all kickstart profiles, the status of kickstarting systems andany scheduled kickstart activity. The profiles page is where new kickstart setups are
done. The Bare Metal page shows IP addresses that have been associated withkickstart profiles. GPG and SSL keys page lists all certificates available for inclusion in
the kickstart profiles and enables creating new certificates. Every system will have the
SSL certificate of Spacewalk for it to work securely. The Distributions page enables
administrators to create and find custom installation trees which are used inkickstarting. The File Preservation page gives a chance to make a list of files that are
not altered when kickstarting. This is extremely useful when kickstarting an old systemwith custom files. [9.]The first step is to create a new distribution tree. This is done from the distribution pageby clicking create new distribution link.

29 (49)

Figure 17 Spacewalk create new distribution. Screenshot [5].

The page will require sections to be filled out. Distribution label is the name of theinstallation media, for example centos6-x86_64. Tree path section is the local path of
the installation media files, for example /var/distro-trees/centos6-x86_64. Select thematching base channel for the distribution. Select the Linux distribution that thiskickstart distribution is for. The Linux versions of Red Hat can be used in CentOS
installations. Kernel Options can have custom kernel based commands. The post
kernel option is for kernel custom commands that are meant to be used after the
installation. The next step is to make the kickstart configuration profile. This is done
from the Profiles page by clicking the create new kickstart profile button. First, the labelof the profile needs to be entered. The base channel also needs to be selected. The
kickstart able tree drop down list is shown based on the base channel selection. The
virtualization type selection is for XEN and KVM based virtualization platforms. Selectthe correct type and when done click the next button to display the kickstart profile
configuration page. [9.]

30 (49)

Figure 18 Spacewalk create kickstart profile. Screenshot [5].

The first page shows the basic configurations which were gathered from distribution
configurations. This page allows having logging enabled for the kickstart procedure.
The operating system tab administrator can modify the base channel, child channels
and available trees. Note that it is not recommended to have the update child channel
selected because installation can fail because of that. The variables page is used for
substitute values to the kickstart profile. The advanced option tab enables
administrators easily to modify kickstart configuration such as keyboard layout, logging,and firewall. The bare metal kickstart page enables defining IP address ranges for the
kickstart profile. The profile can only be used from a specified IP address range. [9.]The sub-tabs on the system detail page are details, locale, partitioning, file
preservation, GPG & SSL and troubleshooting.

The details page enables

administrators to manage SELinux parameters. Administrators can also select if thesystem will be enabled to have configuration management and remote commands. A
root password can be applied from this page. The locale sub-tab shows the timezone
option for the profile. Finland uses the Europe/Helsinki option. The partitioning pageenables administrators to alter the partition table of kickstarted systems. The file
preservation page shows all the files that have been listed as preserved for this profile.
On the GPG & SSL page the administrator can select which certification will be
deployed in to the system. The troubleshooting tab gives options for administrators tosolve hardware and other issues in the created systems. [9.]

31 (49)

The software page is for administrators to select packages or package groups that will
be installed when kickstarting. It is recommended that in addition to base packages thefollowing will be installed: rhn-check, rhn-setup, yum-rhn-plugin, python-ethtool, pythondmidecode, rhncfg-client and rhncfg-actions. With these packages, setup can register asystem, and all necessary client tools are found. The kickstart profile can be attached
to an activation key which will automatically bring the system to the correct systemgroup and software channel. Scripts page administrators can write scripts to be
executed before or after installation. This is a very useful tool when for example
creating users or giving basic security settings for new systems. The kickstart pageshows the kickstart profile which is used when kickstarting. Administrators can also
download the profile. After profile creation, Spacewalk is set for installing new systems.
Profiles can be found from the /var/lib/tftpboot/images folder. [9.]4.2.7Creating Configuration Channels

Configuration channels enable administrators to modify, create and deploy
configuration files or scripts for multiple servers at the same time. This feature is very
useful for example when the /etc/hosts file has to be up to date with the IP address ofeach system in the infrastructure. Creating the configuration channel can be done fromthe configuration channels page on the configuration tab and by clicking the create new
config channel button. A new page opens and administrators are required to enter thename, label and description of the channel. The next page will show the overview pageof the newly created configuration channel. It shows overall information about thechannel as shown in figure 19.

Figure 19 Spacewalk Configuration Channel Overview. Screenshot [5].

32 (49)

A couple of options will be needed for the configuration channel to work properly. Files
can be imported, uploaded or created from the add files tab. From the systems tab thesystems are connected to the channel and also contains a list of all systems attachedto the channel. First, the systems need to be added to the configuration channel. Eachsystem needs few packages for this feature to work. Install these packages with thefollowing command:#yum install –y rhncfg rhncfg-actions rhncfg-client
Listing 17. RHN package installation commands. [9.]Go to the systems page on the configuration tab. Then select target systems and thepage will display every system that has not been targeted for configuration channels.
Select the system which needs to be targeted and click the enable Spacewalk
configuration management button. Sometimes the configuration feature will need to be
setup by hand. Entering these commands from the client command line will enable thefeature:#rhn_check#rhn-actions-control –enable all
Listing 18. Commands to enable software configuration.[5]After this step the systems can be subscribed to configuration channels. This is done
either from activation key management or from configuration channel settings on thesystems tab.

Figure 20 Spacewalk subscribe configuration channel. Screenshot [5].

The subscribed systems tab shows all systems that are getting configuration files fromthe channel. Systems are added to the channel from the target systems tab. Select thewanted systems and click the subscribe button to attach them to the channel.

33 (49)

Adding files to the configuration channel can be done in three different ways:
uploading, importing and creating files. Administrators can upload files to Spacewalkfrom their workstation or network location. Importing enables administrators to collectfiles from other channels in the organization. Creating files creates a new file to thesystem:Figure 21 Spacewalk create configuration file. Screenshot [5].

Creating a file needs a few configuration steps. First, the file type must be specified. It
can be a text file, directory or symbolic link. The text file can be a configuration file,
script or just a text file. The directory creates a new directory to the system. The
symbolic link creates a link to the wanted file so it can be accessed from anotherlocation. The filename/path section specifies the location where the file, directory or
symbolic link will be created. The ownership of the file can be selected. In most cases,for security reasons, it is good that root is both the user and the group. Note that if theusername or group does not exist in the system, deployment of the file will fail. The filepermission mode gives the files and directories permissions according to a three digit
number. These numbers are based on octal digits. The best practice for thepermissions is that the text and configuration files will have 644 permissions so they
can be read but not modified, and directories and executables should have 755
permissions so they can be executed and read but not modified by anyone else than
the root. The SELinux section specifies the required file attributes that are enabledsuch as user, role or file type. Macro delimiters define the symbols that mark the34 (49)

beginning and the end of a macro. File contents are available only when creating a newtext file. Enter the configuration, text or script lines into the file and click the create
configuration file button to finish the creation phase. [6.]4.2.8Managing Errata

Errata is information about packages that have security, bug fix or enhancement
updates available. Distributions stop their support at some point for later versions andinformation about for example security patches become unavailable. Errata helps todetect these issues even in later versions of packages. Errata legends are shown infigure 22.

Figure 22 Spacewalk Errata Legend. Screenshot [5].

Security errata are for packages that need a security patch. These packages must be
updated as soon as possible. Bug fix errata contain updates to the issues in the
package that were reported by users or discovered during development or testing.
Enhancement errata means that a newer version of a package contains either new
features, improved functionality or enhanced performance. [6.]Errata information is brought to Spacewalk by a script. This is because CentOS does
not provide a straight way to errata. Fixes are reported via mailing lists or posted on theweb. Script is written in bash as shown in listing 19.

35 (49)#!/bin/bash
cd /etc/rhn/
export http_proxy=http://<ip address and port>
export https_proxy=http://<ip address and port>
wget -N http://cefs.steve-meier.de/errata.latest.xml
wget

-N

https://www.redhat.com/security/data/oval/com.redhat.rhsaall.xml
export SPACEWALK_USER='<spacewalkadmin username>'
export SPACEWALK_PASS='<password>'./errata-import.pl --server suo-swk-01.suoja.local --errata
errata.latest.xml--rhsa-oval

com.redhat.rhsa-all.xml--

publishunset http_proxyunset https_proxyunset SPACEWALK_USER
unset SPACEWALK_PASS
Listing 19. Spacewalk errata sync script. [4.]This script is located in the /etc/rhn folder. The script will start going to the folder/etc/rhn with the cd command. As listing 19 illustrates, HTTP and HTTPS proxies are
set with an export command. The script checks if a new errata xml file is available withthe wget command. Then the script exports the Spacewalk admin username andpassword to two variables which are used in the errata-import.pl script. This script wasprovided on the Internet. The script needs the command server, errata, rhsa-oval andpublish to work correctly. The Spacewalks FQDN name is specified in the --servercommand, --errata

points to the location where the xml file is found, --rhsa-oval

indicates the Red Hat oval errata xml location and --publish enables errata to besynchronized with Spacewalk software channels. Unset commands are used to clear
the variables. This is done for security reasons. To always get the latest versions oferrata, the script will run daily at 01:00 a.m. [4.]Errata is now displayed on the Errata tab. The relevant page shows errata updates forthe registered systems. The list contains information about each errata update
including its severity, type, advisory number and the systems’ affected. All sub-tabs

36 (49)

show all the errata information available in the Spacewalk organization. Administrators
can also search for any errata on the advanced search page. [6.]

37 (49)

5

Testing

5.1

Installing New Systems

Installing new systems is done using a kickstart automated process. In the VMware
environment administrators need to create a new VMware server with requested
specifications. Spacewalk can make new virtual machines to XEN and KVM based
virtualization environments. Capgemini will use specific VLAN for the installation
network. This needs to be changed in the interface so that DHCP and Cobbler will workas wanted. After installations, VLAN must be changed to the production VLAN. The
kickstart test phase will consist of installing all used versions of Linux in Capgemini,
which includes CentOS and RHEL versions 5.8 & 6.3. SLES does not support kickstart
configuration, so it cannot be used in Spacewalk. [9.]The systems will get their IP address from the DHCP service in Spacewalk server. The
network can hold up to 29 simultaneous installation addresses. On boot, theadministrator needs to choose the network boot option, and after DHCP request, theCobbler menu will be displayed:

Figure 23 Spacewalk cobbler menu. Screenshot [10].

This is the Cobbler menu. Here administrators can choose which installation profile will
be used. The name specifies which distribution, architecture and installation type isused. For example, centos63-i386-suoja-minimal will create CentOS 6.3 minimal

38 (49)

installation with architecture i386 and the location will be in the SUOJA system group.
The installation will proceed several installation steps automatically.

Figure 24 Spacewalk kickstart automated installation. Screenshot [10].

After installation, the system will reboot and show the login screen. Login credentials
are created with post scripts in kickstart profile. System will be displayed in Spacewalk
as localhost.localdomain because hostname can’t be given while installing. Because ofthis systems need to be re-registered with Spacewalk. This must be done after
changing hostname and interface VLAN to production. Re-registration is done withcommand:#rhnreg_ks--serverUrl=http://<ip

address>/XMLRPC--

activationkey=<activation key number> --force
Listing 20. Registering client command. [11]After that re-registration server is getting all necessary update packages and features.
Installation profile localhost.localdomain can be removed from the Spacewalk. Eachinstallation step was successful and so this feature can be brought into production use.
[11.]

39 (49)

5.2

Updating Systems with Spacewalk

Spacewalk can be used to update packages for one or multiple systems at the sametime. Package updates can be scheduled as wanted. With errata information packages
can be updated with specific profile i.e. security, bug fix or enhancement.
Administrators can also update all packages available in the software channel.
5.2.1

Patching Security, Bug and Enhancement Packages

Security patches can be applied to systems by going systems information and selecting
errata sub tab under software tab. Select security advisory from the drop down box andclick show button which will show all security related packages.

Figure 25 Spacewalk patching security fixes. Screenshot [5].

All security packages will be displayed with a lock icon. Click select all buttons tochoose all packages for update and click apply the errata button and confirm on thenext page. Spacewalk will schedule package installations to the administrators’
choosing. Administrators can view the patch process from the schedule tab. After thepatch process, the system will be security patched. [6.]

40 (49)

Bug fixes can be applied from the same menu than security fixes. Select bug fix
advisory from the drop down box and click the show button to display the packages
with bugs. [6.]All bug fixes are displayed on that page. Click the select all button to choose all
packages and click the apply errata and confirm the selection. Spacewalk will schedulethese in the same way as the security patches. Enhancement package updates aredone in the same way as the security and bug fixes. [6.]5.2.2

Patching All Packages

A full system patch can also be applied from Spacewalk. This is done from the upgrade
page which is located under the software and packages.

Figure 26 Spacewalk patching system. Screenshot [5].

All packages that have an update available will be displayed as shown in the figure 26.
Page shows which version is installed of the package and which version is available.
Errata information is also shown for relevant packages. Click the select all button to
select all packages and click the upgrade button and confirm after that to submit thepatch process. The patch process will be displayed on the schedule tab. [6.]

41 (49)

After patching, the systems will need to be restarted if updates include kernel patches.
Spacewalk will show systems that need to be restarted on the systems sub tab and on
the requiring reboot page. Scheduling a reboot can be done by clicking the systemname and clicking the Schedule System Reboot link. [6.]5.3Managing Configuration Files

Testing configuration file management will be done with two systems connected toSpacewalk. A configuration channel called Test will be used. This channel holds one
script file which will be deployed to /tmp/ location. Deployment of the file will be done
from the deploy file tab of the configuration channel.

Figure 27 Spacewalk deploy configuration file. Screenshot [5].

All files in the configuration channel are displayed on the deploy file page. The pageshows the configurations file name, modification and version number. Version numbers
are displayed as revision numbers. Each revision is saved in Spacewalk and they canbe compared from the compare link under the Actions column. To deploy a file, select it
and click the deploy selected files button, or if all files need to be deployed, click the
deploy all files button. The administrator must then select the systems where theconfiguration file will be deployed. In this case the administrator will deploy one file totwo systems. After selection is done, click confirm and deploy button to deploy the files.
After the schedule tab shows that the operation was successfully completed theadministrator will log on to the systems and study the /tmp/ directory to see if the script
has arrived with the correct settings and context. [6.]

42 (49)

6

Deployment Planning & Implementation

This section will cover the planning and implementation phase when Spacewalk iscorrectly installed, configured and ready to use. Every company is different, andplanning how to attach systems that are already in production into Spacewalk is crucial.
6.1

Planning

Deployment will be done one customer at a time. Systems that have the lowest priority
will be added first. After adding development and test systems, they will be tested
against Spacewalk. Production systems can be registered when no errors occur.
Systems will be registered in the same way with correct activation keys. Everycustomer will have their own system category and the administrator’s rights will be
setup accordingly. Configuration files will be added to the systems for example hosts
files will be identical with every system in one company. Administrators will be
educated to Spacewalk so that they know how to use it in every situation.
6.2

Implementation

Systems need to be registered with Spacewalk. The registration process will be done
to one customer at a time. This helps administrators work and errors can be noticed
easily. The new installation procedure is instructed to administrators.
6.2.1

Registering Systems into Spacewalk

Every system that has not been installed through the Spacewalk kickstart profile needs
to be registered. Attaching is done using Red Hat tools. These tools can be installedfrom Spacewalk client repository. To install Spacewalk repository to different
distributions, select one of these commands:

RHEL 5 / CentOS 5:#BASEARCH=$(uname -i)
#rpm

-Uvh

http://yum.spacewalkproject.org/1.9-

client/RHEL/5/$BASEARCH/spacewalk-client-repo-1.91.el5.noarch.rpm
Listing 21. Spacewalk client repository install command. [11.]43 (49)

RHEL 6 / CentOS 6:#BASEARCH=$(uname -i)
#rpm

-Uvh

http://yum.spacewalkproject.org/1.9-

client/RHEL/6/$BASEARCH/spacewalk-client-repo-1.91.el6.noarch.rpm
Listing 22. Spacewalk client repository install command. [11.]Extra packages may be needed when installing the Red Hat tools. These EPEL
repositories (see listings 23- 24) will provide the needed packages:

RHEL 5 / CentOS 5:
BASEARCH=$(uname -i)#rpm -Uvh
http://dl.fedoraproject.org/pub/epel/5/$BASEARCH/epelrelease-5-4.noarch.rpm
Listing 23. EPEL repository install command. [11.]RHEL 6 / CentOS 6:# BASEARCH=$(uname -i)#rpm -Uvh
http://dl.fedoraproject.org/pub/epel/6/$BASEARCH/epelrelease-6-7.noarch.rpm
Listing 24. EPEL repository install command. [11.]After repositories are setup, the required client packages can be installed:#yuminstallrhn-client-tools

rhn-checkrhn-setuprhnsd

m2crypto yum-rhn-plugin
Listing 25. Spacewalk client package installation command. [11.]SLES requires a different repository. In SLES 11 openSUSE 12 repositories will be
used. These will work fine with it. Install the repository with the following command:# zypper ar -f
http://download.opensuse.org/repositories/systemsmanagement:/spacewalk/SLE_11_SP2/systemsmanagement:spacewalk.repo
Listing 26. Spacewalk client repository for SLES installation command. [11.]44 (49)

After the repository is installed SLES requires several packages. Installation is donewith command given below:#

zypperinstallrhn-client-tools

zypp-plugin-spacewalk

rhnsd rhn-setup rhn-check yum
Listing 27. Spacewalk client installation command for SLES. [11.]These packages will enable different features in Spacewalk. After installation finishes,disable Spacewalk and all other repositories so client will not try to update packages
from that repository. This is done from /etc/yum.repos.d/<repository-name>.repo file byswitching enabled value to 0. In SLES, repositories are disabled in the same way but
from the directory /etc/zypp/repos.d/. Registering the system can now be done aslisting 28 suggests:#rhnreg_ks--serverUrl=http://<Spacewalk-server-URL>/XMLRPC--activationkey=<activation key number>
Listing 28. Client registration command. [11.]The server URL is the address for the Spacewalk server and the activation key is theuniqueSpacewalkactivation

key

for

example:2-12345678912345678912345678912345. Make sure that the correct activation key isused for the registration. The system will now be displayed on Spacewalk systems tab.

If the system is registered with the wrong activation key, it can be re-registered to theSpacewalk. Re-registering is done with the following command:#rhnreg_ks--serverUrl=http://<ip

address>/XMLRPC--

activationkey=<activation key number> --force
Listing 29. Client re-registration command. [11.]The command is almost same as the normal registration command but --force will force
system to register even if it is found in Spacewalk. The system will be deleted from theexisting group and added to the new one. [11.]45 (49)

7

MaintenanceThis section describes how to maintain Spacewalk. Spacewalk does not need much
maintenance but it can be updated to the latest version. This section also describes
how to restart Spacewalk and how to manage its processes.
7.1

Updating Spacewalk

Spacewalk upgrades are presented regularly. These patches include enhancements,
new features and bug fixes. The Spacewalk upgrade requires a few prerequisites:
enabled EPEL repositories, enabled CentOS/RHEL repositories and the Spacewalk
repository needs to be replaced with the newest one for example when upgrading from
1.8 to 1.9, change the Spacewalk repository URL from the /etc/yum.repos.d/ folder.
[12.]

After the prerequisites are configured, upgrade the procedure start. First, the files need
to be backed up. It is a good practice to use a different server when backing up files.
Backup files are backed up with the following commands:
#

scp

–R

/etc/sysconfig/rhn/*<ip

addressofbackupserver>:/tmp/Backup/sysrhn
#

scp

–R

/etc/rhn/*<ip

addressofbackupaddressofbackupaddressofbackupserver>:/tmp/Backup/rhn
#

scp

–R

/etc/jabberd/*<ipserver>:/tmp/Backup/jabberd
#

scp

–R

/root/ssl-build/*<ip

server>:/tmp/Backup/ssl-build
Listing 30. File transfer commands.[12.]After backups are done, the administrator needs to take a backup of the postgreSQL or
Oracle databases. The dump file can also be sent to a remote server. The next
procedure needs Spacewalk to be shutdown with the command given below:#spacewalk-service stop
Listing 31. Spacewalk service stop command. [12.]When Spacewalk has shut down all its processes, yum repositories must be updated.
This command will update all packages in the Spacewalk system:46 (49)#yum upgrade
Listing 32. Update packages command. [12.]After the packages have been upgraded, check all .rpmnew/.rpmsave files which werecreated during the upgrade procedure. These files describe the changes made to theconfiguration files. Run this command to ensure configuration files have beenpreserved:# yum install rpmconf# rpmconf –aListing 33. Package installation command. [12.]The next procedure is schema upgrading. This upgrades the database schema of theSpacewalk server. Make sure that Spacewalk is still in shutdown state:#spacewalk-service status
Listing 34. Show Spacewalk status command. [12.]If Spacewalk processes are shut down, the database schema can be upgraded. Make
sure that a backup exists of the database. The schema can be upgraded with thefollowing command:#spacewalk-schema-upgrade
Listing 35. Spacewalk database upgrade command. [12.]Schema upgrade logs can be found in /var/log/spacewalk/schema-upgrade. If the
upgrade fails, the cause of the failure will be displayed in the log file. When the upgrade
fails, the recommended procedure is to first investigate, then restore from backup, fix
the cause and rerun the spacewalk-schema-upgrade command. After a successful
database upgrade, Spacewalk configuration needs to be upgraded. This is done withthe command given below:#spacewalk-setup –disconnected –external-db –upgrade
Listing 36. Spacewalk configuration after upgrade command. [12.]47 (49)

After the update is done, restore the modified values from the /etc/rhn/rhn.conf file.
When done, the administrator can start the Spacewalk service with the command
below:#spacewalk-service start
Listing 37. Start Spacewalk command. [12.]Spacewalk will start all its required processes. Now Spacewalk is upgraded to thelatest version. [12.]7.2Manage Spacewalk

Spacewalk processes can be managed from the command line or from the webinterface Admin tab. It is recommended to use the command line if Spacewalk freezes
or any problems occur. Spacewalk processes can be managed with the following
command:#spacewalk-service start/stop/status/restart
Listing 38. Spacewalk service commands. [3.]The start sub-command will start all Spacewalk services. Stop will halt Spacewalk. Thisis good to do before restarting the platform server or doing changes to Spacewalk core
files. The status shows all processes of Spacewalk and their status. This is good for for
example troubleshooting purposes to see what processes are up and running andwhich are not. The restart sub-command will make stop and start commands
automatically. Spacewalk has a built in debug command as shown in listing 39:#spacewalk-debug –dirListing 39. Spacewalk debug command. [6.]This command is a utility for troubleshooting problems with Spacewalk. It packages alllog files to a designated folder with the --dir parameter. This command provides full
diagnostics of Spacewalk server issues.

Spacewalk-debug and spacewalk-service commands are the most importantcommands in Spacewalk. Administrators can solve most of the issues with only thesetwo commands. [6]48 (49)

8

Conclusion

The goal of this project was to create working Linux management software forCapgemini Finland. Spacewalk was selected as the management software because it
is a pioneer in the Linux management. The main objectives were that with Spacewalk
the company’s administrators could easily manage multiple systems at the same time,
deploy updates, deploy configuration files and have role based access control. These
objectives were successfully added to Spacewalk.

Difficulties included implementing the SLES operating system to the Spacewalk. Thiswas difficult because SLES is based on its own Linux distribution and support is
minimal. All difficulties were beaten with work around solutions, such as a local SLES
repository server had to be created because repositories could not be gathered fromNovell sites.

In the future, Spacewalk could be enhanced by delivering updates to the Solaris
systems and deploying a monitoring feature. Also an audit feature could be
implemented, so customers could get automatic reports of their systems.

Overall this project was a success. Spacewalk is now running and it has already been
implemented to the Capgemini infrastructure.

49 (49)

References
1

Spacewalk community. Free & Open Source Systems Management [online].
2010.
URL: http://spacewalk.redhat.com/. Accessed 20 March 2013.

2

Red Hat. Proxy Installation Guide [online]. Red Hat; 2010.
URL: https://access.redhat.com/site/documentation/en-US/
Red_Hat_Network_Satellite/5.4/html-single/Proxy_Installation_Guide/ index.html.
Accessed 20 March 2013.

3

Spacewalk community. Spacewalk Installation Instructions [online]; 2013.
URL: https://fedorahosted.org/spacewalk/wiki/HowToInstall. Accessed 20 March
2013.

4

Steve Meier. CEFS: CentOS Errata for Spacewalk [online]; 2013.
URL: http://cefs.steve-meier.de/. Accessed 20 April 2013.

5

Spacewalk [software]. Version 1.9. Red Hat; 2013.

6

Red Hat. Red hat Network Satellite [online]; Red Hat; 2013.
URL: https://access.redhat.com/site/documentation/en-US/
Red_Hat_Network_Satellite/5.5/html/Reference_Guide/index.html. Accessed 23
March 2013.

7

CentOS community. Spacewalk [online]; 2013.
URL: http://wiki.centos.org/HowTos/PackageManagement/Spacewalk. Accessed
20 March 2013.

8

Spacewalk community. Upload content to Spacewalk [online]; 2012.
URL: https://fedorahosted.org/spacewalk/wiki/UploadFedoraContent. Accessed
21 March 2013.

9

Xebia. How To Walk With Spacewalk [online]; 2011.
URL: http://blog.xebia.com/2011/12/19/how-to-walk-with-spacewalk/. Accessed
25 April 2013.

10

VMware virtual console [software]. Version 5.1. VMware; 2013.

11

Spacewalk community. Registering clients [online]; 2013.
URL: https://fedorahosted.org/spacewalk/wiki/RegisteringClients. Accessed 4
April 2013.

12

Spacewalk community. Spacewalk Upgrade Instructions [online]; 2013.
URL: https://fedorahosted.org/spacewalk/wiki/HowToUpgrade. Accessed 3 May
2013