Chapter 1. Accessing Red Hat Satellite After Red Hat Satellite has been installed and configured, use the Satellite web UI interface to log in to Satellite for further configuration. 1.1. Satellite web UI overview You can manage and monitor your Satellite infrastructure from a browser with the Satellite web UI. For example, you can use the following navigation features in the Satellite web UI: Navigation feature Description Organization dropdown Choose the organization you want to manage. Location dropdown Choose the location you want to manage. Monitor Provides summary dashboards and reports. Content Provides content management tools. This includes content views, activation keys, and lifecycle environments. Hosts Provides host inventory and provisioning configuration tools. Configure Provides general configuration tools and data, including host groups and Ansible content. Infrastructure Provides tools on configuring how Satellite interacts with the environment. Provides event notifications to keep administrators informed of important environment changes. Administer Provides advanced configuration for settings such as users, role-based access control (RBAC), and general settings. 1.2. Importing the Katello root CA certificate The first time you log in to Satellite, you might see a warning informing you that you are using the default self-signed certificate and you might not be able to connect this browser to Satellite until the root CA certificate is imported in the browser. Use the following procedure to locate the root CA certificate on Satellite and to import it into your browser. To use the CLI instead of the Satellite web UI, see CLI Procedure . Prerequisites Your Red Hat Satellite is installed and configured. Procedure Identify the fully qualified domain name of your Satellite Server: Access the pub directory on your Satellite Server using a web browser pointed to the fully qualified domain name: When you access Satellite for the first time, an untrusted connection warning displays in your web browser. Accept the self-signed certificate and add the Satellite URL as a security exception to override the settings. This procedure might differ depending on the browser being used. Ensure that the Satellite URL is valid before you accept the security exception. Select katello-server-ca.crt . Import the certificate into your browser as a certificate authority and trust it to identify websites. CLI procedure From the Satellite CLI, copy the katello-server-ca.crt file to the machine you use to access the Satellite web UI: In the browser, import the katello-server-ca.crt certificate as a certificate authority and trust it to identify websites. 1.3. Logging in to Satellite Use the web user interface to log in to Satellite for further configuration. Prerequisites Ensure that the Katello root CA certificate is installed in your browser. For more information, see Section 1.2, "Importing the Katello root CA certificate" . Procedure Access Satellite Server using a web browser pointed to the fully qualified domain name: Enter the user name and password created during the configuration process. If a user was not created during the configuration process, the default user name is admin . If you have problems logging in, you can reset the password. For more information, see Section 1.8, "Resetting the administrative user password" . 1.4. Using Red Hat Identity Management credentials to log in to the Satellite Hammer CLI This section describes how to log in to your Satellite Hammer CLI with your Red Hat Identity Management (IdM) login and password. Prerequisites You have enrolled your Satellite Server into Red Hat Identity Management and configured it to use Red Hat Identity Management for authentication. More specifically, you have enabled access both to the Satellite web UI and the Satellite API. For more information, see Using Red Hat Identity Management in Installing Satellite Server in a connected network environment . The host on which you run this procedure is configured to use Red Hat Identity Management credentials to log users in to your Satellite Hammer CLI. For more information, see Configuring the Hammer CLI to Use Red Hat Identity Management User Authentication in Installing Satellite Server in a connected network environment . The host is an Red Hat Identity Management client. An Red Hat Identity Management server is running and reachable by the host. Procedure Obtain a Kerberos ticket-granting ticket (TGT) on behalf of a Satellite user: Warning If, when you were setting Red Hat Identity Management to be the authentication provider, you enabled access to both the Satellite API and the Satellite web UI, an attacker can now obtain an API session after the user receives the Kerberos TGT. The attack is possible even if the user did not previously enter the Satellite login credentials anywhere, for example in the browser. If automatic negotiate authentication is not enabled, use the TGT to authenticate to Hammer manually: Optional: Destroy all cached Kerberos tickets in the collection: You are still logged in, even after destroying the Kerberos ticket. Verification Use any hammer command to ensure that the system does not ask you to authenticate again: Note To log out of Hammer, enter: hammer auth logout . 1.5. Using Red Hat Identity Management credentials to log in to the Satellite web UI with a Firefox browser This section describes how to use the Firefox browser to log in to your Satellite web UI with your Red Hat Identity Management (IdM) login and password. Prerequisites You have enrolled your Satellite Server into Red Hat Identity Management and configured the server to use Red Hat Identity Management for authentication. For more information, see Using Red Hat Identity Management in Installing Satellite Server in a connected network environment . The host on which you are using a Firefox browser to log in to the Satellite web UI is an Red Hat Identity Management client. You have a valid Red Hat Identity Management login and password. Red Hat recommends using the latest stable Firefox browser. Your Firefox browser is configured for Single Sign-On (SSO). For more information, see Configuring Firefox to use Kerberos for single sign-on in Configuring authentication and authorization in Red Hat Enterprise Linux . An Red Hat Identity Management server is running and reachable by the host. Procedure Obtain the Kerberos ticket granting ticket (TGT) for yourself using your Red Hat Identity Management credentials: In your browser address bar, enter the URL of your Satellite Server. You are logged in automatically. Note Alternatively, you can skip the first two steps and enter your login and password in the fields displayed on the Satellite web UI. This is also the only option if the host from which you are accessing the Satellite web UI is not an Red Hat Identity Management client. 1.6. Using Red Hat Identity Management credentials to log in to the Satellite web UI with a Chrome browser This section describes how to use a Chrome browser to log in to your Satellite web UI with your Red Hat Identity Management login and password. Prerequisites You have enrolled your Satellite Server into Red Hat Identity Management and configured the server to use Red Hat Identity Management for authentication. For more information, see Using Red Hat Identity Management in Installing Satellite Server in a connected network environment . The host on which you are using the Chrome browser to log in to the Satellite web UI is an Red Hat Identity Management client. You have a valid Red Hat Identity Management login and password. Red Hat recommends using the latest stable Chrome browser. An Red Hat Identity Management server is running and reachable by the host. Procedure Enable the Chrome browser to use Kerberos authentication: Note Instead of allowlisting the whole domain, you can also allowlist a specific Satellite Server. Obtain the Kerberos ticket-granting ticket (TGT) for yourself using your Red Hat Identity Management credentials: In your browser address bar, enter the URL of your Satellite Server. You are logged in automatically. Note Alternatively, you can skip the first three steps and enter your login and password in the fields displayed on the Satellite web UI. This is also the only option if the host from which you are accessing the Satellite web UI is not an Red Hat Identity Management client. 1.7. Changing the password These steps show how to change your password. Procedure In the Satellite web UI, click your user name at the top right corner. Select My Account from the menu. In the Current Password field, enter the current password. In the Password field, enter a new password. In the Verify field, enter the new password again. Click Submit to save your new password. 1.8. Resetting the administrative user password Use the following procedures to reset the administrative password to randomly generated characters or to set a new administrative password. To reset the administrative user password Log in to the base operating system where Satellite Server is installed. Enter the following command to reset the password: Use this password to reset the password in the Satellite web UI. Edit the ~/.hammer/cli.modules.d/foreman.yml file on Satellite Server to add the new password: Unless you update the ~/.hammer/cli.modules.d/foreman.yml file, you cannot use the new password with Hammer CLI. To set a new administrative user password Log in to the base operating system where Satellite Server is installed. To set the password, enter the following command: Edit the ~/.hammer/cli.modules.d/foreman.yml file on Satellite Server to add the new password: Unless you update the ~/.hammer/cli.modules.d/foreman.yml file, you cannot use the new password with Hammer CLI. 1.9. Setting a custom message on the Login page Procedure In the Satellite web UI, navigate to Administer > Settings , and click the General tab. Click the edit button to Login page footer text , and enter the desired text to be displayed on the login page. For example, this text may be a warning message required by your company. Click Save . Log out of the Satellite web UI and verify that the custom text is now displayed on the login page below the Satellite version number.

Commands:
hostname -f
https:// satellite.example.com /pub
scp /var/www/html/pub/katello-server-ca.crt username@hostname:remotefile
https:// satellite.example.com /
kinit idm_user
hammer auth login negotiate
kdestroy -A
hammer host list
kinit idm_user Password for idm_user@ EXAMPLE.COM :
google-chrome --auth-server-whitelist="*. example.com " --auth-negotiate-delegate-whitelist="*. example.com "
kinit idm_user Password for idm_user@_EXAMPLE.COM :
foreman-rake permissions:reset Reset to user: admin, password: qwJxBptxb7Gfcjj5
vi ~/.hammer/cli.modules.d/foreman.yml
foreman-rake permissions:reset password= new_password
vi ~/.hammer/cli.modules.d/foreman.yml