Chapter 4. Performing additional configuration on Satellite Server 4.1. Using Red Hat Insights with Satellite Server You can use Red Hat Insights to diagnose systems and downtime related to security exploits, performance degradation and stability failures. You can use the dashboard to quickly identify key risks to stability, security, and performance. You can sort by category, view details of the impact and resolution, and then determine what systems are affected. Note that you do not require a Red Hat Insights entitlement in your subscription manifest. For more information about Satellite and Red Hat Insights, see Red Hat Insights on Satellite Red Hat Enterprise Linux (RHEL) . To maintain your Satellite Server, and improve your ability to monitor and diagnose problems you might have with Satellite, install Red Hat Insights on Satellite Server and register Satellite Server with Red Hat Insights. Scheduling insights-client Note that you can change the default schedule for running insights-client by configuring insights-client.timer on Satellite. For more information, see Changing the insights-client schedule in the Client Configuration Guide for Red Hat Insights . Procedure To install Red Hat Insights on Satellite Server, enter the following command: To register Satellite Server with Red Hat Insights, enter the following command: 4.2. Disabling Red Hat Insights registration After you install or upgrade Satellite, you can choose to unregister or register Red Hat Insights as needed. For example, if you need to use Satellite in a disconnected environment, you can unregister insights-client from Satellite Server. Prerequisites You have registered Satellite to Red Hat Customer Portal. Procedure Optional: To unregister Red Hat Insights from Satellite Server, enter the following command: Optional: To register Satellite Server with Red Hat Insights, enter the following command: 4.3. Enabling and synchronizing the Red Hat Satellite Client 6 repository The Red Hat Satellite Client 6 repository provides the katello-host-tools and puppet packages for hosts registered to Satellite. You must periodically synchronize the repository from the Red Hat Content Delivery Network (CDN) to your Satellite Server and enable the repository on your hosts. 4.3.1. Synchronizing the Red Hat Satellite Client 6 repository for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 8 To use the CLI instead of the Satellite web UI, see the procedure relevant for your Red Hat Enterprise Linux version: CLI procedure for Red Hat Enterprise Linux 9 CLI procedure for Red Hat Enterprise Linux 8 Procedure In the Satellite web UI, navigate to Content > Sync Status . Click the arrow to the Red Hat Enterprise Linux for x86_64 product to view available content. Select Red Hat Satellite Client 6 for RHEL 9 x86_64 RPMs or Red Hat Satellite Client 6 for RHEL 8 x86_64 RPMs . Click Synchronize Now . CLI procedure for Red Hat Enterprise Linux 9 Synchronize your Red Hat Satellite Client 6 repository: CLI procedure for Red Hat Enterprise Linux 8 Synchronize your Red Hat Satellite Client 6 repository: Additional resources For details about the hammer repository synchronize command, enter hammer repository synchronize --help . 4.3.2. Synchronizing the Red Hat Satellite Client 6 repository for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 6 Note You require Red Hat Enterprise Linux Extended Lifecycle Support (ELS) Add-on subscription to synchronize the repositories of Red Hat Enterprise Linux 6. For more information, see Red Hat Enterprise Linux Extended Lifecycle Support (ELS) Add-on guide. To use the CLI instead of the Satellite web UI, see the procedure relevant for your Red Hat Enterprise Linux version: CLI procedure for Red Hat Enterprise Linux 7 CLI procedure for Red Hat Enterprise Linux 6 Procedure In the Satellite web UI, navigate to Content > Sync Status . Click the arrow to the Red Hat Enterprise Linux Server or Red Hat Enterprise Linux Server - Extended Lifecycle Support . Select Red Hat Satellite Client 6 (for RHEL 7 Server) RPMs x86_64 or Red Hat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64 based on your operating system version. Click Synchronize Now . CLI procedure for Red Hat Enterprise Linux 7 Synchronize your Red Hat Satellite Client 6 repository: CLI procedure for Red Hat Enterprise Linux 6 Synchronize your Red Hat Satellite Client 6 repository: Additional resources For details about the hammer repository synchronize command, enter hammer repository synchronize --help . 4.3.3. Enabling the Red Hat Satellite Client 6 repository for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 8 To use the CLI instead of the Satellite web UI, see the procedure relevant for your Red Hat Enterprise Linux version: CLI procedure for Red Hat Enterprise Linux 9 CLI procedure for Red Hat Enterprise Linux 8 Procedure In the Satellite web UI, navigate to Content > Red Hat Repositories . In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories. Click Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs) or Red Hat Satellite Client 6 for RHEL 8 x86_64 (RPMs) to expand the repository set. For the x86_64 architecture, click the + icon to enable the repository. If the Red Hat Satellite Client 6 items are not visible, it may be because they are not included in the Red Hat subscription manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Red Hat subscription manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing content . Enable the Red Hat Satellite Client 6 repository for every supported major version of Red Hat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created. CLI procedure for Red Hat Enterprise Linux 9 Enable the Red Hat Satellite Client 6 repository: CLI procedure for Red Hat Enterprise Linux 8 Enable the Red Hat Satellite Client 6 repository: Additional resources For details about the hammer repository-set enable command, enter hammer repository-set enable --help . 4.3.4. Enabling the Red Hat Satellite Client 6 repository for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 6 Note You require Red Hat Enterprise Linux Extended Lifecycle Support (ELS) Add-on subscription to enable the repositories of Red Hat Enterprise Linux 6. For more information, see Red Hat Enterprise Linux Extended Lifecycle Support (ELS) Add-on guide. To use the CLI instead of the Satellite web UI, see the procedure relevant for your Red Hat Enterprise Linux version: CLI procedure for Red Hat Enterprise Linux 7 CLI procedure for Red Hat Enterprise Linux 6 Procedure In the Satellite web UI, navigate to Content > Red Hat Repositories . In the Available Repositories pane, enable the Recommended Repositories to get the list of repositories. In the Available Repositories pane, click on Red Hat Satellite Client 6 (for RHEL 7 Server) (RPMs) or Red Hat Satellite Client 6 (for RHEL 6 Server - ELS) (RPMs) to expand the repository set. If the Red Hat Satellite Client 6 items are not visible, it may be because they are not included in the Red Hat subscription manifest obtained from the Customer Portal. To correct that, log in to the Customer Portal, add these repositories, download the Red Hat subscription manifest and import it into Satellite. For more information, see Managing Red Hat Subscriptions in Managing content . For the x86_64 architecture, click the + icon to enable the repository. Enable the Red Hat Satellite Client 6 repository for every supported major version of Red Hat Enterprise Linux running on your hosts. After enabling a Red Hat repository, a Product for this repository is automatically created. CLI procedure for Red Hat Enterprise Linux 7 Enable the Red Hat Satellite Client 6 repository: CLI procedure for Red Hat Enterprise Linux 6 Enable the Red Hat Satellite Client 6 repository: Additional resources For details about the hammer repository-set enable command, enter hammer repository-set enable --help . 4.4. Configuring pull-based transport for remote execution By default, remote execution uses push-based SSH as the transport mechanism for the Script provider. If your infrastructure prohibits outgoing connections from Satellite Server to hosts, you can use remote execution with pull-based transport instead, because the host initiates the connection to Satellite Server. The use of pull-based transport is not limited to those infrastructures. The pull-based transport comprises pull-mqtt mode on Capsules in combination with a pull client running on hosts. Note The pull-mqtt mode works only with the Script provider. Ansible and other providers will continue to use their default transport settings. Procedure Enable the pull-based transport on your Satellite Server: Configure the firewall to allow the MQTT service on port 1883: Make the changes persistent: In pull-mqtt mode, hosts subscribe for job notifications to either your Satellite Server or any Capsule Server through which they are registered. Ensure that Satellite Server sends remote execution jobs to that same Satellite Server or Capsule Server: In the Satellite web UI, navigate to Administer > Settings . On the Content tab, set the value of Prefer registered through Capsule for remote execution to Yes . steps Configure your hosts for the pull-based transport. For more information, see Transport modes for remote execution in Managing hosts . 4.5. Configuring Satellite for UEFI HTTP boot provisioning in an IPv6 network Use this procedure to configure Satellite to provision hosts in an IPv6 network with UEFI HTTP Boot provisioning. Prerequisites Ensure that your clients can access DHCP and HTTP servers. Ensure that the UDP ports 67 and 68 are accessible by clients so clients can send DHCP requests and receive DHCP offers. Ensure that the TCP port 8000 is open for clients to download files and Kickstart templates from Satellite and Capsules. Ensure that the host provisioning interface subnet has an HTTP Boot Capsule, and Templates Capsule set. For more information, see Adding a Subnet to Satellite Server in Provisioning hosts . In the Satellite web UI, navigate to Administer > Settings > Provisioning and ensure that the Token duration setting is not set to 0 . Satellite cannot identify clients that are booting from the network by a remote IPv6 address because of unmanaged DHCPv6 service, therefore provisioning tokens must be enabled. Procedure You must disable DHCP management in the installer or not use it. For all IPv6 subnets created in Satellite, set the DHCP Capsule to blank. Optional: If the host and the DHCP server are separated by a router, configure the DHCP relay agent and point to the DHCP server. On Satellite or Capsule from which you provision, update the grub2-efi package to the latest version: Synchronize the Red Hat Enterprise Linux 8 kickstart repository. 4.6. Configuring Satellite Server with an HTTP proxy Use the following procedures to configure Satellite with an HTTP proxy. 4.6.1. Adding a default HTTP proxy to Satellite If your network uses an HTTP Proxy, you can configure Satellite Server to use an HTTP proxy for requests to the Red Hat Content Delivery Network (CDN) or another content source. Use the FQDN instead of the IP address where possible to avoid losing connectivity because of network changes. The following procedure configures a proxy only for downloading content for Satellite. To use the CLI instead of the Satellite web UI, see the CLI procedure . Procedure In the Satellite web UI, navigate to Infrastructure > HTTP Proxies . Click New HTTP Proxy . In the Name field, enter the name for the HTTP proxy. In the Url field, enter the URL of the HTTP proxy in the following format: https://proxy.example.com:8080 . Optional: If authentication is required, in the Username field, enter the username to authenticate with. Optional: If authentication is required, in the Password field, enter the password to authenticate with. To test connection to the proxy, click Test Connection . Click Submit . In the Satellite web UI, navigate to Administer > Settings , and click the Content tab. Set the Default HTTP Proxy setting to the created HTTP proxy. CLI procedure Verify that the http_proxy , https_proxy , and no_proxy variables are not set. Add an HTTP proxy entry to Satellite: Configure Satellite to use this HTTP proxy by default: 4.6.2. Configuring SELinux to ensure access to Satellite on custom ports SELinux ensures access of Red Hat Satellite and Subscription Manager only to specific ports. In the case of the HTTP cache, the TCP ports are 8080, 8118, 8123, and 10001 - 10010. If you use a port that does not have SELinux type http_cache_port_t , complete the following steps. Procedure On Satellite, to verify the ports that are permitted by SELinux for the HTTP cache, enter a command as follows: To configure SELinux to permit a port for the HTTP cache, for example 8088, enter a command as follows: 4.6.3. Using an HTTP proxy for all Satellite HTTP requests If your Satellite Server must remain behind a firewall that blocks HTTP and HTTPS, you can configure a proxy for communication with external systems, including compute resources. Note that if you are using compute resources for provisioning, and you want to use a different HTTP proxy with the compute resources, the proxy that you set for all Satellite communication takes precedence over the proxies that you set for compute resources. Procedure In the Satellite web UI, navigate to Administer > Settings . In the HTTP(S) proxy row, select the adjacent Value column and enter the proxy URL. Click the tick icon to save your changes. CLI procedure Enter the following command: 4.6.4. Excluding hosts from receiving proxied requests If you use an HTTP Proxy for all Satellite HTTP or HTTPS requests, you can prevent certain hosts from communicating through the proxy. Procedure In the Satellite web UI, navigate to Administer > Settings . In the HTTP(S) proxy except hosts row, select the adjacent Value column and enter the names of one or more hosts that you want to exclude from proxy requests. Click the tick icon to save your changes. CLI procedure Enter the following command: 4.6.5. Resetting the HTTP proxy If you want to reset the current HTTP proxy setting, unset the Default HTTP Proxy setting. Procedure In the Satellite web UI, navigate to Administer > Settings , and click the Content tab. Set the Default HTTP Proxy setting to no global default . CLI procedure Set the content_default_http_proxy setting to an empty string: 4.7. Enabling power management on hosts To perform power management tasks on hosts using the intelligent platform management interface (IPMI) or a similar protocol, you must enable the baseboard management controller (BMC) module on Satellite Server. Prerequisites All hosts must have a network interface of BMC type. Satellite Server uses this NIC to pass the appropriate credentials to the host. For more information, see Adding a Baseboard Management Controller (BMC) Interface in Managing hosts . Procedure To enable BMC, enter the following command: 4.8. Configuring DNS, DHCP, and TFTP You can manage DNS, DHCP, and TFTP centrally within the Satellite environment, or you can manage them independently after disabling their maintenance on Satellite. You can also run DNS, DHCP, and TFTP externally, outside of the Satellite environment. 4.8.1. Configuring DNS, DHCP, and TFTP on Satellite Server To configure the DNS, DHCP, and TFTP services on Satellite Server, use the satellite-installer command with the options appropriate for your environment. Any changes to the settings require entering the satellite-installer command again. You can enter the command multiple times and each time it updates all configuration files with the changed values. Prerequisites Ensure that the following information is available to you: DHCP IP address ranges DHCP gateway IP address DHCP nameserver IP address DNS information TFTP server name Use the FQDN instead of the IP address where possible in case of network changes. Contact your network administrator to ensure that you have the correct settings. Procedure Enter the satellite-installer command with the options appropriate for your environment. The following example shows configuring full provisioning services: You can monitor the progress of the satellite-installer command displayed in your prompt. You can view the logs in /var/log/foreman-installer/satellite.log . Additional resources For more information about the satellite-installer command, enter satellite-installer --help . 4.8.2. Disabling DNS, DHCP, and TFTP for unmanaged networks If you want to manage TFTP, DHCP, and DNS services manually, you must prevent Satellite from maintaining these services on the operating system and disable orchestration to avoid DHCP and DNS validation errors. However, Satellite does not remove the back-end services on the operating system. Procedure On Satellite Server, enter the following command: In the Satellite web UI, navigate to Infrastructure > Subnets and select a subnet. Click the Capsules tab and clear the DHCP Capsule , TFTP Capsule , and Reverse DNS Capsule fields. In the Satellite web UI, navigate to Infrastructure > Domains and select a domain. Clear the DNS Capsule field. Optional: If you use a DHCP service supplied by a third party, configure your DHCP server to pass the following options: For more information about DHCP options, see RFC 2132 . Note Satellite does not perform orchestration when a Capsule is not set for a given subnet and domain. When enabling or disabling Capsule associations, orchestration commands for existing hosts can fail if the expected records and configuration files are not present. When associating a Capsule to turn orchestration on, ensure the required DHCP and DNS records as well as the TFTP files are in place for the existing Satellite hosts in order to prevent host deletion failures in the future. 4.8.3. Additional resources For more information about configuring DNS, DHCP, and TFTP externally, see Chapter 6, Configuring Satellite Server with external services . For more information about configuring DHCP, DNS, and TFTP services, see Configuring Network Services in Provisioning hosts . 4.9. Configuring Satellite Server for outgoing emails To send email messages from Satellite Server, you can use either an SMTP server, or the sendmail command. Prerequisites Some SMTP servers with anti-spam protection or grey-listing features are known to cause problems. To setup outgoing email with such a service either install and configure a vanilla SMTP service on Satellite Server for relay or use the sendmail command instead. Procedure In the Satellite web UI, navigate to Administer > Settings . Click the Email tab and set the configuration options to match your preferred delivery method. The changes have an immediate effect. The following example shows the configuration options for using an SMTP server: Table 4.1. Using an SMTP server as a delivery method Name Example value Delivery method SMTP SMTP address smtp.example.com SMTP authentication login SMTP HELO/EHLO domain example.com SMTP password password SMTP port 25 SMTP username user@example.com The SMTP username and SMTP password specify the login credentials for the SMTP server. The following example uses gmail.com as an SMTP server: Table 4.2. Using gmail.com as an SMTP server Name Example value Delivery method SMTP SMTP address smtp.gmail.com SMTP authentication plain SMTP HELO/EHLO domain smtp.gmail.com SMTP enable StartTLS auto Yes SMTP password password SMTP port 587 SMTP username user @gmail.com The following example uses the sendmail command as a delivery method: Table 4.3. Using sendmail as a delivery method Name Example value Delivery method Sendmail Sendmail location /usr/sbin/sendmail Sendmail arguments -i For security reasons, both Sendmail location and Sendmail argument settings are read-only and can be only set in /etc/foreman/settings.yaml . Both settings currently cannot be set via satellite-installer . For more information see the sendmail 1 man page. If you decide to send email using an SMTP server which uses TLS authentication, also perform one of the following steps: Mark the CA certificate of the SMTP server as trusted. To do so, execute the following commands on Satellite Server: Where mailca.crt is the CA certificate of the SMTP server. Alternatively, in the Satellite web UI, set the SMTP enable StartTLS auto option to No . Click Test email to send a test message to the user's email address to confirm the configuration is working. If a message fails to send, the Satellite web UI displays an error. See the log at /var/log/foreman/production.log for further details. Additional resources For information on configuring email notifications for individual users or user groups, see Configuring Email Notification Preferences in Administering Red Hat Satellite . 4.10. Configuring an alternate CNAME for Satellite You can configure an alternate CNAME for Satellite. This might be useful if you want to deploy the Satellite web interface on a different domain name than the one that is used by client systems to connect to Satellite. You must plan the alternate CNAME configuration in advance prior to installing Capsules and registering hosts to Satellite to avoid redeploying new certificates to hosts. 4.10.1. Configuring Satellite with an alternate CNAME Use this procedure to configure Satellite with an alternate CNAME. Note that the procedures for users of a default Satellite certificate and custom certificate differ. For default Satellite certificate users If you have installed Satellite with a default Satellite certificate and want to configure Satellite with an alternate CNAME, enter the following command on Satellite to generate a new default Satellite SSL certificate with an additional CNAME. If you have not installed Satellite, you can add the --certs-cname alternate_fqdn option to the satellite-installer command to install Satellite with an alternate CNAME. For custom certificate users If you use Satellite with a custom certificate, when creating a custom certificate, include the alternate CNAME records to the custom certificate. For more information, see Creating a Custom SSL Certificate for Satellite Server . 4.10.2. Configuring hosts to use an alternate Satellite CNAME for content management If Satellite is configured with an alternate CNAME, you can configure hosts to use the alternate Satellite CNAME for content management. To do this, you must point hosts to the alternate Satellite CNAME prior to registering the hosts to Satellite. You can do this using the bootstrap script or manually. Configuring hosts with the bootstrap script On the host, run the bootstrap script with the --server alternate_fqdn.example.com option to register the host to the alternate Satellite CNAME: Configuring hosts manually On the host, edit the /etc/rhsm/rhsm.conf file to update hostname and baseurl settings to point to the alternate host name, for example: Now you can register the host with the subscription-manager . 4.11. Configuring Satellite Server with a custom SSL certificate By default, Red Hat Satellite uses a self-signed SSL certificate to enable encrypted communications between Satellite Server, external Capsule Servers, and all hosts. If you cannot use a Satellite self-signed certificate, you can configure Satellite Server to use an SSL certificate signed by an external certificate authority (CA). When you configure Red Hat Satellite with custom SSL certificates, you must fulfill the following requirements: You must use the privacy-enhanced mail (PEM) encoding for the SSL certificates. You must not use the same SSL certificate for both Satellite Server and Capsule Server. The same CA must sign certificates for Satellite Server and Capsule Server. An SSL certificate must not also be a CA certificate. An SSL certificate must include a subject alt name (SAN) entry that matches the common name (CN). An SSL certificate must be allowed for Key Encipherment using a Key Usage extension. An SSL certificate must not have a shortname as the CN. You must not set a passphrase for the private key. To configure your Satellite Server with a custom certificate, complete the following procedures: Section 4.11.1, "Creating a custom SSL certificate for Satellite Server" Section 4.11.2, "Deploying a custom SSL certificate to Satellite Server" Section 4.11.3, "Deploying a custom SSL certificate to hosts" If you have external Capsule Servers registered to Satellite Server, configure them with custom SSL certificates. For more information, see Configuring Capsule Server with a Custom SSL Certificate in Installing Capsule Server . 4.11.1. Creating a custom SSL certificate for Satellite Server Use this procedure to create a custom SSL certificate for Satellite Server. If you already have a custom SSL certificate for Satellite Server, skip this procedure. Procedure To store all the source certificate files, create a directory that is accessible only to the root user: Create a private key with which to sign the certificate signing request (CSR). Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password. If you already have a private key for this Satellite Server, skip this step. Create the /root/satellite_cert/openssl.cnf configuration file for the CSR and include the following content: Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section: 1 Two letter code 2 Full name 3 Full name (example: New York) 4 Division responsible for the certificate (example: IT department) Generate CSR: 1 Path to the private key 2 Path to the configuration file 3 Path to the CSR to generate Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server. When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files. 4.11.2. Deploying a custom SSL certificate to Satellite Server Use this procedure to configure your Satellite Server to use a custom SSL certificate signed by a Certificate Authority. The katello-certs-check command validates the input certificate files and returns the commands necessary to deploy a custom SSL certificate to Satellite Server. Important Do not store the SSL certificates or .tar bundles in /tmp or /var/tmp directory. The operating system removes files from these directories periodically. As a result, satellite-installer fails to execute while enabling features or upgrading Satellite Server. Procedure Validate the custom SSL certificate input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server. 1 Path to Satellite Server certificate file that is signed by a Certificate Authority. 2 Path to the private key that was used to sign Satellite Server certificate. 3 Path to the Certificate Authority bundle. If the command is successful, it returns two satellite-installer commands, one of which you must use to deploy a certificate to Satellite Server. Example output of katello-certs-check Note that you must not access or modify /root/ssl-build . From the output of the katello-certs-check command, depending on your requirements, enter the satellite-installer command that installs a new Satellite with custom SSL certificates or updates certificates on a currently running Satellite. If you are unsure which command to run, you can verify that Satellite is installed by checking if the file /etc/foreman-installer/scenarios.d/.installed exists. If the file exists, run the second satellite-installer command that updates certificates. Important satellite-installer needs the certificate archive file after you deploy the certificate. Do not modify or delete it. It is required, for example, when upgrading Satellite Server. On a computer with network access to Satellite Server, navigate to the following URL: https://satellite.example.com . In your browser, view the certificate details to verify the deployed certificate. 4.11.3. Deploying a custom SSL certificate to hosts After you configure Satellite to use a custom SSL certificate, you must deploy the certificate to hosts registered to Satellite. Procedure Update the SSL certificate on each host: 4.12. Using external databases with Satellite As part of the installation process for Red Hat Satellite, the satellite-installer command installs PostgreSQL databases on the same server as Satellite. In certain Satellite deployments, using external databases instead of the default local databases can help with the server load. Red Hat does not provide support or tools for external database maintenance. This includes backups, upgrades, and database tuning. You must have your own database administrator to support and maintain external databases. To create and use external databases for Satellite, you must complete the following procedures: Section 4.12.2, "Preparing a host for external databases" . Prepare a Red Hat Enterprise Linux 8 server to host the external databases. Section 4.12.3, "Installing PostgreSQL" . Prepare PostgreSQL with databases for Satellite, Candlepin and Pulp with dedicated users owning them. Section 4.12.4, "Configuring Satellite Server to use external databases" . Edit the parameters of satellite-installer to point to the new databases, and run satellite-installer . 4.12.1. PostgreSQL as an external database considerations Foreman, Katello, and Candlepin use the PostgreSQL database. If you want to use PostgreSQL as an external database, the following information can help you decide if this option is right for your Satellite configuration. Satellite supports PostgreSQL version 12. Advantages of external PostgreSQL Increase in free memory and free CPU on Satellite Flexibility to set shared_buffers on the PostgreSQL database to a high number without the risk of interfering with other services on Satellite Flexibility to tune the PostgreSQL server's system without adversely affecting Satellite operations Disadvantages of external PostgreSQL Increase in deployment complexity that can make troubleshooting more difficult The external PostgreSQL server is an additional system to patch and maintain If either Satellite or the PostgreSQL database server suffers a hardware or storage failure, Satellite is not operational If there is latency between the Satellite server and database server, performance can suffer If you suspect that the PostgreSQL database on your Satellite is causing performance problems, use the information in Satellite 6: How to enable postgres query logging to detect slow running queries to determine if you have slow queries. Queries that take longer than one second are typically caused by performance issues with large installations, and moving to an external database might not help. If you have slow queries, contact Red Hat Support. 4.12.2. Preparing a host for external databases Install a freshly provisioned system with the latest Red Hat Enterprise Linux 8 to host the external databases. Subscriptions for Red Hat Enterprise Linux do not provide the correct service level agreement for using Satellite with external databases. You must also attach a Satellite subscription to the base operating system that you want to use for the external databases. Prerequisites The prepared host must meet Satellite's Storage Requirements . Procedure Use the instructions in Attaching the Satellite Infrastructure Subscription to attach a Satellite subscription to your server. Disable all repositories and enable only the following repositories: Enable the following module: Note Enablement of the module satellite:el8 warns about a conflict with postgresql:10 and ruby:2.5 as these modules are set to the default module versions on Red Hat Enterprise Linux 8. The module satellite:el8 has a dependency for the modules postgresql:12 and ruby:2.7 that will be enabled with the satellite:el8 module. These warnings do not cause installation process failure, hence can be ignored safely. For more information about modules and lifecycle streams on Red Hat Enterprise Linux 8, see Red Hat Enterprise Linux Application Streams Lifecycle . 4.12.3. Installing PostgreSQL You can install only the same version of PostgreSQL that is installed with the satellite-installer tool during an internal database installation. Satellite supports PostgreSQL version 12. Procedure To install PostgreSQL, enter the following command: To initialize PostgreSQL, enter the following command: Edit the /var/lib/pgsql/data/postgresql.conf file: Note that the default configuration of external PostgreSQL needs to be adjusted to work with Satellite. The base recommended external database configuration adjustments are as follows: checkpoint_completion_target: 0.9 max_connections: 500 shared_buffers: 512MB work_mem: 4MB Remove the # and edit to listen to inbound connections: Edit the /var/lib/pgsql/data/pg_hba.conf file: Add the following line to the file: To start, and enable PostgreSQL service, enter the following commands: Open the postgresql port on the external PostgreSQL server: Make the changes persistent: Switch to the postgres user and start the PostgreSQL client: Create three databases and dedicated roles: one for Satellite, one for Candlepin, and one for Pulp: Connect to the Pulp database: Create the hstore extension: Exit the postgres user: From Satellite Server, test that you can access the database. If the connection succeeds, the commands return 1 . 4.12.4. Configuring Satellite Server to use external databases Use the satellite-installer command to configure Satellite to connect to an external PostgreSQL database. Prerequisites You have installed and configured a PostgreSQL database on a Red Hat Enterprise Linux server. Procedure To configure the external databases for Satellite, enter the following command: To enable the Secure Sockets Layer (SSL) protocol for these external databases, add the following options:

Commands:
satellite-maintain packages install insights-client
satellite-installer --register-with-insights
insights-client --unregister
satellite-installer --register-with-insights
hammer repository synchronize --name "Red Hat Satellite Client 6 for RHEL 9 x86_64 RPMs" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository synchronize --name "Red Hat Satellite Client 6 for RHEL 8 x86_64 RPMs" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository synchronize --async --name "Red Hat Satellite Client 6 for RHEL 7 Server RPMs x86_64" --organization " My_Organization " --product "Red Hat Enterprise Linux Server"
hammer repository synchronize --async --name "Red Hat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64" --organization " My_Organization " --product "Red Hat Enterprise Linux Server - Extended Lifecycle Support"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 for RHEL 8 x86_64 (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 (for RHEL 7 Server) (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux Server"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 (for RHEL 6 Server - ELS) (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux Server - Extended Lifecycle Support"
satellite-installer --foreman-proxy-plugin-remote-execution-script-mode=pull-mqtt
firewall-cmd --add-service=mqtt
firewall-cmd --runtime-to-permanent
satellite-maintain packages update grub2-efi
unset http_proxy unset https_proxy unset no_proxy
hammer http-proxy create --name= myproxy --url http:// myproxy.example.com :8080 --username= proxy_username --password= proxy_password
hammer settings set --name=content_default_http_proxy --value= myproxy
semanage port -l | grep http_cache http_cache_port_t tcp 8080, 8118, 8123, 10001-10010 [output truncated]
semanage port -a -t http_cache_port_t -p tcp 8088
hammer settings set --name=http_proxy --value= Proxy_URL
hammer settings set --name=http_proxy_except_list --value=[ hostname1.hostname2... ]
hammer settings set --name=content_default_http_proxy --value=""
satellite-installer --foreman-proxy-bmc "true" --foreman-proxy-bmc-default-provider "freeipmi"
satellite-installer --foreman-proxy-dns true --foreman-proxy-dns-managed true --foreman-proxy-dns-zone example.com --foreman-proxy-dns-reverse 2.0.192.in-addr.arpa --foreman-proxy-dhcp true --foreman-proxy-dhcp-managed true --foreman-proxy-dhcp-range " 192.0.2.100 192.0.2.150 " --foreman-proxy-dhcp-gateway 192.0.2.1 --foreman-proxy-dhcp-nameservers 192.0.2.2 --foreman-proxy-tftp true --foreman-proxy-tftp-managed true --foreman-proxy-tftp-servername 192.0.2.3
satellite-installer --foreman-proxy-dhcp false --foreman-proxy-dns false --foreman-proxy-tftp false
Option 66: IP address of Satellite or Capsule Option 67: /pxelinux.0
cp mailca.crt /etc/pki/ca-trust/source/anchors/ update-ca-trust enable update-ca-trust
satellite-installer --certs-cname alternate_fqdn --certs-update-server
./bootstrap.py --server alternate_fqdn.example.com
Server hostname: hostname = alternate_fqdn.example.com content omitted Content base URL: baseurl=https:// alternate_fqdn.example.com /pulp/content/
mkdir /root/satellite_cert
openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096
[ req ] req_extensions = v3_req distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] commonName = satellite.example.com [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection subjectAltName = @alt_names [ alt_names ] DNS.1 = satellite.example.com
[req_distinguished_name] CN = satellite.example.com countryName = My_Country_Name 1 stateOrProvinceName = My_State_Or_Province_Name 2 localityName = My_Locality_Name 3 organizationName = My_Organization_Or_Company_Name organizationalUnitName = My_Organizational_Unit_Name 4
openssl req -new -key /root/satellite_cert/satellite_cert_key.pem \ 1 -config /root/satellite_cert/openssl.cnf \ 2 -out /root/satellite_cert/satellite_cert_csr.pem 3
katello-certs-check -c /root/satellite_cert/satellite_cert.pem \ 1 -k /root/satellite_cert/satellite_cert_key.pem \ 2 -b /root/satellite_cert/ca_cert_bundle.pem 3
Validation succeeded. To install the Red Hat Satellite Server with the custom certificates, run: satellite-installer --scenario satellite --certs-server-cert " /root/satellite_cert/satellite_cert.pem " --certs-server-key " /root/satellite_cert/satellite_cert_key.pem " --certs-server-ca-cert " /root/satellite_cert/ca_cert_bundle.pem " To update the certificates on a currently running Red Hat Satellite installation, run: satellite-installer --scenario satellite --certs-server-cert " /root/satellite_cert/satellite_cert.pem " --certs-server-key " /root/satellite_cert/satellite_cert_key.pem " --certs-server-ca-cert " /root/satellite_cert/ca_cert_bundle.pem " --certs-update-server --certs-update-server-ca
dnf install http:// satellite.example.com /pub/katello-ca-consumer-latest.noarch.rpm
subscription-manager repos --disable '*' subscription-manager repos --enable=satellite-6.15-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.15-for-rhel-8-x86_64-rpms --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms
dnf module enable satellite:el8
dnf install postgresql-server postgresql-evr postgresql-contrib
postgresql-setup initdb
vi /var/lib/pgsql/data/postgresql.conf
listen_addresses = '*'
vi /var/lib/pgsql/data/pg_hba.conf
host all all Satellite_ip /32 md5
systemctl enable --now postgresql
firewall-cmd --add-service=postgresql
firewall-cmd --runtime-to-permanent
su - postgres -c psql
CREATE USER "foreman" WITH PASSWORD ' Foreman_Password '; CREATE USER "candlepin" WITH PASSWORD ' Candlepin_Password '; CREATE USER "pulp" WITH PASSWORD ' Pulpcore_Password '; CREATE DATABASE foreman OWNER foreman; CREATE DATABASE candlepin OWNER candlepin; CREATE DATABASE pulpcore OWNER pulp;
postgres=# \c pulpcore You are now connected to database "pulpcore" as user "postgres".
pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore"; CREATE EXTENSION
\q
PGPASSWORD=' Foreman_Password ' psql -h postgres.example.com -p 5432 -U foreman -d foreman -c "SELECT 1 as ping" PGPASSWORD=' Candlepin_Password ' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping" PGPASSWORD=' Pulpcore_Password ' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"
satellite-installer --foreman-db-database foreman --foreman-db-host postgres.example.com --foreman-db-manage false --foreman-db-password Foreman_Password --foreman-proxy-content-pulpcore-manage-postgresql false --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password --foreman-proxy-content-pulpcore-postgresql-user pulp --katello-candlepin-db-host postgres.example.com --katello-candlepin-db-name candlepin --katello-candlepin-db-password Candlepin_Password --katello-candlepin-manage-db false
--foreman-db-root-cert <path_to_CA> --foreman-db-sslmode verify-full --foreman-proxy-content-pulpcore-postgresql-ssl true --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA> --katello-candlepin-db-ssl true --katello-candlepin-db-ssl-ca <path_to_CA> --katello-candlepin-db-ssl-verify true