Hide thumbs Also See for NETWORK SATELLITE 5.3.0:
Table of Contents

Advertisement

Red Hat Network
Satellite 5.3.0
Installation Guide
Red Hat Network Satellite

Advertisement

Table of Contents
loading

Summary of Contents for Red Hat NETWORK SATELLITE 5.3.0

  • Page 1 Red Hat Network Satellite 5.3.0 Installation Guide Red Hat Network Satellite...
  • Page 2 Installation Guide Red Hat Network Satellite 5.3.0 Installation Guide Red Hat Network Satellite Edition 5.3.0 Copyright © 2009 Red Hat, Inc. This material may only be distributed subject to the terms and conditions set forth in the Open Publication License, V1.0 or later (the latest version of the OPL is presently available at http://www.opencontent.org/openpub/).
  • Page 3: Table Of Contents

    1. Introduction 1.1. Red Hat Network ......................1 1.2. RHN Satellite ....................... 1 1.3. Terms to Understand ....................2 1.4. How it Works ....................... 3 1.5. Summary of Steps ....................... 4 1.6. Upgrades ........................6 1.6.1. Satellite Certificate ..................... 6 1.6.2.
  • Page 4 Installation Guide 6.4.2. Configuring the Master RHN Satellite Server ............. 47 6.4.3. Configuring the Slave RHN Satellite Servers ............. 48 6.5. Using Inter-Satellite Sync .................... 48 6.5.1. Syncing between a Development Staging Server and a Production Satellite ..49 6.5.2. Bi-directional sync .................... 49 6.6.
  • Page 5: Introduction

    Chapter 1. Introduction RHN Satellite provides a solution to organizations requiring absolute control over and privacy of the maintenance and package deployment of their servers. It allows Red Hat Network customers the greatest flexibility and power in keeping servers secure and updated. Two types of RHN Satellite are available: One with a stand-alone database on a separate machine and one with an embedded database installed on the same machine as the Satellite.
  • Page 6: Terms To Understand

    Chapter 1. Introduction • Security — an end-to-end secure connection is maintained from the client systems to the RHN Satellite without connecting to the public Internet. • Efficiency — packages are delivered significantly faster over a local area network. • Control — clients' System Profiles are stored on the local RHN Satellite, not on the central Red Hat Network Servers.
  • Page 7: How It Works

    How it Works For more detailed explanations of these terms and others, refer to the Red Hat Network Reference Guide. 1.4. How it Works RHN Satellite consists of the following components: • Database — for the Stand-Alone Database, this may be the organization's existing database or, preferably, a separate machine.
  • Page 8: Summary Of Steps

    Chapter 1. Introduction The organization can configure the website for the RHN Satellite to be accessible from the local area network only or from both the local area network and the Internet. The Satellite's version of the RHN website allows full control over client systems, system groups, and users. The RHN Satellite management tools are used to synchronize the RHN Satellite database and package repository with Red Hat Network.
  • Page 9 3. Your Red Hat contact creates a Satellite-entitled account on the RHN website and sends you the login information. 4. Log into the RHN website (rhn.redhat.com) and download the distribution ISOs for Red Hat Enterprise Linux AS 4 or Red Hat Enterprise Linux 5 and RHN Satellite 5.3.0. These can be found within the Downloads tab of the respective Channel Details pages.
  • Page 10: Upgrades

    • Satellite Upgrade Documentation Package (rhn-upgrade) • New Installation ISO 1.6.1. Satellite Certificate To obtain a Satellite certificate, visit Red Hat support at http://support.redhat.com. 1.6.2. Satellite Upgrade Documentation Package (rhn-upgrade) There are two ways to obtain this RPM: 1. Ensure the satellite is registered to RHN and to the Red Hat Network Satellite Channel, then using...
  • Page 11: Requirements

    /etc/selinux/config file to read SELINUX=permissive and reboot the system. More in-depth coverage of SELinux is available at http://www.redhat.com/docs/. You may also refer to the Red Hat Knowledgebase article on SELinux and RHN Satellite at http://kbase.redhat.com/faq/.
  • Page 12: Hardware Requirements

    Chapter 2. Requirements Synchronization Tool or obtained from your Red Hat representative if synchronization is not possible, such as in a disconnected environment. When installing Red Hat Enterprise Linux AS 4 or later from CD or ISO image, there is no need to select any package groups, only the base install is required.
  • Page 13: S/390 Hardware Requirements

    s/390 Hardware Requirements • Two processors • 2 GB of memory Section 2.3, “Database Requirements” for instructions on estimating the tablespace of the database and setting its environment variables. Keep in mind, the frequency with which client systems connect to the Satellite is directly related to load on the Apache Web server and the database.
  • Page 14: Database Requirements

    Chapter 2. Requirements • The package repository may be any large storage device easily and securely accessed by the other components. The space requirements depend on the number of packages that will be stored. Default Red Hat channels contain approximately 3 GB of packages each, and that size grows with each synchronization;...
  • Page 15: Additional Requirements

    RHN strongly recommends firewalling the RHN Satellite solution from the Internet. However, various TCP ports must be opened on the Satellite, depending on your implementation of RHN Satellite: Port Direction Reason Outbound Satellite uses this port to reach rhn.redhat.com xmlrpc.rhn.redhat.com...
  • Page 16 Chapter 2. Requirements Port Direction Reason satellite.rhn.redhat.com (unless running in a disconnected mode for Satellite) Inbound WebUI and client requests come in via either http or https Inbound WebUI and client requests come in via either http or https rhn.redhat.com...
  • Page 17 It is imperative that customers keep track of all primary login information. For RHN Satellite, this includes usernames and passwords for the Organization Administrator account on rhn.redhat.com, the primary administrator account on the Satellite itself, SSL certificate generation, and database connection (which also requires a SID, or net service name).
  • Page 18 Chapter 2. Requirements be downloaded to a separate system to synchronize the Satellite with the central Red Hat Network Servers. All other RHN Satellites should be synchronized directly over the Internet. Note If you are running a disconnected Satellite that is not registered to RHN Hosted the installation program will note and return a list of any missing additional packages needed beyond @base to be installed, then the installation program will exit.
  • Page 19: Example Topologies

    Chapter 3. Example Topologies The RHN Satellite can be configured in multiple ways. Select one method depending on the following factors: • The total number of client systems to be served by the RHN Satellite. • The maximum number of clients expected to connect concurrently to the RHN Satellite. •...
  • Page 20: Satellite-Proxy Vertically Tiered Topology

    Chapter 3. Example Topologies It is possible to synchronize content between RHN Satellites using the rhn-satellite-exporter Section 6.1.1, “rhn- and satellite-sync -m commands. This feature is discussed in detail in satellite-exporter”. Additional maintenance is the biggest disadvantage of this horizontal structure. Figure 3.2.
  • Page 21 Satellite-Proxy Vertically Tiered Topology Figure 3.3. Satellite-Proxy Vertically Tiered Topology...
  • Page 23: Installation

    Chapter 4. Installation This chapter describes the initial installation of the RHN Satellite. It presumes the prerequisites listed Chapter 2, Requirements have been met. If you are instead upgrading to a newer version of RHN Satellite, contact your Red Hat representative for assistance. 4.1.
  • Page 24 Chapter 4. Installation mount -o loop iso_filename /media/cdrom The remaining instructions assume it is mounted in /media/cdrom/. 4. Ensure that the RHN Entitlement Certificate has been copied onto the Satellite's file system. It can be named anything and located in any directory. The installation program will ask you for its location.
  • Page 25 RHN Satellite Installation Program * Installing RHN packages. 9. Next, the RHN Satellite Installation Program downloads and installs the RHN GPG key, including setting up the /root/.gnupg/ directory, if required. * Setting up environment and users ** GPG: Initializing GPG and importing RHN key. ** GPG: Creating /root/.gnupg directory 10.
  • Page 26 Chapter 4. Installation City Enter the city where the Satellite resides. Country Enter the country where the Satellite resides. The country code must be exactly two letters, or the certificate generation fails. 14. Once the CA Cert certificate is generated, the RHN Satellite Installation Program performs final configuration and restarts the associated services.
  • Page 27 RHN Satellite Installation Program Figure 4.2. Final Configuration Prompt 17. The Satellite Configuration - General Configuration page allows you to alter the most basic Satellite settings, such as the admin email address and whether Monitoring is enabled.
  • Page 28 Chapter 4. Installation Figure 4.3. General Configuration 18. The RHN Satellite Configuration - Monitoring page allows you to configure the monitoring aspects of this Satellite. The local mail exchanger and local main domain are used to mail monitoring notification messages to administration. This is required only if you intend to receive alert notifications from probes.
  • Page 29 RHN Satellite Installation Program Figure 4.4. Monitoring 19. The RHN Satellite Configuration - Certificate page allows you to upload a new Satellite certificate. To identify the certificate's path, click Browse, navigate to the file, and select it. To input its contents, open your certificate in a text editor, copy all lines, and paste them directly into the large text field at the bottom.
  • Page 30 Chapter 4. Installation Figure 4.5. Certificate 20. The RHN Satellite Configuration - Bootstrap page allows you to generate a bootstrap script for redirecting client systems from the central RHN Servers to the Satellite. This script, to be placed in the /var/www/html/pub/bootstrap/ directory of the Satellite, significantly reduces the effort involved in reconfiguring all systems, which by default obtain packages from the central RHN Servers.
  • Page 31 RHN Satellite Installation Program Figure 4.6. Bootstrap 21. The RHN Satellite Configuration - Restart page contains the final step in configuring the Satellite. Click the Restart button to restart the Satellite in order to incorporate all of the configuration options added on the previous screens. Note that it will take between four and five minutes for the restart to finish.
  • Page 32: Options To The Satellite Installation Program

    Chapter 4. Installation Figure 4.7. Restart 22. Once the Satellite has restarted, the countdown notice disappears. You are now free to begin using your Satellite. Figure 4.8. Restart Complete 4.2.1. Options to the Satellite Installation Program The various options available for the Satellite Installation Program are included below for easy reference.
  • Page 33: Automated Rhn Satellite Server Installation

    Automated RHN Satellite Server Installation Option Usage For use only with --answer-file. If the --answer- --non-interactive file does not provide a required response, exit instead of prompting the user. Register the system with RHN, even if it is already registered. --re-register Install the satellite in disconnected mode.
  • Page 34: Sendmail Configuration

    Chapter 4. Installation 4. Once the answer file is ready, use the --answer-file option when starting the installation process from the command line: ./install.pl --answer-file=/tmp/answers.txt The RHN Satellite Installation Program then looks for answers in the file. For any option no filled out in the file, the Installer Program prompts the user for the missing information.
  • Page 35: Mysql Installation

    MySQL Installation Finally, update the sendmail-cf package: yum update sendmail-cf Note, disconnected installs must obtain this package from the ISO. Restart sendmail: service sendmail restart 4.5. MySQL Installation This sections is applicable only if your RHN Satellite will serve Monitoring-entitled systems and you wish to run MySQL probes against them.
  • Page 37: Entitlements

    Chapter 5. Entitlements The RHN Satellite, like RHN itself, provides all services to customers through the setting of entitlements. For RHN, entitlements are purchased by customers as needed; however, for RHN Satellite, entitlements are contractually agreed-upon beforehand, and they are set at installation time.
  • Page 38: Uploading The Rhn Entitlement Certificate

    5.2. Uploading the RHN Entitlement Certificate If your RHN Satellite is connected to the Internet, you have the option of uploading your new RHN Entitlement Certificate through the RHN website. To do this: https://rhn.redhat.com 1. Log into with your organization's Satellite-entitled account.
  • Page 39: Activating The Satellite

    Activating the Satellite Option Description Display the help screen with a list of options. -h, --help Confirm certificate sanity. Does not activate the --sanity-only Satellite locally or remotely. Activates locally but not on remote RHN Servers. --disconnected Uploads new certificate and activates the Satellite --rhn-cert=/PATH/TO/CERT based upon the other options passed (if any).
  • Page 40: Satellite Entitlement Certificate Expiration

    Chapter 5. Entitlements 5.4. Satellite Entitlement Certificate Expiration Satellite certificates expire at 11:59:59 PM on the date listed in the certificate's expires field, and new certificates become active at 12:00:00 AM on their issued date. A standard grace period of seven (7) days exists between the date of Satellite certificate expiration and when the Satellite becomes inactive.
  • Page 41: Importing And Synchronizing

    Chapter 6. Importing and Synchronizing After installing the RHN Satellite, you must provide it with the packages and channels to be served to client systems. This chapter explains how to import that data and keep it up to date whether the content is from RHN's central servers, local media, or from one Satellite within your organization to another.
  • Page 42: Exporting

    Chapter 6. Importing and Synchronizing The RHN Satellite Exporter offers several command line options. To use them, insert the option and appropriate value after the rhn-satellite-exporter command. Option Description Place the exported information into this directory. -d, --dir= Process data for this specific channel (specified -cCHANNEL_LABEL, -- by label) only.
  • Page 43: Importing With Rhn Satellite Synchronization Tool

    Importing with RHN Satellite Synchronization Tool • The RHN Satellite installation must have been performed successfully. • There must be sufficient disk space in the directory specified in the --dir option to contain the exported contents. Although it is not a requirement for the export to succeed, the export will be most useful when performed on a Satellite that has populated channels.
  • Page 44 Chapter 6. Importing and Synchronizing satellite-sync This tool can be used in a closed environment, such as the one created with a disconnected install, or it may obtain data directly over the Internet. Closed environment imports can get their data from downloaded ISOs or from the XML data generated by RHN Satellite Exporter.
  • Page 45: Preparing For Import From Local Media

    Preparing for Import from Local Media Option Description Perform the sync process only to the step --step=STEP_NAME specified. Typically used in testing. Do not retrieve actual RPMs. --no-rpms Do not process full package data. --no-packages Do not process Errata information. --no-errata Do not process kickstart data --no-kickstarts...
  • Page 46 Chapter 6. Importing and Synchronizing • The RHN Satellite installation must have been performed successfully. • The Red Hat Network Channel Content ISOs or RHN Satellite Exporter data must be available, or the Satellite must have access to the Internet and the RHN website. Although it is possible to conduct the import directly from the RHN website, this should be done only if Channel Content ISOs are not available.
  • Page 47: Running The Import

    Running the Import 7. Then unmount /mnt/import in preparation for the next CD or ISO: umount /mnt/import 8. Repeat these steps for each Channel Content ISO of every channel to be imported. 6.2.2.2. Preparing RHN Satellite Exporter Data In order to perform the import from data previously exported using RHN Satellite Exporter, you must first copy that data onto the local system.
  • Page 48: Synchronizing

    Chapter 6. Importing and Synchronizing Note Importing package data can take up to two hours per channel. You may begin registering systems to channels as soon as they appear in the RHN Satellite's website. No packages are necessary for registration, although updates cannot be retrieved from the Satellite until the channel is completely populated.
  • Page 49: Synchronizing Errata And Packages Directly Via Rhn

    Synchronizing Errata and Packages Directly via RHN 1. Connects over SSL to central RHN Servers, authenticates itself as an RHN Satellite, and triggers an export of RHN data — unless a local mount point for RHN-exported data is specified, in which Section 6.3.2, “Synchronizing Errata and Packages via case no connection is necessary.
  • Page 50: Inter-Satellite Sync

    Chapter 6. Importing and Synchronizing satellite-sync -c rhel-i386-as-3 --mount-point /var/rhn-sat-sync This can be used to perform the sync process described above, using the dump files in /var/rhn- Section 6.2.3, “Running the sat-sync to perform the necessary comparisons and imports. See Import”...
  • Page 51: Configuring The Master Rhn Satellite Server

    Configuring the Master RHN Satellite Server Figure 6.2. Master Server and Slave Peers that include their own custom content In this example, the master Satellite is the development channel, from which content is distributed to all production slave Satellites. Some slave Satellites have extra content not present in master Satellite channels.
  • Page 52: Configuring The Slave Rhn Satellite Servers

    Chapter 6. Importing and Synchronizing By default, no slave Satellites are specified to sync from the master server, so you must enter the hostname of each slave Satellite server, separated by commas. For example: allowed_iss_slaves=slave1.satellite.example.org,slave2.satellite.example.org Once you finished configuring the rhn.conf file, restart the httpd service by issuing the following command: service httpd restart 6.4.3.
  • Page 53: Syncing Between A Development Staging Server And A Production Satellite

    Figure 6.4. Syncing from RHN Hosted and a Satellite Staging Server Normally, the administrator runs: satellite-sync -c your-channel This command downloads directly from data from rhn_parent (usually RHN Hosted, rhn.redhat.com). Then, to sync from the staging Satellite server address , the administrator runs: satellite-sync --iss-parent=staging-satellite.example.com -c custom-channel 6.5.2.
  • Page 54: Synchronizing By Organization

    Chapter 6. Importing and Synchronizing 6.6. Synchronizing by Organization Satellite-sync has a new enhancement as part of the inter satellite sync feature where a user can import content to any specific organization. This can be done locally or by a remote syncing from hosted or another satellite.
  • Page 55: Troubleshooting

    RHN Satellite. If you need additional help, contact Red Hat Network support at rhn.redhat.com/help/contact.pxt. Log in using your Satellite-entitled account to see your full list of options. In addition, you may package configuration information and logs from the Satellite and send them to Section 7.7, “Satellite Debugging by Red Hat”...
  • Page 56 If the administrator is not getting email from the RHN Satellite, confirm the correct email addresses have been set for traceback_mail in /etc/rhn/rhn.conf. If the traceback mail is marked from dev-null@rhn.redhat.com and you would like the address to be valid for your organization, include the web.default_mail_from option and appropriate value in /...
  • Page 57: Host Not Found/Could Not Determine Fqdn

    Host Not Found/Could Not Determine FQDN If importing/synchronizing a channel fails and you can't recover it in any other way, run this command to delete the cache: rm -rf temporary-directory Section 6.2.2.1, “Preparing Channel Content ISOs” Note that suggested that this temporary directory be /var/rhn-sat-import/.
  • Page 58: Connection Errors

    Chapter 7. Troubleshooting 127.0.0.1 localhost.localdomain.com localhost 123.45.67.8 this_machine.example.com this_machine Replace the value here with the actual IP address of the Satellite. This should resolve the problem. Keep in mind, if the specific IP address is stipulated, the file will need to be updated when the machine obtains a new address.
  • Page 59: Selinux Issues

    SELinux Issues 7 rhn-org-httpd-ssl-key-pair-MACHINE_NAME-VER-REL.noarch.rpm is installed on the RHN Satellite and the corresponding rhn-org-trusted-ssl-cert- *.noarch.rpm or raw CA SSL public (client) certificate is installed on all client systems. • Verify the client systems are configured to use the appropriate certificate. •...
  • Page 60 Chapter 7. Troubleshooting * copying configuration information * copying logs * querying RPM database (versioning of RHN Satellite, etc.) * querying schema version and database character sets * get diskspace available * timestamping * creating tarball (may take some time): /tmp/satellite-debug.tar.bz2 * removing temporary debug tree Debug dump created, stored in /tmp/satellite-debug.tar.bz2 Deliver the generated tarball to your RHN contact or support channel.
  • Page 61: Maintenance

    For RHN Satellite systems that may not be connected to the Internet, the packages themselves may be retrieved using a customer account at https://rhn.redhat.com. Then, they can be applied manually by the customer according to instructions in the Errata Advisory.
  • Page 62: Backing Up The Satellite

    • /root/ssl-build/ If possible, back up /var/satellite/, as well. In case of failure, this will save lengthy download time. Since /var/satellite/ (specifically /var/satellite/redhat/NULL/) is primarily a duplicate of Red Hat's RPM repository, it can be regenerated with satellite-sync. Red Hat recommends the entire /var/satellite/ tree be backed up.
  • Page 63: Using Rhn Db Control

    Using RHN DB Control Note Regardless of the back-up method used, when you restore the Satellite from a back-up, you must run the following command to schedule the recreation of search indexes the next time the rhn-search service is started: /etc/init.d/rhn-search cleanindex 8.4.
  • Page 64: Backing Up The Database

    Chapter 8. Maintenance Option Description Starts the database instance. This can also be start accomplished by issuing the service rhn- database start command as root. Shrinks RHN Oracle database segments with signifcant shrink-segments amounts of free space. Shows the current status of the database, either status "running"...
  • Page 65: Verifying The Backup

    Verifying the Backup service rhn-satellite stop Then switch to the oracle user and issue this command to initiate the backup: db-control backup DIRNAME Backup files are stored in the directory specified. Note that this is a cold backup; the database must be stopped before running this command.
  • Page 66: Cloning The Satellite With Embedded Db

    Chapter 8. Maintenance db-control restore DIRNAME This not only restores the Embedded Database but first verifies the contents of the backup directory using md5sums. Once the restoration is complete, return to root user mode and restart the database and related services with these commands in this order: service rhn-satellite start 8.5.
  • Page 67: Conducting Satellite-Specific Tasks

    Conducting Satellite-Specific Tasks certificate, and bootstrap script generation steps. Include the same RHN account and database connection information provided during the initial Satellite install and register the new Satellite. If your original SSL certificate does not take your high-availability solution into account, you may create a new one with a more appropriate Common Name value now.
  • Page 68: Using The Tools Menu

    Chapter 8. Maintenance editing System Profiles and updating packages. Tasks directly related to managing custom channels and Errata are covered in the RHN Channel Management Guide. This section seeks to explain activities available only to Satellite customers. 8.7.1. Using the Tools menu In addition to the standard categories available to all users through the top navigation bar, Satellite Organization Administrators also have access to a Tools menu.
  • Page 69: Deleting Users

    Deleting Users Administrators should ensure the RHN Task Engine stays up and running. If this daemon hangs for any reason, it can be restarted using it's filename, taskomatic. As root, run the command: /sbin/service taskomatic restart Other service commands can also be used, including start, stop, and status. 8.7.2.
  • Page 70: Automating Synchronization

    Chapter 8. Maintenance The Organization Administrator role may be removed by any Organization Administrator (provided they are not the sole Organization Administrator for the organization) by clicking on the Users tab and then visiting the Details sub-tab. Figure 8.3. User Delete Confirmation Many other options exist for managing users.
  • Page 71: Implementing Pam Authentication

    Implementing PAM Authentication Once opened, use the first five fields (minute, hour, day, month, and weekday) to schedule the synchronization. Remember, hours use military time. Edit the crontab to include random synchronization, like so: 0 1 * * * perl -le 'sleep rand 9000' && satellite-sync --email >/dev/null \ 2>/dev/null This particular job will run randomly between 1:00 a.m.
  • Page 72: Enabling Push To Clients

    Chapter 8. Maintenance auth required pam_deny.so account required pam_krb5.so no_user_check Please note that changing the password on the RHN website changes only the local password on the RHN Satellite, which may not be used at all if PAM is enabled for that user. In the above example, for instance, the Kerberos password will not be changed.
  • Page 73 Enabling Push to Clients Now when you schedule actions from the Satellite on any of the push-enabled systems, the task will begin immediately rather than wait for the system to check in.
  • Page 75: Sample Rhn Satellite Configuration File

    #/etc/rhn/rhn.conf example for an RHN Satellite #---------------------------------------------- # Destination of all tracebacks, such as crash information, etc. traceback_mail = test@pobox.com, test@redhat.com # Location of RPMs (Red Hat and custom) served by the RHN Satellite mount_point = /var/satellite # Corporate gateway (hostname:PORT): server.satellite.http_proxy = corporate_gateway.example.com:8080...
  • Page 76 Appendix A. Sample RHN Satellite Configuration File RHN::Task::ErrataEngine, RHN::Task::DailySummary, RHN::Task::SummaryPopulation, RHN::Task::RHNProc, RHN::Task::PackageCleanup web.rhn_gpg_backend_module = RHN::GPG::OpenPGP web.restrict_mail_domains =...
  • Page 77: Revision History

    Appendix B. Revision History Revision 1.0 Fri Feb 27 2009...
  • Page 79: Index

    Index enabling push to clients, 68 entitlement certificate, 13, 19 uploading, 34 Symbols /etc/nsswitch.conf, 53 firewall rules /etc/rhn/rhn.conf, 52 requirements, 11 advantages, 1 general problems, 51 Apache, 57 GPG keys, 19 Apache HTTP, 3 automating Satellite synchronization, 66 host not found error backing up the RHN Satellite, 58 could not determine FQDN, 53 block sizes, 10...
  • Page 80 Index options, 40 RHN Task Engine, 64 operating system rhn-satellite supported, 7 service, 57 Oracle 10g, 3 rhn-satellite-activate, 34 Organization Administrator activating, 35 definition, 2 options, 34 osa-dispatcher, 68 rhn-satellite-exporter, 37 osad, 68 export, 39 options, 38 rhn.conf PAM authentication sample file, 71 implementation, 67 rhns-satellite-tools, 34, 43...

Table of Contents