Chapter 4. Configuring Capsule Server with External Services If you do not want to configure the DNS, DHCP, and TFTP services on Capsule Server, use this section to configure your Capsule Server to work with external DNS, DHCP and TFTP services. 4.1. Configuring Capsule Server with External DNS You can configure Capsule Server with external DNS. Capsule Server uses the nsupdate utility to update DNS records on the remote server. To make any changes persistent, you must enter the satellite-installer command with the options appropriate for your environment. Prerequisites You must have a configured external DNS server. This guide assumes you have an existing installation. Procedure Copy the /etc/rndc.key file from the external DNS server to Capsule Server: Configure the ownership, permissions, and SELinux context: To test the nsupdate utility, add a host remotely: Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file: In the Satellite web UI, navigate to Infrastructure > Capsules . Locate the Capsule Server and select Refresh from the list in the Actions column. Associate the DNS service with the appropriate subnets and domain. 4.2. Configuring Capsule Server with External DHCP To configure Capsule Server with external DHCP, you must complete the following procedures: Section 4.2.1, "Configuring an External DHCP Server to Use with Capsule Server" Section 4.2.2, "Configuring Satellite Server with an External DHCP Server" 4.2.1. Configuring an External DHCP Server to Use with Capsule Server To configure an external DHCP server running Red Hat Enterprise Linux to use with Capsule Server, you must install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) or its utility packages. You must also share the DHCP configuration and lease files with Capsule Server. The example in this procedure uses the distributed Network File System (NFS) protocol to share the DHCP configuration and lease files. Note If you use dnsmasq as an external DHCP server, enable the dhcp-no-override setting. This is required because Satellite creates configuration files on the TFTP server under the grub2/ subdirectory. If the dhcp-no-override setting is disabled, clients fetch the bootloader and its configuration from the root directory, which might cause an error. Procedure On your Red Hat Enterprise Linux host, install the ISC DHCP Service and BIND packages or its utility packages depending on your host version. For Red Hat Enterprise Linux 7 host: For Red Hat Enterprise Linux 8 host: Generate a security token: As a result, a key pair that consists of two files is created in the current directory. Copy the secret hash from the key: Edit the dhcpd configuration file for all subnets and add the key. The following is an example: Note that the option routers value is the Satellite or Capsule IP address that you want to use with an external DHCP service. Delete the two key files from the directory that they were created in. On Satellite Server, define each subnet. Do not set DHCP Capsule for the defined Subnet yet. To prevent conflicts, set up the lease and reservation ranges separately. For example, if the lease range is 192.168.38.10 to 192.168.38.100, in the Satellite web UI define the reservation range as 192.168.38.101 to 192.168.38.250. Configure the firewall for external access to the DHCP server: On Satellite Server, determine the UID and GID of the foreman user: On the DHCP server, create the foreman user and group with the same IDs as determined in a step: To ensure that the configuration files are accessible, restore the read and execute flags: Start the DHCP service: Export the DHCP configuration and lease files using NFS: Create directories for the DHCP configuration and lease files that you want to export using NFS: To create mount points for the created directories, add the following line to the /etc/fstab file: Mount the file systems in /etc/fstab : Ensure the following lines are present in /etc/exports : Note that the IP address that you enter is the Satellite or Capsule IP address that you want to use with an external DHCP service. Reload the NFS server: Configure the firewall for DHCP omapi port 7911: Optional: Configure the firewall for external access to NFS. Clients are configured using NFSv3. 4.2.2. Configuring Satellite Server with an External DHCP Server You can configure Capsule Server with an external DHCP server. Prerequisite Ensure that you have configured an external DHCP server and that you have shared the DHCP configuration and lease files with Capsule Server. For more information, see Section 4.2.1, "Configuring an External DHCP Server to Use with Capsule Server" . Procedure Install the nfs-utils utility: Create the DHCP directories for NFS: Change the file owner: Verify communication with the NFS server and the Remote Procedure Call (RPC) communication paths: Add the following lines to the /etc/fstab file: Mount the file systems on /etc/fstab : To verify that the foreman-proxy user can access the files that are shared over the network, display the DHCP configuration and lease files: Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file: Restart the foreman-proxy service: In the Satellite web UI, navigate to Infrastructure > Capsules . Locate the Capsule Server and select Refresh from the list in the Actions column. Associate the DHCP service with the appropriate subnets and domain. 4.3. Configuring Capsule Server with External TFTP You can configure Capsule Server with external TFTP services. Procedure Create the TFTP directory for NFS: In the /etc/fstab file, add the following line: Mount the file systems in /etc/fstab : Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file: If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of the server that the TFTP service is running on: In the Satellite web UI, navigate to Infrastructure > Capsules . Locate the Capsule Server and select Refresh from the list in the Actions column. Associate the TFTP service with the appropriate subnets and domain. 4.4. Configuring Capsule Server with External IdM DNS When Satellite Server adds a DNS record for a host, it first determines which Capsule is providing DNS for that domain. It then communicates with the Capsule that is configured to provide DNS service for your deployment and adds the record. The hosts are not involved in this process. Therefore, you must install and configure the IdM client on the Satellite or Capsule that is currently configured to provide a DNS service for the domain you want to manage using the IdM server. Capsule Server can be configured to use a Red Hat Identity Management (IdM) server to provide DNS service. For more information about Red Hat Identity Management, see the Linux Domain Identity, Authentication, and Policy Guide . To configure Capsule Server to use a Red Hat Identity Management (IdM) server to provide DNS service, use one of the following procedures: Section 4.4.1, "Configuring Dynamic DNS Update with GSS-TSIG Authentication" Section 4.4.2, "Configuring Dynamic DNS Update with TSIG Authentication" To revert to internal DNS service, use the following procedure: Section 4.4.3, "Reverting to Internal DNS Service" Note You are not required to use Capsule Server to manage DNS. When you are using the realm enrollment feature of Satellite, where provisioned hosts are enrolled automatically to IdM, the ipa-client-install script creates DNS records for the client. Configuring Capsule Server with external IdM DNS and realm enrollment are mutually exclusive. For more information about configuring realm enrollment, see External Authentication for Provisioned Hosts in the Administering Red Hat Satellite guide. 4.4.1. Configuring Dynamic DNS Update with GSS-TSIG Authentication You can configure the IdM server to use the generic security service algorithm for secret key transaction (GSS-TSIG) technology defined in RFC3645 . To configure the IdM server to use the GSS-TSIG technology, you must install the IdM client on the Capsule Server base operating system. Prerequisites You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide . You must contact the IdM server administrator to ensure that you obtain an account on the IdM server with permissions to create zones on the IdM server. You should create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see Configuring Satellite Server . Procedure To configure dynamic DNS update with GSS-TSIG authentication, complete the following steps: Creating a Kerberos Principal on the IdM Server Obtain a Kerberos ticket for the account obtained from the IdM administrator: Create a new Kerberos principal for Capsule Server to use to authenticate on the IdM server. Installing and Configuring the IdM Client On the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment, install the ipa-client package: Configure the IdM client by running the installation script and following the on-screen prompts: Obtain a Kerberos ticket: Remove any preexisting keytab : Obtain the keytab for this system: Note When adding a keytab to a standby system with the same host name as the original system in service, add the r option to prevent generating new credentials and rendering the credentials on the original system invalid. For the dns.keytab file, set the group and owner to foreman-proxy : Optional: To verify that the keytab file is valid, enter the following command: Configuring DNS Zones in the IdM web UI Create and configure the zone that you want to manage: Navigate to Network Services > DNS > DNS Zones . Select Add and enter the zone name. For example, example.com . Click Add and Edit . Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list: Set Dynamic update to True . Enable Allow PTR sync . Click Save to save the changes. Create and configure the reverse zone: Navigate to Network Services > DNS > DNS Zones . Click Add . Select Reverse zone IP network and add the network address in CIDR format to enable reverse lookups. Click Add and Edit . Click the Settings tab and in the BIND update policy box, add the following to the semi-colon separated list: Set Dynamic update to True . Click Save to save the changes. Configuring the Satellite or Capsule Server that Manages the DNS Service for the Domain Use the satellite-installer command to configure the Satellite or Capsule that manages the DNS Service for the domain: On Satellite, enter the following command: On Capsule, enter the following command: After you run the satellite-installer command to make any changes to your Capsule configuration, you must update the configuration of each affected Capsule in the Satellite web UI. Updating the Configuration in the Satellite web UI In the Satellite web UI, navigate to Infrastructure > Capsules , locate the Capsule Server, and from the list in the Actions column, select Refresh . Configure the domain: In the Satellite web UI, navigate to Infrastructure > Domains and select the domain name. In the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected. Configure the subnet: In the Satellite web UI, navigate to Infrastructure > Subnets and select the subnet name. In the Subnet tab, set IPAM to None . In the Domains tab, select the domain that you want to manage using the IdM server. In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected. Click Submit to save the changes. 4.4.2. Configuring Dynamic DNS Update with TSIG Authentication You can configure an IdM server to use the secret key transaction authentication for DNS (TSIG) technology that uses the rndc.key key file for authentication. The TSIG protocol is defined in RFC2845 . Prerequisites You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide . You must obtain root user access on the IdM server. You must confirm whether Satellite Server or Capsule Server is configured to provide DNS service for your deployment. You must configure DNS, DHCP and TFTP services on the base operating system of either the Satellite or Capsule that is managing the DNS service for your deployment. You must create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see Configuring Satellite Server . Procedure To configure dynamic DNS update with TSIG authentication, complete the following steps: Enabling External Updates to the DNS Zone in the IdM Server On the IdM Server, add the following to the top of the /etc/named.conf file: Reload the named service to make the changes take effect: In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes: Add the following in the BIND update policy box: Set Dynamic update to True . Click Update to save the changes. Copy the /etc/rndc.key file from the IdM server to the base operating system of your Satellite Server. Enter the following command: To set the correct ownership, permissions, and SELinux context for the rndc.key file, enter the following command: Assign the foreman-proxy user to the named group manually. Normally, satellite-installer ensures that the foreman-proxy user belongs to the named UNIX group, however, in this scenario Satellite does not manage users and groups, therefore you need to assign the foreman-proxy user to the named group manually. On Satellite Server, enter the following satellite-installer command to configure Satellite to use the external DNS server: Testing External Updates to the DNS Zone in the IdM Server Ensure that the key in the /etc/rndc.key file on Satellite Server is the same key file that is used on the IdM server: On Satellite Server, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1 . On Satellite Server, test the DNS entry: To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones . Click the name of the zone and search for the host by name. If resolved successfully, remove the test DNS entry: Confirm that the DNS entry was removed: The above nslookup command fails and returns the SERVFAIL error message if the record was successfully deleted. 4.4.3. Reverting to Internal DNS Service You can revert to using Satellite Server and Capsule Server as your DNS providers. You can use a backup of the answer file that was created before configuring external DNS, or you can create a backup of the answer file. For more information about answer files, see Configuring Satellite Server . Procedure On the Satellite or Capsule Server that you want to configure to manage DNS service for the domain, complete the following steps: Configuring Satellite or Capsule as a DNS Server If you have created a backup of the answer file before configuring external DNS, restore the answer file and then enter the satellite-installer command: If you do not have a suitable backup of the answer file, create a backup of the answer file now. To configure Satellite or Capsule as DNS server without using an answer file, enter the following satellite-installer command on Satellite or Capsule: For more information,see Configuring DNS, DHCP, and TFTP on Capsule Server . After you run the satellite-installer command to make any changes to your Capsule configuration, you must update the configuration of each affected Capsule in the Satellite web UI. Updating the Configuration in the Satellite web UI In the Satellite web UI, navigate to Infrastructure > Capsules . For each Capsule that you want to update, from the Actions list, select Refresh . Configure the domain: In the Satellite web UI, navigate to Infrastructure > Domains and click the domain name that you want to configure. In the Domain tab, set DNS Capsule to the Capsule where the subnet is connected. Configure the subnet: In the Satellite web UI, navigate to Infrastructure > Subnets and select the subnet name. In the Subnet tab, set IPAM to DHCP or Internal DB . In the Domains tab, select the domain that you want to manage using Satellite or Capsule. In the Capsules tab, set Reverse DNS Capsule to the Capsule where the subnet is connected. Click Submit to save the changes.

Commands:
scp root@ dns.example.com :/etc/rndc.key /etc/foreman-proxy/rndc.key
restorecon -v /etc/foreman-proxy/rndc.key chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key chmod -v 640 /etc/foreman-proxy/rndc.key
echo -e "server DNS_IP_Address \n update add aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key nslookup aaa.example.com DNS_IP_Address echo -e "server DNS_IP_Address \n update delete aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key
satellite-installer --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" DNS_IP_Address " --foreman-proxy-keyfile=/etc/foreman-proxy/rndc.key
yum install dhcp bind
yum install dhcp-server bind-utils
dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key
grep ^Key Komapi_key.+*.private | cut -d ' ' -f2
cat /etc/dhcp/dhcpd.conf default-lease-time 604800; max-lease-time 2592000; log-facility local7; subnet 192.168.38.0 netmask 255.255.255.0 { range 192.168.38.10 192.168.38.100 ; option routers 192.168.38.1 ; option subnet-mask 255.255.255.0 ; option domain-search " virtual.lan "; option domain-name " virtual.lan "; option domain-name-servers 8.8.8.8 ; } omapi-port 7911; key omapi_key { algorithm HMAC-MD5; secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw=="; }; omapi-key omapi_key;
firewall-cmd --add-service dhcp && firewall-cmd --runtime-to-permanent
id -u foreman 993 id -g foreman 990
groupadd -g 990 foreman useradd -u 993 -g 990 -s /sbin/nologin foreman
chmod o+rx /etc/dhcp/ chmod o+r /etc/dhcp/dhcpd.conf chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf
systemctl start dhcpd
yum install nfs-utils systemctl enable rpcbind nfs-server systemctl start rpcbind nfs-server nfs-lock nfs-idmapd
mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp
/var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0 /etc/dhcp /exports/etc/dhcp none bind,auto 0 0
mount -a
/exports 192.168.38.1 (rw,async,no_root_squash,fsid=0,no_subtree_check) /exports/etc/dhcp 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide) /exports/var/lib/dhcpd 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide)
exportfs -rva
firewall-cmd --add-port=7911/tcp firewall-cmd --runtime-to-permanent
firewall-cmd --zone public --add-service mountd && firewall-cmd --zone public --add-service rpc-bind && firewall-cmd --zone public --add-service nfs && firewall-cmd --runtime-to-permanent
yum install nfs-utils
mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd
chown -R foreman-proxy /mnt/nfs
showmount -e DHCP_Server_FQDN rpcinfo -p DHCP_Server_FQDN
DHCP_Server_FQDN :/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0 DHCP_Server_FQDN :/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0
mount -a
su foreman-proxy -s /bin/bash bash-4.2USD cat /mnt/nfs/etc/dhcp/dhcpd.conf bash-4.2USD cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases bash-4.2USD exit
satellite-installer --foreman-proxy-dhcp=true --foreman-proxy-dhcp-provider=remote_isc --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key --foreman-proxy-plugin-dhcp-remote-isc-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911 --enable-foreman-proxy-plugin-dhcp-remote-isc --foreman-proxy-dhcp-server= DHCP_Server_FQDN
systemctl restart foreman-proxy
mkdir -p /mnt/nfs/var/lib/tftpboot
TFTP_Server_IP_Address :/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0
mount -a
satellite-installer --foreman-proxy-tftp=true --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot
satellite-installer --foreman-proxy-tftp-servername= TFTP_Server_FQDN
kinit idm_user
ipa service-add capsule.example.com
satellite-maintain packages install ipa-client
ipa-client-install
kinit admin
rm /etc/foreman-proxy/dns.keytab
ipa-getkeytab -p capsule/ satellite.example.com@EXAMPLE.COM -s idm1.example.com -k /etc/foreman-proxy/dns.keytab
chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab
kinit -kt /etc/foreman-proxy/dns.keytab capsule/ satellite.example.com@EXAMPLE.COM
grant capsule/047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
satellite-installer --scenario satellite --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate_gss --foreman-proxy-dns-server=" idm1.example.com " --foreman-proxy-dns-tsig-principal="capsule/ satellite.example.com@EXAMPLE.COM " --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab
satellite-installer --scenario capsule --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate_gss --foreman-proxy-dns-server=" idm1.example.com " --foreman-proxy-dns-tsig-principal="capsule/ satellite.example.com@EXAMPLE.COM " --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab
######################################################################## include "/etc/rndc.key"; controls { inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; }; }; ########################################################################
systemctl reload named
grant "rndc-key" zonesub ANY;
scp /etc/rndc.key root@ satellite.example.com :/etc/rndc.key
restorecon -v /etc/rndc.key chown -v root:named /etc/rndc.key chmod -v 640 /etc/rndc.key
usermod -a -G named foreman-proxy
satellite-installer --scenario satellite --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" IdM_Server_IP_Address " --foreman-proxy-keyfile=/etc/rndc.key --foreman-proxy-dns-ttl=86400
key "rndc-key" { algorithm hmac-md5; secret " secret-key =="; };
echo -e "server 192.168.25.1\n update add test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1 Server: 192.168.25.1 Address: 192.168.25.1#53 Name: test.example.com Address: 192.168.25.20
echo -e "server 192.168.25.1\n update delete test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1
satellite-installer
satellite-installer --foreman-proxy-dns=true --foreman-proxy-dns-managed=true --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server="127.0.0.1"