Installing Capsule Server Red Hat Satellite 6.16 Install and configure Capsule Red Hat Satellite Documentation Team satellite-doc-list@redhat.com

Commands:
nfs.example.com:/nfsshare /var/lib/pulp nfs context="system_u:object_r:var_lib_t:s0" 1 2
restorecon -R /var/lib/pulp
firewall-cmd --add-port="8000/tcp" --add-port="9090/tcp"
firewall-cmd --add-service=dns --add-service=dhcp --add-service=tftp --add-service=http --add-service=https --add-service=puppetmaster
firewall-cmd --runtime-to-permanent
firewall-cmd --list-all
hammer host-registration generate-command --activation-keys " My_Activation_Key "
hammer host-registration generate-command --activation-keys " My_Activation_Key " --insecure true
curl -X POST https://satellite.example.com/api/registration_commands --user " My_User_Name " -H 'Content-Type: application/json' -d '{ "registration_command": { "activation_keys": [" My_Activation_Key_1 , My_Activation_Key_2 "] }}'
curl -X POST https://satellite.example.com/api/registration_commands --user " My_User_Name " -H 'Content-Type: application/json' -d '{ "registration_command": { "activation_keys": [" My_Activation_Key_1 , My_Activation_Key_2 "], "insecure": true }}'
subscription-manager repos --disable "*"
subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms --enable=rhel-9-for-x86_64-appstream-rpms --enable=satellite-capsule-6.16-for-rhel-9-x86_64-rpms --enable=satellite-maintenance-6.16-for-rhel-9-x86_64-rpms
dnf repolist enabled
subscription-manager repos --disable "*"
subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms --enable=satellite-capsule-6.16-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.16-for-rhel-8-x86_64-rpms
dnf module enable satellite-capsule:el8
dnf repolist enabled
dnf install fapolicyd
satellite-maintain packages install fapolicyd
systemctl enable --now fapolicyd
systemctl status fapolicyd
dnf upgrade
dnf install satellite-capsule
mkdir /root/ capsule_cert
capsule-certs-generate --foreman-proxy-fqdn capsule.example.com --certs-tar /root/capsule_cert/ capsule.example.com -certs.tar
output omitted satellite-installer --scenario capsule --certs-tar-file "/root/capsule_cert/ capsule.example.com -certs.tar" --foreman-proxy-register-in-foreman "true" --foreman-proxy-foreman-base-url "https:// satellite.example.com " --foreman-proxy-trusted-hosts " satellite.example.com " --foreman-proxy-trusted-hosts " capsule.example.com " --foreman-proxy-oauth-consumer-key " s97QxvUAgFNAQZNGg4F9zLq2biDsxM7f " --foreman-proxy-oauth-consumer-secret " 6bpzAdMpRAfYaVZtaepYetomgBVQ6ehY "
scp /root/capsule_cert/ capsule.example.com -certs.tar root@ capsule.example.com :/root/ capsule.example.com -certs.tar
mkdir /root/capsule_cert
openssl genrsa -out /root/capsule_cert/capsule_cert_key.pem 4096
[ req ] req_extensions = v3_req distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] commonName = capsule.example.com [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection subjectAltName = @alt_names [ alt_names ] DNS.1 = capsule.example.com
[req_distinguished_name] CN = capsule.example.com countryName = My_Country_Name 1 stateOrProvinceName = My_State_Or_Province_Name 2 localityName = My_Locality_Name 3 organizationName = My_Organization_Or_Company_Name organizationalUnitName = My_Organizational_Unit_Name 4
openssl req -new -key /root/capsule_cert/capsule_cert_key.pem \ 1 -config /root/capsule_cert/openssl.cnf \ 2 -out /root/capsule_cert/capsule_cert_csr.pem 3
capsule-certs-generate --foreman-proxy-fqdn capsule.example.com --certs-tar ~/ capsule.example.com -certs.tar --server-cert /root/ capsule_cert/capsule_cert.pem \ 1 --server-key /root/ capsule_cert/capsule_cert_key.pem \ 2 --server-ca-cert /root/ capsule_cert/ca_cert_bundle.pem 3
output omitted satellite-installer --scenario capsule --certs-tar-file "/root/ capsule.example.com -certs.tar" --foreman-proxy-register-in-foreman "true" --foreman-proxy-foreman-base-url "https:// satellite.example.com " --foreman-proxy-trusted-hosts " satellite.example.com " --foreman-proxy-trusted-hosts " capsule.example.com " --foreman-proxy-oauth-consumer-key " My_OAuth_Consumer_Key " --foreman-proxy-oauth-consumer-secret " My_OAuth_Consumer_Secret "
scp ~/ capsule.example.com -certs.tar root@ capsule.example.com :/root/ capsule.example.com -certs.tar
dnf install http:// capsule.example.com /pub/katello-ca-consumer-latest.noarch.rpm
satellite-installer --foreman-trusted-proxies "127.0.0.1/8" --foreman-trusted-proxies "::1" --foreman-trusted-proxies " My_IP_address " --foreman-trusted-proxies " My_IP_range "
satellite-installer --full-help | grep -A 2 "trusted-proxies"
satellite-installer --foreman-proxy-plugin-remote-execution-script-mode=pull-mqtt
firewall-cmd --add-service=mqtt
firewall-cmd --runtime-to-permanent
satellite-installer --enable-foreman-proxy-plugin-openscap --foreman-proxy-plugin-openscap-ansible-module true --foreman-proxy-plugin-openscap-puppet-module true
hammer capsule list
hammer capsule info --id My_capsule_ID
hammer capsule content available-lifecycle-environments --id My_capsule_ID
hammer capsule content add-lifecycle-environment --id My_capsule_ID --lifecycle-environment-id My_Lifecycle_Environment_ID --organization " My_Organization "
hammer capsule content synchronize --id My_capsule_ID
hammer capsule content synchronize --id My_capsule_ID --lifecycle-environment-id My_Lifecycle_Environment_ID
hammer capsule content synchronize --id My_capsule_ID --skip-metadata-check true
satellite-installer --foreman-proxy-bmc "true" --foreman-proxy-bmc-default-provider "freeipmi"
satellite-installer --foreman-proxy-dns true --foreman-proxy-dns-managed true --foreman-proxy-dns-zone example.com --foreman-proxy-dns-reverse 2.0.192.in-addr.arpa --foreman-proxy-dhcp true --foreman-proxy-dhcp-managed true --foreman-proxy-dhcp-range " 192.0.2.100 192.0.2.150 " --foreman-proxy-dhcp-gateway 192.0.2.1 --foreman-proxy-dhcp-nameservers 192.0.2.2 --foreman-proxy-tftp true --foreman-proxy-tftp-managed true --foreman-proxy-tftp-servername 192.0.2.3
scp root@ dns.example.com :/etc/rndc.key /etc/foreman-proxy/rndc.key
restorecon -v /etc/foreman-proxy/rndc.key chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key chmod -v 640 /etc/foreman-proxy/rndc.key
echo -e "server DNS_IP_Address \n update add aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key nslookup aaa.example.com DNS_IP_Address echo -e "server DNS_IP_Address \n update delete aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key
satellite-installer --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" DNS_IP_Address " --foreman-proxy-keyfile=/etc/foreman-proxy/rndc.key
dnf install dhcp-server bind-utils
tsig-keygen -a hmac-md5 omapi_key
cat /etc/dhcp/dhcpd.conf default-lease-time 604800; max-lease-time 2592000; log-facility local7; subnet 192.168.38.0 netmask 255.255.255.0 { range 192.168.38.10 192.168.38.100 ; option routers 192.168.38.1 ; option subnet-mask 255.255.255.0 ; option domain-search " virtual.lan "; option domain-name " virtual.lan "; option domain-name-servers 8.8.8.8 ; } omapi-port 7911; key omapi_key { algorithm hmac-md5; secret " My_Secret "; }; omapi-key omapi_key;
firewall-cmd --add-service dhcp
firewall-cmd --runtime-to-permanent
id -u foreman 993 id -g foreman 990
groupadd -g 990 foreman useradd -u 993 -g 990 -s /sbin/nologin foreman
chmod o+rx /etc/dhcp/ chmod o+r /etc/dhcp/dhcpd.conf chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf
systemctl enable --now dhcpd
dnf install nfs-utils systemctl enable --now nfs-server
mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp
/var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0 /etc/dhcp /exports/etc/dhcp none bind,auto 0 0
mount -a
/exports 192.168.38.1 (rw,async,no_root_squash,fsid=0,no_subtree_check) /exports/etc/dhcp 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide) /exports/var/lib/dhcpd 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide)
exportfs -rva
firewall-cmd --add-port=7911/tcp
firewall-cmd --add-service mountd --add-service nfs --add-service rpc-bind --zone public
firewall-cmd --runtime-to-permanent
satellite-maintain packages install nfs-utils
mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd
chown -R foreman-proxy /mnt/nfs
showmount -e DHCP_Server_FQDN rpcinfo -p DHCP_Server_FQDN
DHCP_Server_FQDN :/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0 DHCP_Server_FQDN :/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0
mount -a
su foreman-proxy -s /bin/bash cat /mnt/nfs/etc/dhcp/dhcpd.conf cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases exit
satellite-installer --enable-foreman-proxy-plugin-dhcp-remote-isc --foreman-proxy-dhcp-provider=remote_isc --foreman-proxy-dhcp-server= My_DHCP_Server_FQDN --foreman-proxy-dhcp=true --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key --foreman-proxy-plugin-dhcp-remote-isc-key-secret= My_Secret --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911
mkdir -p /mnt/nfs/var/lib/tftpboot
TFTP_Server_IP_Address :/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0
mount -a
satellite-installer --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot --foreman-proxy-tftp=true
satellite-installer --foreman-proxy-tftp-servername= TFTP_Server_FQDN
kinit idm_user
ipa service-add capsule.example.com
satellite-maintain packages install ipa-client
ipa-client-install
kinit admin
rm /etc/foreman-proxy/dns.keytab
ipa-getkeytab -p capsule/ satellite.example.com@EXAMPLE.COM -s idm1.example.com -k /etc/foreman-proxy/dns.keytab
chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab
kinit -kt /etc/foreman-proxy/dns.keytab capsule/ satellite.example.com@EXAMPLE.COM
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
satellite-installer --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate_gss --foreman-proxy-dns-server=" idm1.example.com " --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab --foreman-proxy-dns-tsig-principal="capsule/ satellite.example.com@EXAMPLE.COM " --foreman-proxy-dns=true
######################################################################## include "/etc/rndc.key"; controls { inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; }; }; ########################################################################
systemctl reload named
grant "rndc-key" zonesub ANY;
scp /etc/rndc.key root@ satellite.example.com :/etc/rndc.key
restorecon -v /etc/rndc.key chown -v root:named /etc/rndc.key chmod -v 640 /etc/rndc.key
usermod -a -G named foreman-proxy
satellite-installer --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" IdM_Server_IP_Address " --foreman-proxy-dns-ttl=86400 --foreman-proxy-dns=true --foreman-proxy-keyfile=/etc/rndc.key
key "rndc-key" { algorithm hmac-md5; secret " secret-key =="; };
echo -e "server 192.168.25.1\n update add test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1
Server: 192.168.25.1 Address: 192.168.25.1#53 Name: test.example.com Address: 192.168.25.20
echo -e "server 192.168.25.1\n update delete test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1
satellite-installer
satellite-installer --foreman-proxy-dns-managed=true --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server="127.0.0.1" --foreman-proxy-dns=true
satellite-maintain packages install ipa-client
ipa-client-install
foreman-prepare-realm admin realm-capsule
scp /root/freeipa.keytab root@ capsule.example.com :/etc/foreman-proxy/freeipa.keytab
mv /root/freeipa.keytab /etc/foreman-proxy chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab
satellite-installer --foreman-proxy-realm true --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM --foreman-proxy-realm-provider freeipa
cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt update-ca-trust enable update-ca-trust
systemctl restart foreman-proxy
ipa hostgroup-add hostgroup_name --desc= hostgroup_description
ipa automember-add --type=hostgroup hostgroup_name automember_rule
ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex= ^webserver hostgroup_name ---------------------------------- Added condition(s) to " hostgroup_name " ---------------------------------- Automember Rule: automember_rule Inclusive Regex: userclass= ^webserver ---------------------------- Number of conditions added 1 ----------------------------
satellite-maintain packages install bind-utils
dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key cat Komapi_key.+*.private | grep ^Key|cut -d ' ' -f2-
satellite-installer --foreman-proxy-dhcp-key-name " My_Name " --foreman-proxy-dhcp-key-secret " My_Secret "
satellite-installer --foreman-proxy-dns true --foreman-proxy-dns-provider nsupdate --foreman-proxy-dns-managed true --foreman-proxy-dns-zone example.com --foreman-proxy-dns-reverse 2.0.192.in-addr.arpa
update-ca-trust enable openssl s_client -showcerts -connect infoblox.example.com :443 </dev/null | openssl x509 -text >/etc/pki/ca-trust/source/anchors/infoblox.crt update-ca-trust extract
curl -u admin:password https:// infoblox.example.com /wapi/v2.0/network
_ref: network/ZG5zLm5ldHdvcmskMTkyLjE2OC4yMDIuMC8yNC8w: infoblox.example.com /24/default
network: 192.168.202.0/24
network_view: default
satellite-installer --enable-foreman-proxy-plugin-dhcp-infoblox --foreman-proxy-dhcp true --foreman-proxy-dhcp-provider infoblox --foreman-proxy-dhcp-server infoblox.example.com --foreman-proxy-plugin-dhcp-infoblox-username admin --foreman-proxy-plugin-dhcp-infoblox-password infoblox --foreman-proxy-plugin-dhcp-infoblox-record-type fixedaddress --foreman-proxy-plugin-dhcp-infoblox-dns-view default --foreman-proxy-plugin-dhcp-infoblox-network-view default
satellite-installer --enable-foreman-proxy-plugin-dns-infoblox --foreman-proxy-dns true --foreman-proxy-dns-provider infoblox --foreman-proxy-plugin-dns-infoblox-dns-server infoblox.example.com --foreman-proxy-plugin-dns-infoblox-username admin --foreman-proxy-plugin-dns-infoblox-password infoblox --foreman-proxy-plugin-dns-infoblox-dns-view default
dnf module list --enabled
dnf module list --enabled
dnf module reset ruby
dnf module list --enabled
dnf module reset postgresql
dnf module enable satellite-capsule:el8
dnf install postgresql-upgrade
postgresql-setup --upgrade