Red Hat NETWORK SATELLITE 5.1.1 Installation Manual page 16

Chapter 2. Requirements
Customers who connect to the central Red Hat Network Servers to receive incremental updates
must have an external account with Red Hat Network. This account should be set up at the time of
purchase with the sales representative.
Warning
Do not subscribe your RHN Satellite Server to any of the following child channels
available on RHN Hosted:
• Red Hat Developer Suite
• Red Hat Application Server
• Red Hat Extras
Subscribing to these channels and updating your Satellite (such as by running
up2date) may install newer, incompatible versions of critical software components,
causing the Satellite to fail.
• Backups of Login Information
It is imperative that customers keep track of all primary login information. For RHN Satellite
Server, this includes usernames and passwords for the Organization Administrator account on
rhn.redhat.com, the primary administrator account on the Satellite itself, SSL certificate generation,
and database connection (which also requires a SID, or net service name). Red Hat strongly
recommends this information be copied onto two separate floppy disks, printed out on paper, and
stored in a fireproof safe.
In addition to these requirements, it is recommended that the RHN Satellite Server be configured in
the following manner:
• The entire RHN Satellite Server solution should be protected by a firewall if the Satellite accesses or
is accessed via the Internet. An Internet connection is not required for RHN Satellite Servers running
in completely disconnected environments. This feature instead uses Channel Content ISOs that can
be downloaded to a separate system to synchronize the Satellite with the central Red Hat Network
Servers. All other RHN Satellite Servers should be synchronized directly over the Internet.
• All unnecessary ports should be firewalled off. Client systems connect to RHN Satellite Server over
ports 80, 443, and 4545 (if Monitoring is enabled). In addition, if you plan to enable the pushing of
actions from the Satellite to client systems, as described in
you must allow inbound connections on port 5222. Finally, if the Satellite will also push to an RHN
Proxy Server, you must also allow inbound connections on port 5269.
• No system components should be directly, publicly available. No user other than the system
administrators should have shell access to these machines.
•
All unnecessary services should be disabled using ntsysv or chkconfig.
•
The httpd service should be enabled.
12
Section 8.10, "Enabling Push to Clients",