Showing posts with label SpaceWalk. Show all posts
Showing posts with label SpaceWalk. Show all posts

Thursday, March 5, 2015

How to Configure Satellite for IPA Authentication

This page contains links and information about the configuration and How to Configure Satellite for IPA Authentication​
Requirements
  • Admin group to map for Satellite Admins
  • Config channel group for other users
How to Configure Satellite
  1. Install the following packages:
    1. yum install ipa-client ipa-admintools sssd sssd-dbus mod_auth_kerb mod_authnz_pam mod_lookup_identity mod_intercept_form_submit -y​
  2. Check selinux status (Selinux must be enforcing and can be in permissive mode) by default we turn selinux off. Changing this will require a reboot to relabel all the files with selinux contexts.
    • ​[tuser@client.mydom.com ~]$ getenforce
      Disabled
    • ]$ sestatus
      SELinux status:      disabled​

  3. Since it shows Disabled, we need to change Selinux to Enforcing, then permissive.
    • ​cd /etc/sysconfig and edit selinux file
    • change SELINUX=disabled to SELINUX=enforcing
    • reboot
    • login and change again from enforcing to permissive
      • ​cd /etc/sysconfig and edit selinux file
      • change SELINUX=enforcing​ to SELINUX=permissive​
    • OR do this
      •  # setenforce 0
        [root@client.mydom.com ~]# getenforce
        Permissive
  4. ​​​Verify it's enabled and in enforcing mode
    1. ​[root@Satellite.mydom.com rhn]# getenforce
      Permissive

    2. [root@satellite.mydom.com rhn]# sestatus
      SELinux status:                 enabled
      SELinuxfs mount:                /selinux
      Current mode:                   permissive
      Mode from config file:          permissive
      Policy version:                 24
      Policy from config file:        targeted

  5. If you try to run the spacewalk setup ipa command below and selinux is not configured properly you will see this error:
    1. [root@satellie.mydom.com sysconfig]# spacewalk-setup-ipa-authentication
      Enabling authentication against [ipa.mydom.com].
      Keytab: [/etc/httpd/conf/http.keytab] already exists, will not refetch.
              Use [klist -kt /etc/httpd/conf/http.keytab] to verify its content.
      PAM service: File [/etc/pam.d/spacewalk], will not overwrite.
      Packages: all needed packages are already installed.
      getsebool:  SELinux is disabled
            Maybe you need to upgrade selinux-policy?


  6. Once selinux ​ is configured properly we can proceed with IPA Configuration.

  7. Make sure you have a ticket,  run kinit ​admin
  8. ​​Now that everything is read, run the following command to configure ipa
    1. [root@satellite.mydom.com ~]# spacewalk-setup-ipa-authentication
    2. Enabling authentication against [ipa.mydom.com].
      Keytab: [/etc/httpd/conf/http.keytab] already exists, will not refetch.
              Use [klist -kt /etc/httpd/conf/http.keytab] to verify its content.
      PAM service: File [/etc/pam.d/spacewalk], will not overwrite.
      Packages: all needed packages are already installed.
      Turning SELinux boolean [httpd_dbus_sssd] on ...
              ... done.
      Turning SELinux boolean [allow_httpd_mod_auth_pam] on ...
              ... done.
      Configuring Apache modules.
      ** /etc/tomcat6/server.xml has been backed up to server.xml-swsave.ipa
      Stopping sssd:                                             [  OK  ]
      Starting sssd:                                             [  OK  ]
      Stopping tomcat6:                                          [  OK  ]
      Starting tomcat6:                                          [  OK  ]
      Stopping httpd:                                            [  OK  ]
      Starting httpd:                                            [  OK  ]
      Waiting for tomcat to be ready ...
      Authentication against [ipa.mydom.com] sucessfully enabled.
      As admin, at Admin > Users > External Authentication, select
                Default organization to autopopulate new users into.


  9. Once IPA Configuration is completed, login to satellite webUI as satadm and configured External Authentication for Admin Group
    • ​The unix/linux group admins will be used to allow team login and permissions to Satellite WebUI
  10. Go to Admin > Users > External Authentication > Configuration
    1. Select 'myOrg' for Default Orginization and click Update
  11. Click on Group Role Mapping tab and then click on  + Create External Group
    1. External Group Name:  Enter the external group admins
    2. Administrative Roles:    Select Organization Administrator
    3. Click Create  to save.
  12. Logout then login with your TID account that is member of admins group. Your login should succeed.

Wednesday, September 24, 2014

How to Update Client Hostname in Satellite

This page contains information about the How to Update Client Hostname in Satellite. When a hostname of a machine under a satellite is changed, the changes do not reflect in the satellite. - Deleting the machine with the old hostname and adding the system again fixes this issue, but doing this deletes all history and settings associated with the machine.
After changing the hostname of a satellite client run the following commands below to update and 'refresh' satellite.

  • Hostnames can be refreshed from within the satellite GUI by going to the Systems tab, clicking on the system, clicking the hardware sub-tab underneath the system name in the details page, and using the "Schedule hardware refresh" button at the top right.
  • This will refresh the hardware, usually immediately.
  • Also change the 'System Name'
  • Under Details >> Properties in the WebUI there is a "System Name" field . Edit these 'properties' to change to new/changed hostname
  • Run 'rhn-profile-sync -vv' on the client

Thursday, February 27, 2014

How to Sign Packages for Custom Satellite Channel

This page describes how to sign or resign packages (RPM's) from Third Party or custom rpm's and add them to custom channel. 

  1. Create GPG Key for Custom Packages 
    • gpg --gen-key   (if having problem us rng package - see SpaceWalk commands  ) 
      • follow instructions How to Create GPG Key on Virtual Machine 
        • yum install rng-tools 
        •  sed -i 's,EXTRAOPTIONS.*,EXTRAOPTIONS="-r /dev/urandom",' /etc/sysconfig/rngd  
        • service rngd start 
        • gpg --gen-key  
    • use gpg --list-key to show key  
  2. Retrieve or Export your public key 
    • # gpg --export -a myco-gpg > myco-pubkey.txt  
  3. Copy the key to PUB directory on Satellite 
    • # cp myco-pubkey.txt /var/www/html/pub/MYCO-PUB  
  4. Copy the GPG key into /var/www/html/pub on the Satellite Server so that existing servers can access it  using:\ 
  5. Upload the key to Satellite/Spacewalk 
    • go to Systems > Kickstart > GPG & SSL Keys 
    • click on create new stored key/cert 
    • Type in a description, and upload the file, by clicking create key 

  6. Upload RPM to Satellite/Spacewalk server temporary location.  
  7. Create or edit ~/.rpmmacros file as follows, where number is 2nd number shown from gpg --key-list 
    • .rpmmacros file 
      • %_signature gpg  
      • %_gpg_name B7085C8A 
    • rpm --resign package-name-1.0-1.noarch.rpm 
    • rpm --checksig -v package-name-1.0-1.noarch.rpm   
  8. Use rhn_push to push package to channel 
    1. rhn_push /tmplocation/*.rpm --server=https://mysatelite/APP  -a -c=mycustomchannel -u MYUser -p MyPass -c mycustomchannel 

  9. Add Custom Channel to your Master Activation Key and then add the packages you want to install in packages section. 
  10. or add gpg to your kickstart profile. Go to Kickstart > Profiles, MyProfile > System Details > GPG and check the MYCO-PUB gpg key, then click Update Keys 

Monday, February 10, 2014

New Red Hat Overview of RHN Satellite

Red Hat has recently released a new overview of RHN Satellite 5.6. The overview discusses getting started with Red Hat Satellite Server 5.6, new features such as PosgreSQL support, provisioning and auditing improvements and API information. Please read the full article located here https://access.redhat.com/site/articles/708153  (please note a Red Hat login is required.)

Thursday, January 30, 2014

Satellite Post Install Configuration

This document will explain how to activate Satellite and then how to configure the first Channel. 
Reference 
  • Chapter 6 in Red_Hat_Network_Satellite/5.4 Installation Guide 
  
How to Register Satellite & Download & Import Channel Content ISO’s. 
  1. Verify Activation in RHN (optional if using spacewalk) 
  2. Check for spacewalk-backend-tools package 
    1. # rpm –qa | grep backend   
  3. To see list of rhn commands run # rhn-
     
  4. To view channels available run 
    1. tmp]# satellite-sync -l | tee channels 
    2. # satellite-sync --list-channels | more   
  5. Run the following to reregister system and entitle/activate Satellite 
    1. [root@satserv rhn]# rhn_register 
    2. [root@satserv rhn]# rhn-satellite-activate --rhn-cert=/root/myco.cert
       
  6. Download Satellite Channel Content ISO’s for each channel you will need. 
    1. Red Hat recommends using Channel Content ISO’s locally versus importing directly from RHN website to save time. 
    2. Our example, we only user v6.3 RHEL 
    3. The process to copy Channel Content ISOs is to mount each one, copy its contents to the temporary repository, and then unmount the ISO. 
    4. Mount from your laptop to vmware to satellite server
       
  7. [root@satserv mnt]# mkdir /var/satellite/sat-import
     
  8. Mount the iso to local in vCenter and then copy from mount point to sat-import 
    1. [root@satserv media]# mount /dev/cdrom /media   
    2. [root@satserv media]# cp -ruv  * /mnt /var/satellite/sat-import/
       
    3. Repeat these steps for each Channel Content ISO of every channel to be imported.   
  9. The first step in importing channels into the database is listing the channels available for import. This is accomplished with the command:  
    1. satellite-sync --list-channels --mount-point /var/satellite/sat-import
    2. notes –  
      1. run ‘satellite-sync  --list-channels’ option to obtain a list of all channels by label.
  10. View local channels available 
    1. [root@satserv sat-import]# satellite-sync --list-channels --mount-point /var/satellite/sat-import/  
  11. Start the import of a channel 
    1. [root@satserv sat-import]# satellite-sync  -c rhel-x86_64-server-6 --mount-point /var/satellite/sat-import/  
    2. ..output..  13:20:07 Red Hat Network Satellite - file-system synchronization 
13:20:07    mp:  /var/satellite/sat-import 
13:20:07    db:  rhnsat/<password>@rhnsat 
 13:20:08 Retrieving / parsing additional arches data 
13:20:08 additional arches data complete 
13:20:08 
13:20:08 Retrieving / parsing channel data 
13:20:09    p = previously imported/synced channel 
13:20:09    . = channel not yet imported/synced 
13:20:09    base-channels: 
13:20:09       . rhel-x86_64-server-6                     8203       full import from Mon Jun 25 12:52:55 2012 
13:20:09 
13:20:10 Channel data complete 
13:20:10 
13:20:10 Retrieving / parsing blacklists data 
13:20:10 blacklists data complete 
13:20:10 
13:20:10 Retrieving / parsing product names data 
13:20:10 
13:20:10 Retrieving short package metadata (used for indexing) 
13:20:10    Retrieving / parsing short package metadata: rhel-x86_64-server-6 (8203) 
13:20:43 Diffing package metadata (what's missing locally?): rhel-x86_64-server-6 
            ________________________________________ 
Diffing:    ######################################## - complete 
13:20:57 
13:20:57 Downloading package metadata 
13:20:57    Retrieving / parsing *relevant* package metadata: rhel-x86_64-server-6 (8203) 
13:20:57    * WARNING: this may be a slow process. 
            ________________________________________ 
Downloading:################################   ---output truncated---       8203/8203 Fetch successful: freeradius-2.1.12-3.el6.x86_64.rpm (1458248 bytes) 
13:38:36 Processing rpm packages complete 
13:38:36 
13:38:36 Importing package metadata 
13:38:36    Importing *relevant* package metadata: rhel-x86_64-server-6 (8203) 
13:38:36    * WARNING: this may be a slow process. 
            ________________________________________ 
Importing:  #   ---output truncated---   
This conducts the following tasks in this order:  
  1. Populating the tables describing common features for channels ( channel families). This can also be accomplished individually by passing the --step=channel-families option to satellite-sync.  
  2. Creating a particular channel in the database and importing the metadata describing the channel. Individually, use the --step=channels option.  
  3. Moving the RPM packages from the temporary repository into their final location. Individually, use the --step=rpms option.  
  4. Parsing the header metadata for each package in the channel, uploading the package data, and associating it with the channel. Individually, use the --step=packages option.  
  5. Identifying Errata associated with the packages and including them in the repository. Individually, use the --step=errata option.     
  6. See Chapter 7 Troubleshooting for help  Download RHN tools (or any channel from –list-channels) 
    • satellite-sync --channel=rhn-tools-rhel-x86_64-server-6 
this process worked and resolved my kickstart profile issue  
Set up a cron job in /etc/cron.daily to sync from Red Hat Network
  • Create satsync file 
    • #!/bin/bash  if { -e /var/lock/satsync ]; then          echo "Satellite sync in progress, exiting"          exit 1  fi   touch /var/lock/satsync  until satellite-sync; do          perl -le 'sleep rand 90' done  rm -f /var/lock/satsync   
  • cron.daily]# ll | grep satsync  -rwxr-xr-x. 1 root root  209 Aug 15 15:09 satsync 
 Define your Organization 
  1. Go to Admin > Organization  ( or create new organization) 
  2. Fill out appropriate information 
  3. Once created, you need to assign system entitlements 
    for:  
    • Management (Needed to register with Satellite file management, etc.)  
    •  Monitoring (Needed for Monitoring) 
    • Provisioning (Needed for bare metal installation, config  
    •  Virtualization (Needed for any machine doing virtualization which is not unlimited) 
    • Virtualization Platform (Needed for any machine with unlimited virtualization) 
Configuration File Management 
  1. Go to Configuration  >  Create New Config Channel    
  2. Fill in Name, Label, & Description, then click create 
    1. Click Add Files 
    2. Click Create File 
    3.  Create the file 
Create ‘Company default’ Config Channel  #This is the Myco Config File  # It uses variables and will be customized on   # per host basis.  
MY_SYSTEMID={|rhn.system.sid|} MY_PROFILE_NAME={|rhn.system.profile_name|} MY_SYSTEM_DESCRIPTION={|rhn.system.description|} MY_HOSTNAME={|rhn.system.hostname|} MY_SYSTEM_IP={|rhn.system.ip_address|} MY_ETH0_IP={|rhn.system.net_interface.ip_address(eth0)|} MY_ETH0_NETMASK={|rhn.system.net_interface.netmask(eth0)|} MY_ETH0_BCAST={|rhn.system.net_interface.broadcast(eth0)|} MY_ETH0_MAC={|rhn.system.net_interface.hardware_address(eth0)|} MY_ETH0_DRIVER={|  rhn.system.net_interface.driver_module(eth0)|}   
 Create System Groups   
  • We’ll create 3 System Groups based on Environment (Dev, Stg, Prod) 
  • Create 3 system groups on role (app, db, web) 
    • note: Determine additional groups as needed   
  1. Go to Systems > System groups > Create New Group 
  2. Enter group name and description   
Clone a Channel 
  • This is good idea for creating dev, stg, prod channels and keeping track of software at each channel. 
  • Currently only cloned RHEL Server 6 Channel and to Dev-Rhel Server 6 
    • Fill in Description & maintainer information then Update Channel   
  • Clone all Child Channels as well 
  • Repeat for other channels as needed. 
  
Create a Custom Channel (for PostgreSQL )  
  1. Go to Channels                 > Manage Software Channels > Create New Channel 
  2. Enter the following information  
    1. Basic Channel Details 
      1. Channel Name 
      2. Channel Label 
      3. Select Parent Channel 
      4. Select Parent Channel Arch [x86_64] 
      5. Channel Summary            
    2. Channel Maintainer / Contact 
      1. Maintainer Name 
      2. Maintainer Contact info 
      3. Support Policy (if any) 
    3. Channel Access Control 
      1. Per-User Subs 
      2. Organization Sharing 
    4. Security GPG Key 
      1. If you have GPG enter it here 
  3. Then click Create Channel 
  4. Create Custom Repository (if available, otherwise push packages in via rhnpush) 
    1. Locate the YUM Repo URL  
    2. Click on Manage Repositories > Create New Repository 
    3. Enter the Repo – label and URL and then click  Create Repository    
  5. Go to Software Channels  > Select your Channel >  Repositories 
  6. Select the new Repo then click on Update List > Update Repositories 
  7. There are 3 methods to Sync 
    1. Method 1: Go to Repos > Sync  and verify the Repo is there, then click Sync Now 
    2. Method 2 = command line, skip to next step 8 
    3. Method 3 – To only sync select packages to Repo, Skip to Step 10.  
  8. Use spacewalk-repo-sync to sync packages from thirdparty (postgresql ) Repo 
    1. ]# spacewalk-repo-sync --channel postgresql-9.1 
  9. To push single packages Use rhnpush to move to satellite all PostgreSQL server packages. 
    1. tmtw1]# rhnpush postgresql91-9.1.4-3PGDG.rhel6.x86_64.rpm postgresql91-contrib-9.1.4-3PGDG.rhel6.x86_64.rpm postgresql91-libs-9.1.4-3PGDG.rhel6.x86_64.rpm --server=https://satserv.mycoinc.com/APP -u satadm -p satellite -c postgresql-9.1  note: install GPG key                  [root@satserv /]# rpm -ivh pgdg-redhat91-9.1-5.noarch.rpm  Preparing...                ########################################### [100%]     1:pgdg-redhat91          ########################################### [100%]  [root@satserv /]# cd /etc/pki/rpm-gpg/  [root@satserv rpm-gpg]# ls  RPM-GPG-KEY-PGDG-91      RPM-GPG-KEY-redhat-legacy-former   RPM-GPG-KEY-redhat-legacy-rhx  RPM-GPG-KEY-redhat-beta  RPM-GPG-KEY-redhat-legacy-release  RPM-GPG-KEY-redhat-release  [root@satserv rpm-gpg]# rpm --import RPM-GPG-KEY-PGDG-91    Copy the GPG key into /var/www/html/pub on theSatellite Server so that existing servers can access it using: 
How to Create Activation Keys 
  1. Go to Systems > Activation Keys > Create New Key 
  2. Type a description and Key name  
    1. Desc = Master Key 
    2. Key = master-key 
  3. Select Provisioning 
  4. Click ‘Create Activation Key’ 
  5. Click on  Packages and add these packages to all systems  
    • # Add ITM Packages 
    • # Add Packages for MYCO 
    • # Add Telnet Client 
    • compat-libstdc++-33-3.2.3-69.el6.x86_64 
    • glibc.x86_64 
    • ksh.x86_64 
    • nfs-utils 
    • nss-softokn-freebl.x86_64 
    • python-dmidecode 
    • python-ethtool 
    • rhn-check 
    • rhn-setup 
    • rhncfg 
    • rhncfg-actions 
    • rhncfg-client 
    • telnet.x86_64 
    • yum-rhn-plugin 

Create MYCO Configuration Channel 
  • Uploaded the following files into Config Channel 
    • /path/to/files/file1 
    • /path/to/files/file2   
  • Created new Kickstart Post Script with following contents 
    • # Get MYCO Required Packages and Install set -x       SOURCEDIR="/software/MYCO"  
            if [ ! -d $SOURCEDIR ]          then mkdir -p $SOURCEDIR       fi     wget -P /software/MYCO http://myco103/MYCO/gskcrypt64-8.0.14.11.linux.x86_64.rpm wget -P /software http://myco103/MYCO/gskssl64-8.0.14.11.linux.x86_64.rpm wget -P /software http://myco103/MYCO/TIVsm-API64.x86_64.rpm wget -P /software http://myco103/MYCO/TIVsm-BA.x86_64.rpm  
    • # Yum local install the RPM's yum localinstall /software/MYCO/*.rpm -y  
Add  NTP to Script 2 (standard Script  # Configure NTP  echo "server ntp.mycoinc.com >> /etc/ntp.conf ntpdate -u ntp.mycoinc.com chkconfig --levels 2345 ntpd on