Installing Satellite Server in a connected network environment Red Hat Satellite 6.15 Install and configure Satellite Server in a network with Internet access Red Hat Satellite Documentation Team satellite-doc-list@redhat.com

Commands:
nfs.example.com:/nfsshare /var/lib/pulp nfs context="system_u:object_r:var_lib_t:s0" 1 2
restorecon -R /var/lib/pulp
firewall-cmd --add-port="8000/tcp" --add-port="9090/tcp"
firewall-cmd --add-service=dns --add-service=dhcp --add-service=tftp --add-service=http --add-service=https --add-service=puppetmaster
firewall-cmd --runtime-to-permanent
firewall-cmd --list-all
ping -c1 localhost ping -c1 `hostname -f` # my_system.domain.com
ping -c1 localhost PING localhost (127.0.0.1) 56(84) bytes of data. 64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.043 ms --- localhost ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.043/0.043/0.043/0.000 ms ping -c1 `hostname -f` PING hostname.gateway (XX.XX.XX.XX) 56(84) bytes of data. 64 bytes from hostname.gateway (XX.XX.XX.XX): icmp_seq=1 ttl=64 time=0.019 ms --- localhost.gateway ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.019/0.019/0.019/0.000 ms
hostnamectl set-hostname name
cp /etc/foreman-installer/custom-hiera.yaml /etc/foreman-installer/custom-hiera.original
satellite-installer --tuning medium
/Stage[main]/Dhcp/File[/etc/dhcp/dhcpd.conf]: Filebucketed /etc/dhcp/dhcpd.conf to puppet with sum 622d9820b8e764ab124367c68f5fa3a1
puppet filebucket -l restore /etc/dhcp/dhcpd.conf 622d9820b8e764ab124367c68f5fa3a1
an http proxy server to use (enter server FQDN) proxy_hostname = myproxy.example.com port for http proxy server proxy_port = 8080 user name for authenticating to an http proxy, if needed proxy_user = password for basic http proxy auth, if needed proxy_password =
subscription-manager register
subscription-manager register Username: user_name Password: The system has been registered with ID: 541084ff2-44cab-4eb1-9fa1-7683431bcf9a
subscription-manager repos --disable "*"
subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms --enable=satellite-6.15-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.15-for-rhel-8-x86_64-rpms
dnf module enable satellite:el8
dnf install fapolicyd
satellite-maintain packages install fapolicyd
systemctl enable --now fapolicyd
systemctl status fapolicyd
dnf upgrade
dnf install satellite
dnf install chrony
systemctl enable --now chronyd
satellite-installer --scenario satellite --foreman-initial-organization " My_Organization " --foreman-initial-location " My_Location " --foreman-initial-admin-username admin_user_name --foreman-initial-admin-password admin_password
scp ~/ manifest_file .zip root@ satellite.example.com :~/.
hammer subscription upload --file ~/ manifest_file .zip --organization " My_Organization "
satellite-maintain packages install insights-client
satellite-installer --register-with-insights
insights-client --unregister
satellite-installer --register-with-insights
hammer repository synchronize --name "Red Hat Satellite Client 6 for RHEL 9 x86_64 RPMs" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository synchronize --name "Red Hat Satellite Client 6 for RHEL 8 x86_64 RPMs" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository synchronize --async --name "Red Hat Satellite Client 6 for RHEL 7 Server RPMs x86_64" --organization " My_Organization " --product "Red Hat Enterprise Linux Server"
hammer repository synchronize --async --name "Red Hat Satellite Client 6 for RHEL 6 Server - ELS RPMs x86_64" --organization " My_Organization " --product "Red Hat Enterprise Linux Server - Extended Lifecycle Support"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 for RHEL 8 x86_64 (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux for x86_64"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 (for RHEL 7 Server) (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux Server"
hammer repository-set enable --basearch="x86_64" --name "Red Hat Satellite Client 6 (for RHEL 6 Server - ELS) (RPMs)" --organization " My_Organization " --product "Red Hat Enterprise Linux Server - Extended Lifecycle Support"
satellite-installer --foreman-proxy-plugin-remote-execution-script-mode=pull-mqtt
firewall-cmd --add-service=mqtt
firewall-cmd --runtime-to-permanent
satellite-maintain packages update grub2-efi
unset http_proxy unset https_proxy unset no_proxy
hammer http-proxy create --name= myproxy --url http:// myproxy.example.com :8080 --username= proxy_username --password= proxy_password
hammer settings set --name=content_default_http_proxy --value= myproxy
semanage port -l | grep http_cache http_cache_port_t tcp 8080, 8118, 8123, 10001-10010 [output truncated]
semanage port -a -t http_cache_port_t -p tcp 8088
hammer settings set --name=http_proxy --value= Proxy_URL
hammer settings set --name=http_proxy_except_list --value=[ hostname1.hostname2... ]
hammer settings set --name=content_default_http_proxy --value=""
satellite-installer --foreman-proxy-bmc "true" --foreman-proxy-bmc-default-provider "freeipmi"
satellite-installer --foreman-proxy-dns true --foreman-proxy-dns-managed true --foreman-proxy-dns-zone example.com --foreman-proxy-dns-reverse 2.0.192.in-addr.arpa --foreman-proxy-dhcp true --foreman-proxy-dhcp-managed true --foreman-proxy-dhcp-range " 192.0.2.100 192.0.2.150 " --foreman-proxy-dhcp-gateway 192.0.2.1 --foreman-proxy-dhcp-nameservers 192.0.2.2 --foreman-proxy-tftp true --foreman-proxy-tftp-managed true --foreman-proxy-tftp-servername 192.0.2.3
satellite-installer --foreman-proxy-dhcp false --foreman-proxy-dns false --foreman-proxy-tftp false
Option 66: IP address of Satellite or Capsule Option 67: /pxelinux.0
cp mailca.crt /etc/pki/ca-trust/source/anchors/ update-ca-trust enable update-ca-trust
satellite-installer --certs-cname alternate_fqdn --certs-update-server
./bootstrap.py --server alternate_fqdn.example.com
Server hostname: hostname = alternate_fqdn.example.com content omitted Content base URL: baseurl=https:// alternate_fqdn.example.com /pulp/content/
mkdir /root/satellite_cert
openssl genrsa -out /root/satellite_cert/satellite_cert_key.pem 4096
[ req ] req_extensions = v3_req distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] commonName = satellite.example.com [ v3_req ] basicConstraints = CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection subjectAltName = @alt_names [ alt_names ] DNS.1 = satellite.example.com
[req_distinguished_name] CN = satellite.example.com countryName = My_Country_Name 1 stateOrProvinceName = My_State_Or_Province_Name 2 localityName = My_Locality_Name 3 organizationName = My_Organization_Or_Company_Name organizationalUnitName = My_Organizational_Unit_Name 4
openssl req -new -key /root/satellite_cert/satellite_cert_key.pem \ 1 -config /root/satellite_cert/openssl.cnf \ 2 -out /root/satellite_cert/satellite_cert_csr.pem 3
katello-certs-check -c /root/satellite_cert/satellite_cert.pem \ 1 -k /root/satellite_cert/satellite_cert_key.pem \ 2 -b /root/satellite_cert/ca_cert_bundle.pem 3
Validation succeeded. To install the Red Hat Satellite Server with the custom certificates, run: satellite-installer --scenario satellite --certs-server-cert " /root/satellite_cert/satellite_cert.pem " --certs-server-key " /root/satellite_cert/satellite_cert_key.pem " --certs-server-ca-cert " /root/satellite_cert/ca_cert_bundle.pem " To update the certificates on a currently running Red Hat Satellite installation, run: satellite-installer --scenario satellite --certs-server-cert " /root/satellite_cert/satellite_cert.pem " --certs-server-key " /root/satellite_cert/satellite_cert_key.pem " --certs-server-ca-cert " /root/satellite_cert/ca_cert_bundle.pem " --certs-update-server --certs-update-server-ca
dnf install http:// satellite.example.com /pub/katello-ca-consumer-latest.noarch.rpm
subscription-manager repos --disable '*' subscription-manager repos --enable=satellite-6.15-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.15-for-rhel-8-x86_64-rpms --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms
dnf module enable satellite:el8
dnf install postgresql-server postgresql-evr postgresql-contrib
postgresql-setup initdb
vi /var/lib/pgsql/data/postgresql.conf
listen_addresses = '*'
vi /var/lib/pgsql/data/pg_hba.conf
host all all Satellite_ip /32 md5
systemctl enable --now postgresql
firewall-cmd --add-service=postgresql
firewall-cmd --runtime-to-permanent
su - postgres -c psql
CREATE USER "foreman" WITH PASSWORD ' Foreman_Password '; CREATE USER "candlepin" WITH PASSWORD ' Candlepin_Password '; CREATE USER "pulp" WITH PASSWORD ' Pulpcore_Password '; CREATE DATABASE foreman OWNER foreman; CREATE DATABASE candlepin OWNER candlepin; CREATE DATABASE pulpcore OWNER pulp;
postgres=# \c pulpcore You are now connected to database "pulpcore" as user "postgres".
pulpcore=# CREATE EXTENSION IF NOT EXISTS "hstore"; CREATE EXTENSION
\q
PGPASSWORD=' Foreman_Password ' psql -h postgres.example.com -p 5432 -U foreman -d foreman -c "SELECT 1 as ping" PGPASSWORD=' Candlepin_Password ' psql -h postgres.example.com -p 5432 -U candlepin -d candlepin -c "SELECT 1 as ping" PGPASSWORD=' Pulpcore_Password ' psql -h postgres.example.com -p 5432 -U pulp -d pulpcore -c "SELECT 1 as ping"
satellite-installer --foreman-db-database foreman --foreman-db-host postgres.example.com --foreman-db-manage false --foreman-db-password Foreman_Password --foreman-proxy-content-pulpcore-manage-postgresql false --foreman-proxy-content-pulpcore-postgresql-db-name pulpcore --foreman-proxy-content-pulpcore-postgresql-host postgres.example.com --foreman-proxy-content-pulpcore-postgresql-password Pulpcore_Password --foreman-proxy-content-pulpcore-postgresql-user pulp --katello-candlepin-db-host postgres.example.com --katello-candlepin-db-name candlepin --katello-candlepin-db-password Candlepin_Password --katello-candlepin-manage-db false
--foreman-db-root-cert <path_to_CA> --foreman-db-sslmode verify-full --foreman-proxy-content-pulpcore-postgresql-ssl true --foreman-proxy-content-pulpcore-postgresql-ssl-root-ca <path_to_CA> --katello-candlepin-db-ssl true --katello-candlepin-db-ssl-ca <path_to_CA> --katello-candlepin-db-ssl-verify true
cat /etc/passwd | grep 'puppet\|apache\|foreman\|foreman-proxy' cat /etc/group | grep 'puppet\|apache\|foreman\|foreman-proxy'
install /tmp/ example.crt /etc/pki/tls/certs/
ln -s example.crt /etc/pki/tls/certs/USD(openssl x509 -noout -hash -in /etc/pki/tls/certs/ example.crt ).0
systemctl restart httpd
setsebool -P nis_enabled on
uid=USDlogin,cn=users,cn=accounts,dc=example,dc=com
DC=Domain,DC=Example | |----- CN=Users | |----- CN=Group1 |----- CN=Group2 |----- CN=User1 |----- CN=User2 |----- CN=User3
kinit admin
klist
ipa host-add --random hostname
ipa service-add HTTP/ hostname
satellite-maintain packages install ipa-client
ipa-client-install --password OTP
satellite-installer --foreman-ipa-authentication=true
satellite-installer --foreman-ipa-authentication-api=true --foreman-ipa-authentication=true
satellite-maintain service restart
kinit admin
klist
ipa hbacsvc-add satellite-prod ipa hbacrule-add allow_satellite_prod ipa hbacrule-add-service allow_satellite_prod --hbacsvcs=satellite-prod
ipa hbacrule-add-user allow_satellite_prod --user= username ipa hbacrule-add-host allow_satellite_prod --hosts= satellite.example.com
ipa hbacrule-find satellite-prod ipa hbactest --user= username --host= satellite.example.com --service=satellite-prod
satellite-installer --foreman-pam-service=satellite-prod
satellite-maintain packages install adcli krb5-workstation oddjob-mkhomedir oddjob realmd samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator sssd
realm join AD.EXAMPLE.COM --membership-software=samba --client-software=sssd
mkdir /etc/ipa/
[global] realm = AD.EXAMPLE.COM
[global] workgroup = AD.EXAMPLE realm = AD.EXAMPLE.COM kerberos method = system keytab security = ads
KRB5_KTNAME=FILE:/etc/httpd/conf/http.keytab net ads keytab add HTTP -U Administrator -s /etc/samba/smb.conf
[domain/ ad.example.com ] ad_gpo_access_control = enforcing ad_gpo_map_service = +foreman
systemctl restart sssd
satellite-installer --foreman-ipa-authentication=true
kinit ad_user @ AD.EXAMPLE.COM
curl -k -u : --negotiate https://satellite.example.com/users/extlogin <html><body>You are being <a href="satellite.example.com/hosts">redirected</a>.</body></html>
[nss] user_attributes=+mail, +sn, +givenname [domain/EXAMPLE.com] krb5_store_password_if_offline = True ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname [ifp] allowed_uids = ipaapi, root user_attributes=+email, +firstname, +lastname
dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname
id username
foreman-rake ldap:refresh_usergroups
:foreman: :use_sessions: true
:foreman: :default_auth_type: 'Negotiate_Auth' :use_sessions: true
satellite-maintain packages install ipa-client
ipa-client-install
foreman-prepare-realm admin realm-capsule
scp /root/freeipa.keytab root@ capsule.example.com :/etc/foreman-proxy/freeipa.keytab
mv /root/freeipa.keytab /etc/foreman-proxy chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab
satellite-installer --foreman-proxy-realm true --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM --foreman-proxy-realm-provider freeipa
cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt update-ca-trust enable update-ca-trust
systemctl restart foreman-proxy
ipa hostgroup-add hostgroup_name --desc= hostgroup_description
ipa automember-add --type=hostgroup hostgroup_name automember_rule
ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex= ^webserver hostgroup_name ---------------------------------- Added condition(s) to " hostgroup_name " ---------------------------------- Automember Rule: automember_rule Inclusive Regex: userclass= ^webserver ---------------------------- Number of conditions added 1 ----------------------------
satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install python3-lxml
keycloak-httpd-client-install --app-name foreman-openidc --keycloak-server-url " https://RHSSO.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force
satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "foreman-openidc" --foreman-keycloak-realm " Satellite_Realm "
keycloak-httpd-client-install --app-name hammer-openidc --keycloak-server-url " https://RHSSO.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force
systemctl restart httpd
https://satellite.example.com/users/extlogin/redirect_uri https://satellite.example.com/users/extlogin
https://satellite.example.com/users/extlogin/redirect_uri urn:ietf:wg:oauth:2.0:oob
hammer settings set --name authorize_login_delegation --value true
hammer settings set --name login_delegation_logout_url --value https://satellite.example.com/users/extlogout
hammer settings set --name oidc_algorithm --value 'RS256'
hammer settings set --name oidc_audience --value "[' satellite.example.com -hammer-openidc']"
hammer settings set --name oidc_audience --value "[' satellite.example.com -foreman-openidc', ' satellite.example.com -hammer-openidc']"
hammer settings set --name oidc_issuer --value " RHSSO.example.com /auth/realms/ RHSSO_Realm "
hammer settings set --name oidc_jwks_url --value " RHSSO.example.com /auth/realms/ RHSSO_Realm /protocol/openid-connect/certs"
hammer auth-source external list
hammer auth-source external update --id Authentication Source ID --location-ids Location ID --organization-ids Organization ID
hammer auth login oauth --two-factor --oidc-token-endpoint 'https:// RHSSO.example.com /auth/realms/ssl-realm/protocol/openid-connect/token' --oidc-authorization-endpoint 'https:// RHSSO.example.com /auth' --oidc-client-id ' satellite.example.com -foreman-openidc' --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob
satellite-maintain packages install mod_auth_openidc keycloak-httpd-client-install python3-lxml
keycloak-httpd-client-install --app-name foreman-openidc --keycloak-server-url " https://RHSSO.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force
satellite-installer --foreman-keycloak true --foreman-keycloak-app-name "foreman-openidc" --foreman-keycloak-realm " Satellite_Realm "
keycloak-httpd-client-install --app-name hammer-openidc --keycloak-server-url " https://RHSSO.example.com " --keycloak-admin-username " admin " --keycloak-realm " Satellite_Realm " --keycloak-admin-realm master --keycloak-auth-role root-admin -t openidc -l /users/extlogin --force
systemctl restart httpd
https://satellite.example.com/users/extlogin/redirect_uri https://satellite.example.com/users/extlogin
https://satellite.example.com/users/extlogin/redirect_uri urn:ietf:wg:oauth:2.0:oob
hammer settings set --name authorize_login_delegation --value true
hammer settings set --name login_delegation_logout_url --value https://satellite.example.com/users/extlogout
hammer settings set --name oidc_algorithm --value 'RS256'
hammer settings set --name oidc_audience --value "[' satellite.example.com -hammer-openidc']"
hammer settings set --name oidc_audience --value "[' satellite.example.com -foreman-openidc', ' satellite.example.com -hammer-openidc']"
hammer settings set --name oidc_issuer --value " RHSSO.example.com /auth/realms/ RHSSO_Realm "
hammer settings set --name oidc_jwks_url --value " RHSSO.example.com /auth/realms/ RHSSO_Realm /protocol/openid-connect/certs"
hammer auth-source external list
hammer auth-source external update --id Authentication Source ID --location-ids Location ID --organization-ids Organization ID
hammer auth login oauth --two-factor --oidc-token-endpoint 'https:// RHSSO.example.com /auth/realms/ssl-realm/protocol/openid-connect/token' --oidc-authorization-endpoint 'https:// RHSSO.example.com /auth' --oidc-client-id ' satellite.example.com -foreman-openidc' --oidc-redirect-uri urn:ietf:wg:oauth:2.0:oob
satellite-installer --reset-foreman-keycloak
scp root@ dns.example.com :/etc/rndc.key /etc/foreman-proxy/rndc.key
restorecon -v /etc/foreman-proxy/rndc.key chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key chmod -v 640 /etc/foreman-proxy/rndc.key
echo -e "server DNS_IP_Address \n update add aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key nslookup aaa.example.com DNS_IP_Address echo -e "server DNS_IP_Address \n update delete aaa.example.com 3600 IN A Host_IP_Address \n send\n" | nsupdate -k /etc/foreman-proxy/rndc.key
satellite-installer --foreman-proxy-dns=true --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" DNS_IP_Address " --foreman-proxy-keyfile=/etc/foreman-proxy/rndc.key
dnf install dhcp-server bind-utils
tsig-keygen -a hmac-md5 omapi_key
cat /etc/dhcp/dhcpd.conf default-lease-time 604800; max-lease-time 2592000; log-facility local7; subnet 192.168.38.0 netmask 255.255.255.0 { range 192.168.38.10 192.168.38.100 ; option routers 192.168.38.1 ; option subnet-mask 255.255.255.0 ; option domain-search " virtual.lan "; option domain-name " virtual.lan "; option domain-name-servers 8.8.8.8 ; } omapi-port 7911; key omapi_key { algorithm hmac-md5; secret " My_Secret "; }; omapi-key omapi_key;
firewall-cmd --add-service dhcp
firewall-cmd --runtime-to-permanent
id -u foreman 993 id -g foreman 990
groupadd -g 990 foreman useradd -u 993 -g 990 -s /sbin/nologin foreman
chmod o+rx /etc/dhcp/ chmod o+r /etc/dhcp/dhcpd.conf chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf
systemctl enable --now dhcpd
dnf install nfs-utils systemctl enable --now nfs-server
mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp
/var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0 /etc/dhcp /exports/etc/dhcp none bind,auto 0 0
mount -a
/exports 192.168.38.1 (rw,async,no_root_squash,fsid=0,no_subtree_check) /exports/etc/dhcp 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide) /exports/var/lib/dhcpd 192.168.38.1 (ro,async,no_root_squash,no_subtree_check,nohide)
exportfs -rva
firewall-cmd --add-port=7911/tcp
firewall-cmd --add-service mountd --add-service nfs --add-service rpc-bind --zone public
firewall-cmd --runtime-to-permanent
satellite-maintain packages install nfs-utils
mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd
chown -R foreman-proxy /mnt/nfs
showmount -e DHCP_Server_FQDN rpcinfo -p DHCP_Server_FQDN
DHCP_Server_FQDN :/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0 DHCP_Server_FQDN :/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0
mount -a
su foreman-proxy -s /bin/bash cat /mnt/nfs/etc/dhcp/dhcpd.conf cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases exit
satellite-installer --enable-foreman-proxy-plugin-dhcp-remote-isc --foreman-proxy-dhcp-provider=remote_isc --foreman-proxy-dhcp-server= My_DHCP_Server_FQDN --foreman-proxy-dhcp=true --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key --foreman-proxy-plugin-dhcp-remote-isc-key-secret= My_Secret --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911
mkdir -p /mnt/nfs/var/lib/tftpboot
TFTP_Server_IP_Address :/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0
mount -a
satellite-installer --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot --foreman-proxy-tftp=true
satellite-installer --foreman-proxy-tftp-servername= TFTP_Server_FQDN
kinit idm_user
ipa service-add capsule/satellite.example.com
satellite-maintain packages install ipa-client
ipa-client-install
kinit admin
rm /etc/foreman-proxy/dns.keytab
ipa-getkeytab -p capsule/ satellite.example.com@EXAMPLE.COM -s idm1.example.com -k /etc/foreman-proxy/dns.keytab
chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab
kinit -kt /etc/foreman-proxy/dns.keytab capsule/ satellite.example.com@EXAMPLE.COM
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
grant capsule\047 satellite.example.com@EXAMPLE.COM wildcard * ANY;
satellite-installer --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate_gss --foreman-proxy-dns-server=" idm1.example.com " --foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab --foreman-proxy-dns-tsig-principal="capsule/ satellite.example.com@EXAMPLE.COM " --foreman-proxy-dns=true
######################################################################## include "/etc/rndc.key"; controls { inet _IdM_Server_IP_Address_ port 953 allow { _Satellite_IP_Address_; } keys { "rndc-key"; }; }; ########################################################################
systemctl reload named
grant "rndc-key" zonesub ANY;
scp /etc/rndc.key root@ satellite.example.com :/etc/rndc.key
restorecon -v /etc/rndc.key chown -v root:named /etc/rndc.key chmod -v 640 /etc/rndc.key
usermod -a -G named foreman-proxy
satellite-installer --foreman-proxy-dns-managed=false --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server=" IdM_Server_IP_Address " --foreman-proxy-dns-ttl=86400 --foreman-proxy-dns=true --foreman-proxy-keyfile=/etc/rndc.key
key "rndc-key" { algorithm hmac-md5; secret " secret-key =="; };
echo -e "server 192.168.25.1\n update add test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1 Server: 192.168.25.1 Address: 192.168.25.1#53 Name: test.example.com Address: 192.168.25.20
echo -e "server 192.168.25.1\n update delete test.example.com 3600 IN A 192.168.25.20\n send\n" | nsupdate -k /etc/rndc.key
nslookup test.example.com 192.168.25.1
satellite-installer
satellite-installer --foreman-proxy-dns-managed=true --foreman-proxy-dns-provider=nsupdate --foreman-proxy-dns-server="127.0.0.1" --foreman-proxy-dns=true
dnf module list --enabled
dnf module list --enabled
dnf module reset ruby
dnf module list --enabled
dnf module reset postgresql
dnf module enable satellite:el8
dnf install postgresql-upgrade
postgresql-setup --upgrade
apache::server_tokens: Prod
apache::server_signature: Off
cp /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.backup
journalctl -xe /Stage[main]/Dhcp/File[/etc/dhcp/dhcpd.conf]: Filebucketed /etc/dhcp/dhcpd.conf to puppet with sum 622d9820b8e764ab124367c68f5fa3a1
puppet filebucket restore --local --bucket /var/lib/puppet/clientbucket /etc/dhcp/dhcpd.conf \ 622d9820b8e764ab124367c68f5fa3a1