Installing Satellite Server in a disconnected network environment Red Hat Satellite 6.16 Install and configure Satellite Server in a network without Internet access Red Hat Satellite Documentation Team satellite-doc-list@redhat.com

Commands:
nfs.example.com:/nfsshare /var/lib/pulp nfs context="system_u:object_r:var_lib_t:s0" 1 2
restorecon -R /var/lib/pulp
firewall-cmd --add-port="8000/tcp" --add-port="9090/tcp"
firewall-cmd --add-service=dns --add-service=dhcp --add-service=tftp --add-service=http --add-service=https --add-service=puppetmaster
firewall-cmd --runtime-to-permanent
firewall-cmd --list-all
ping -c1 localhost ping -c1 `hostname -f` # my_system.domain.com
ping -c1 localhost PING localhost (127.0.0.1) 56(84) bytes of data. 64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.043 ms --- localhost ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.043/0.043/0.043/0.000 ms ping -c1 `hostname -f` PING hostname.gateway (XX.XX.XX.XX) 56(84) bytes of data. 64 bytes from hostname.gateway (XX.XX.XX.XX): icmp_seq=1 ttl=64 time=0.019 ms --- localhost.gateway ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.019/0.019/0.019/0.000 ms
hostnamectl set-hostname name
cp /etc/foreman-installer/custom-hiera.yaml /etc/foreman-installer/custom-hiera.original
satellite-installer --tuning medium
scp localfile username@hostname:remotefile
mkdir /media/rhel
mount -o loop rhel-DVD .iso /media/rhel
cp /media/rhel/media.repo /etc/yum.repos.d/rhel.repo chmod u+w /etc/yum.repos.d/rhel.repo
[RHEL-BaseOS] name=Red Hat Enterprise Linux BaseOS mediaid=None metadata_expire=-1 gpgcheck=0 cost=500 baseurl=file:///media/rhel/BaseOS/ [RHEL-AppStream] name=Red Hat Enterprise Linux Appstream mediaid=None metadata_expire=-1 gpgcheck=0 cost=500 baseurl=file:///media/rhel/AppStream/
yum repolist
mkdir /media/sat6
mount -o loop sat6-DVD .iso /media/sat6
dnf install fapolicyd
satellite-maintain packages install fapolicyd
systemctl enable --now fapolicyd
systemctl status fapolicyd
findmnt -t iso9660
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
dnf upgrade
cd /media/sat6/
./install_packages
cd /path-to-package/
dnf install package_name
cd /media/sat6/
./install_packages
satellite-installer --scenario satellite --foreman-initial-organization " My_Organization " --foreman-initial-location " My_Location " --foreman-initial-admin-username admin_user_name --foreman-initial-admin-password admin_password
umount /media/sat6 umount /media/rhel8
hammer settings set --name subscription_connection_enabled --value false
scp ~/ manifest_file .zip root@ satellite.example.com :~/.
hammer subscription upload --file ~/ manifest_file .zip --organization " My_Organization "
hammer organization configure-cdn --name=" My_Organization " --type=custom_cdn --url https:// my-cdn.example.com --ssl-ca-credential-id " My_CDN_CA_Cert_ID "
hammer organization configure-cdn --name=" My_Organization " --type=export_sync
hammer content-credential show --name=" My_Upstream_CA_Cert " --organization=" My_Downstream_Organization "
hammer organization configure-cdn --name=" My_Downstream_Organization " --type=network_sync --url https:// upstream-satellite.example.com --username upstream_username --password upstream_password --ssl-ca-credential-id " My_Upstream_CA_Cert_ID" \ --upstream-organization-label="_My_Upstream_Organization " [--upstream-lifecycle-environment-label=" My_Lifecycle_Environment "] [--upstream-content-view-label=" My_Content_View "]
satellite-installer --foreman-proxy-plugin-remote-execution-script-mode=pull-mqtt
firewall-cmd --add-service=mqtt
firewall-cmd --runtime-to-permanent
satellite-installer --foreman-proxy-bmc "true" --foreman-proxy-bmc-default-provider "freeipmi"
satellite-installer --foreman-proxy-dns true --foreman-proxy-dns-managed true --foreman-proxy-dns-zone example.com --foreman-proxy-dns-reverse 2.0.192.in-addr.arpa --foreman-proxy-dhcp true --foreman-proxy-dhcp-managed true --foreman-proxy-dhcp-range " 192.0.2.100 192.0.2.150 " --foreman-proxy-dhcp-gateway 192.0.2.1 --foreman-proxy-dhcp-nameservers 192.0.2.2 --foreman-proxy-tftp true --foreman-proxy-tftp-managed true --foreman-proxy-tftp-servername 192.0.2.3
satellite-installer --foreman-proxy-dhcp false --foreman-proxy-dns false --foreman-proxy-tftp false
Option 66: IP address of Satellite or Capsule Option 67: /pxelinux.0
cp mailca.crt /etc/pki/ca-trust/source/anchors/ update-ca-trust enable update-ca-trust
mkdir /root/satellite_cert
openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096
[ req ] req_extensions = v3_req distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] commonName = satellite.example.com [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection subjectAltName = @alt_names [ alt_names ] DNS.1 = satellite.example.com
[req_distinguished_name] CN = satellite.example.com countryName = My_Country_Name 1 stateOrProvinceName = My_State_Or_Province_Name 2 localityName = My_Locality_Name 3 organizationName = My_Organization_Or_Company_Name organizationalUnitName = My_Organizational_Unit_Name 4
openssl req -new -key /root/satellite_cert/satellite_cert_key.pem \ 1 -config /root/satellite_cert/openssl.cnf \ 2 -out /root/satellite_cert/satellite_cert_csr.pem 3
katello-certs-check -c /root/satellite_cert/satellite_cert.pem \ 1 -k /root/satellite_cert/satellite_cert_key.pem \ 2 -b /root/satellite_cert/ca_cert_bundle.pem 3
Validation succeeded. To install the Red Hat Satellite Server with the custom certificates, run: satellite-installer --scenario satellite --certs-server-cert " /root/satellite_cert/satellite_cert.pem " --certs-server-key " /root/satellite_cert/satellite_cert_key.pem " --certs-server-ca-cert " /root/satellite_cert/ca_cert_bundle.pem " To update the certificates on a currently running Red Hat Satellite installation, run: satellite-installer --scenario satellite --certs-server-cert " /root/satellite_cert/satellite_cert.pem " --certs-server-key " /root/satellite_cert/satellite_cert_key.pem " --certs-server-ca-cert " /root/satellite_cert/ca_cert_bundle.pem " --certs-update-server --certs-update-server-ca
dnf install http:// satellite.example.com /pub/katello-ca-consumer-latest.noarch.rpm
subscription-manager repos --disable "*"
subscription-manager repos --enable=satellite-6.16-for-rhel-9-x86_64-rpms --enable=satellite-maintenance-6.16-for-rhel-9-x86_64-rpms --enable=rhel-9-for-x86_64-baseos-rpms --enable=rhel-9-for-x86_64-appstream-rpms
dnf repolist enabled
subscription-manager repos --disable "*"
subscription-manager repos --enable=satellite-6.16-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.16-for-rhel-8-x86_64-rpms --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms
dnf module enable satellite:el8
dnf repolist enabled
dnf install postgresql-server postgresql-evr postgresql-contrib
postgresql-setup initdb
vi /var/lib/pgsql/data/postgresql.conf
listen_addresses = '*'
password_encryption=scram-sha-256
vi /var/lib/pgsql/data/pg_hba.conf
host all all Satellite_ip /32 scram-sha-256
systemctl enable --now postgresql
firewall-cmd --add-service=postgresql
firewall-cmd --runtime-to-permanent
su - postgres -c psql
CREATE USER "foreman" WITH PASSWORD ' Foreman_Password '; CREATE USER "candlepin" WITH PASSWORD ' Candlepin_Password '; CREATE USER "pulp" WITH PASSWORD ' Pulpcore_Password '; CREATE DATABASE foreman OWNER foreman; CREATE DATABASE candlepin OWNER candlepin; CREATE DATABASE pulpcore OWNER pulp;
postgres=# \c pulpcore You are now connected to database "pulpcore" as user "postgres".
pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore"; CREATE EXTENSION
\q
PGPASSWORD=' Foreman_Password ' psql -h postgres.example.com -p 5432 -U foreman -d foreman -c "SELECT 1 as ping" PGPASSWORD=' Candlepin_Password ' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping" PGPASSWORD=' Pulpcore_Password ' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"
satellite-installer --katello-candlepin-manage-db false --katello-candlepin-db-host postgres.example.com --katello-candlepin-db-name candlepin --katello-candlepin-db-user candlepin --katello-candlepin-db-password Candlepin_Password --foreman-proxy-content-pulpcore-manage-postgresql false --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore --foreman-proxy-content-pulpcore-postgresql-user pulp --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password --foreman-db-manage false --foreman-db-host postgres.example.com --foreman-db-database foreman --foreman-db-username foreman --foreman-db-password Foreman_Password
--foreman-db-root-cert <path_to_CA> --foreman-db-sslmode verify-full --foreman-proxy-content-pulpcore-postgresql-ssl true --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA> --katello-candlepin-db-ssl true --katello-candlepin-db-ssl-ca <path_to_CA> --katello-candlepin-db-ssl-verify true
scp root@ dns.example.com :/etc/rndc.key /etc/foreman-proxy/rndc.key
restorecon -v /etc/foreman-proxy/rndc.key chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key chmod -v 640 /etc/foreman-proxy/rndc.key
echo -e "server DNS_IP_Address \n update add aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key nslookup aaa.example.com DNS_IP_Address echo -e "server DNS_IP_Address \n update delete aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key
satellite-installer --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" DNS_IP_Address " --foreman-proxy-keyfile=/etc/foreman-proxy/rndc.key
dnf install dhcp-server bind-utils
tsig-keygen -a hmac-md5 omapi_key
cat /etc/dhcp/dhcpd.conf default-lease-time 604800; max-lease-time 2592000; log-facility local7; subnet 192.168.38.0 netmask 255.255.255.0 { range 192.168.38.10 192.168.38.100 ; option routers 192.168.38.1 ; option subnet-mask 255.255.255.0 ; option domain-search " virtual.lan "; option domain-name " virtual.lan "; option domain-name-servers 8.8.8.8 ; } omapi-port 7911; key omapi_key { algorithm hmac-md5; secret " My_Secret "; }; omapi-key omapi_key;
firewall-cmd --add-service dhcp
firewall-cmd --runtime-to-permanent
id -u foreman 993 id -g foreman 990
groupadd -g 990 foreman useradd -u 993 -g 990 -s /sbin/nologin foreman
chmod o+rx /etc/dhcp/ chmod o+r /etc/dhcp/dhcpd.conf chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf
systemctl enable --now dhcpd
dnf install nfs-utils systemctl enable --now nfs-server
mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp
/var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0 /etc/dhcp /exports/etc/dhcp none bind,auto 0 0
mount -a
/exports 192.168.38.1 (rw,async,no_root_squash,fsid=0,no_subtree_check) /exports/etc/dhcp 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide) /exports/var/lib/dhcpd 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide)
exportfs -rva
firewall-cmd --add-port=7911/tcp
firewall-cmd --add-service mountd --add-service nfs --add-service rpc-bind --zone public
firewall-cmd --runtime-to-permanent
satellite-maintain packages install nfs-utils
mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd
chown -R foreman-proxy /mnt/nfs
showmount -e DHCP_Server_FQDN rpcinfo -p DHCP_Server_FQDN
DHCP_Server_FQDN :/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0 DHCP_Server_FQDN :/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0
mount -a
su foreman-proxy -s /bin/bash cat /mnt/nfs/etc/dhcp/dhcpd.conf cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases exit
satellite-installer --enable-foreman-proxy-plugin-dhcp-remote-isc --foreman-proxy-dhcp-provider=remote_isc --foreman-proxy-dhcp-server= My_DHCP_Server_FQDN --foreman-proxy-dhcp=true --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key --foreman-proxy-plugin-dhcp-remote-isc-key-secret= My_Secret --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911
update-ca-trust enable openssl s_client -showcerts -connect infoblox.example.com :443 </dev/null | openssl x509 -text >/etc/pki/ca-trust/source/anchors/infoblox.crt update-ca-trust extract
curl -u admin:password https:// infoblox.example.com /wapi/v2.0/network
_ref: network/ZG5zLm5ldHdvcmskMTkyLjE2OC4yMDIuMC8yNC8w: infoblox.example.com /24/default
network: 192.168.202.0/24
network_view: default
satellite-installer --enable-foreman-proxy-plugin-dhcp-infoblox --foreman-proxy-dhcp true --foreman-proxy-dhcp-provider infoblox --foreman-proxy-dhcp-server infoblox.example.com --foreman-proxy-plugin-dhcp-infoblox-username admin --foreman-proxy-plugin-dhcp-infoblox-password infoblox --foreman-proxy-plugin-dhcp-infoblox-record-type fixedaddress --foreman-proxy-plugin-dhcp-infoblox-dns-view default --foreman-proxy-plugin-dhcp-infoblox-network-view default
satellite-installer --enable-foreman-proxy-plugin-dns-infoblox --foreman-proxy-dns true --foreman-proxy-dns-provider infoblox --foreman-proxy-plugin-dns-infoblox-dns-server infoblox.example.com --foreman-proxy-plugin-dns-infoblox-username admin --foreman-proxy-plugin-dns-infoblox-password infoblox --foreman-proxy-plugin-dns-infoblox-dns-view default
mkdir -p /mnt/nfs/var/lib/tftpboot
TFTP_Server_IP_Address :/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0
mount -a
satellite-installer --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot --foreman-proxy-tftp=true
satellite-installer --foreman-proxy-tftp-servername= TFTP_Server_FQDN
kinit idm_user
ipa service-add capsule/satellite.example.com
satellite-maintain packages install ipa-client
ipa-client-install
kinit admin
rm /etc/foreman-proxy/dns.keytab
ipa-getkeytab -p capsule/ satellite.example.com@EXAMPLE.COM -s idm1.example.com -k /etc/foreman-proxy/dns.keytab
chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab
kinit -kt /etc/foreman-proxy/dns.keytab capsule/ satellite.example.com@EXAMPLE.COM
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
satellite-installer --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate_gss --foreman-proxy-dns-server=" idm1.example.com " --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab --foreman-proxy-dns-tsig-principal="capsule/ satellite.example.com@EXAMPLE.COM " --foreman-proxy-dns=true
######################################################################## include "/etc/rndc.key"; controls { inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; }; }; ########################################################################
systemctl reload named
grant "rndc-key" zonesub ANY;
scp /etc/rndc.key root@ satellite.example.com :/etc/rndc.key
restorecon -v /etc/rndc.key chown -v root:named /etc/rndc.key chmod -v 640 /etc/rndc.key
usermod -a -G named foreman-proxy
satellite-installer --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" IdM_Server_IP_Address " --foreman-proxy-dns-ttl=86400 --foreman-proxy-dns=true --foreman-proxy-keyfile=/etc/rndc.key
key "rndc-key" { algorithm hmac-md5; secret " secret-key =="; };
echo -e "server 192.168.25.1\n update add test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1
Server: 192.168.25.1 Address: 192.168.25.1#53 Name: test.example.com Address: 192.168.25.20
echo -e "server 192.168.25.1\n update delete test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1
satellite-installer
satellite-installer --foreman-proxy-dns-managed=true --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server="127.0.0.1" --foreman-proxy-dns=true
satellite-maintain packages install ipa-client
ipa-client-install
foreman-prepare-realm admin realm-capsule
scp /root/freeipa.keytab root@ capsule.example.com :/etc/foreman-proxy/freeipa.keytab
mv /root/freeipa.keytab /etc/foreman-proxy chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab
satellite-installer --foreman-proxy-realm true --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM --foreman-proxy-realm-provider freeipa
cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt update-ca-trust enable update-ca-trust
systemctl restart foreman-proxy
ipa hostgroup-add hostgroup_name --desc= hostgroup_description
ipa automember-add --type=hostgroup hostgroup_name automember_rule
ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex= ^webserver hostgroup_name ---------------------------------- Added condition(s) to " hostgroup_name " ---------------------------------- Automember Rule: automember_rule Inclusive Regex: userclass= ^webserver ---------------------------- Number of conditions added 1 ----------------------------
apache::server_tokens: Prod
apache::server_signature: Off
cp /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.backup
journalctl -xe /Stage[main]/Dhcp/File[/etc/dhcp/dhcpd.conf]: Filebucketed /etc/dhcp/dhcpd.conf to puppet with sum 622d9820b8e764ab124367c68f5fa3a1
puppet filebucket restore --local --bucket /var/lib/puppet/clientbucket /etc/dhcp/dhcpd.conf \ 622d9820b8e764ab124367c68f5fa3a1
hammer organization configure-cdn --name=" My_Organization " --type=redhat_cdn