Red Hat NETWORK 3.7 - User manual

Red Hat Network 3.7
Client Configuration Guide

Red Hat Network 3.7: Client Configuration Guide
Copyright © 2001 - 2005 by Red Hat, Inc.
Red Hat, Inc.
1801 Varsity Drive
Raleigh NC 27606-2072 USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588
Research Triangle Park NC 27709 USA
RHNclient-config(EN)-3.7-RHI (2005-03-16T12:14)
Copyright © 2005 by Red Hat, Inc. This material may be distributed only subject to the terms and conditions set forth in the
Open Publication License, V1.0 or later (the latest version is presently available at http://www.opencontent.org/openpub/).
Distribution of substantively modified versions of this document is prohibited without the explicit permission of the copyright
holder.
Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is prohibited
unless prior permission is obtained from the copyright holder.
Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat, Inc. in the United States and other
countries.
All other trademarks referenced herein are the property of their respective owners.
The GPG fingerprint of the [email protected] key is:
CA 20 86 86 2B D6 9D FC 65 F6 EC C4 21 91 80 CD DB 42 A6 0E

Table of Contents
1. Introduction..................................................................................................................................... 1
2. Client Applications.......................................................................................................................... 3
2.1. Deploying the Latest Red Hat Network Client RPMs ....................................................... 3
2.2. Configuring the Client Applications .................................................................................. 3
2.2.1. Registering with Activation Keys ....................................................................... 4
2.2.2. Using the --configure Option ........................................................................ 4
2.2.3. Updating the Configuration Files Manually ....................................................... 6
2.2.4. Implementing Server Failover............................................................................. 7
2.3. Configuring the Red Hat Network Alert Notification Tool with Satellite...................... 8
3. SSL Infrastructure.......................................................................................................................... 9
3.1. A Brief Introduction To SSL.............................................................................................. 9
3.2. The RHN SSL Maintenance Tool.................................................................................. 10
3.2.1. SSL Generation Explained................................................................................ 11
3.2.2. RHN SSL Maintenance Tool Options ............................................................ 11
3.2.3. Generating the Certificate Authority SSL Key Pair.......................................... 14
3.2.4. Generating Web Server SSL Key Sets .............................................................. 15
3.3. Deploying the CA SSL Public Certificate to Clients ....................................................... 16
3.4. Configuring Client Systems ............................................................................................. 16
4. Importing Custom GPG Keys...................................................................................................... 17
5. Using RHN Bootstrap ................................................................................................................... 19
5.1. Preparation ....................................................................................................................... 19
5.2. Generation........................................................................................................................ 20
5.3. Script Use......................................................................................................................... 20
5.4. RHN Bootstrap Options ................................................................................................. 21
6. Manually Scripting the Configuration........................................................................................ 23
7. Implementing Kickstart ............................................................................................................... 25
A. Sample Bootstrap Script.............................................................................................................. 27
Index................................................................................................................................................... 31

Chapter 1.
Introduction
This best practices guide is intended to help customers of RHN Satellite Server and RHN Proxy Server
more easily configure their client systems.
By default, all Red Hat Network client applications are configured to communicate with central Red
Hat Network Servers. When connecting clients to RHN Satellite Server or RHN Proxy Server, how-
ever, many of these settings must be altered. Altering client settings for a system or two may be
relatively simple. But a large enterprise environment, containing hundreds or thousands of systems,
will likely benefit from the mass reconfiguration steps described here.
Because of the complexity of this undertaking, customers have been given the option of generating and
using a pre-populated script that automates many of the tasks required to get your systems using your
RHN Server. Refer to Chapter 5 Using RHN Bootstrap for details. Nevertheless, Red Hat believes
you should understand the implications of these changes and therefore describes the manual steps for
reconfiguration in earlier chapters. Use your best judgement in determining the ideal solution for your
organization.
Although many of the commands provided within this guide can be applied as they appear, it is impos-
sible to predict all of the potential network configurations adopted by customers. Therefore, Red Hat
encourages you to use these commands as references that must take into account your organization’s
individual settings.

2 Chapter 1. Introduction

Chapter 2.
Client Applications
Most of the enterprise-class features of Red Hat Network have required changes to the Red Hat Net-
work client applications themselves. Of course, it’s difficult to get the latest versions of these applica-
tions until the systems are registered with Red Hat Network. This sort of chicken-and-egg problem is
especially problematic for customers who want to migrate large numbers of older systems to Red Hat
Network. This chapter identifies techniques that may be used to resolve this dilemma.
Important
Red Hat strongly recommends that clients connected to RHN Proxy Server or RHN Satellite Server
be running the latest update of Red Hat Enterprise Linux to ensure proper connectivity.
2.1. Deploying the Latest Red Hat Network Client RPMs
Since Red Hat Update Agent (up2date) and Red Hat Network Registration Client
(rhn_register) are prerequisites for using much of Red Hat Network’s enterprise functionality,
it’s crucial to install them before trying to use RHN Proxy Server or RHN Satellite Server in your
environment.
There are several sensible approaches to doing this, but they are all similar; each involves storing the
RPMs somewhere that is accessible by all client systems and deploying the packages with the simplest
command possible. This command will vary from organization to organization.
Remember, only systems running Red Hat Enterprise Linux 2.1 need to use the Red Hat Network
Registration Client to register with RHN. Systems running Red Hat Enterprise Linux 3 and later can
use the registration functionality built into the Red Hat Update Agent.
This document presumes that the customer has installed RHN Satellite Server and/or RHN Proxy
Server on the customer network. With either server type, the latest versions of both up2date and
rhn_register should have been downloaded and installed to the RHN Satellite Server or RHN
Proxy Server itself, as part of the importing process used to get the package repository populated and
up-to-date. Known working versions of both applications are placed in the /var/www/html/pub/
directory of the Proxy or Satellite.
Confirm the precise paths of the client packages before running the following command, as they may
not reside in the top-level /pub directory but instead in its subdirectories. When run from a client, this
command would then install these RPMs to that client, assuming the domain name, paths, and RPM
versions are correct:
rpm -Uvh \
http://your_proxy_or_sat.your_domain.com/pub/rhn_register-2.8.27-1.7.3.i386.rpm \
http://your_proxy_or_sat.your_domain.com/pub/rhn_register-gnome-2.8.27-1.7.3.i386.rpm \
http://your_proxy_or_sat.your_domain.com/pub/up2date-3.0.7-1.i386.rpm \
http://your_proxy_or_sat.your_domain.com/pub/up2date-gnome-3.0.7-1.i386.rpm
Note the inclusion of the associated gnome RPMs. Keep in mind, the architecture (in this case, i386)
may need to be altered depending on the systems to be served.

4 Chapter 2. Client Applications
2.2. Configuring the Client Applications
Not every customer will need to connect securely to an RHN Satellite Server or RHN Proxy Server
within their organization. And not every customer will need to build and deploy a GPG key for custom
packages. (Both of these topics are explained in detail later.) But every customer who uses RHN Satel-
lite Server or RHN Proxy Server will need to reconfigure the Red Hat Update Agent (up2date) and
possibly the Red Hat Network Registration Client (rhn_register) to be directed to the Satellite
or Proxy.
Important
Although this isn’t configurable, users should still make note that the port used by the Red Hat Update
Agent is 443 for SSL (HTTPS) and 80 for non-SSL (HTTP). By default, up2date uses SSL only. For
this reason, users should ensure their firewalls allow connections over port 443. To bypass SSL, in
/etc/sysconfig/rhn/up2date change the protocol for serverURL from https to http. Similarly,
if you will be using RHN’s Monitoring feature and probes requiring the Red Hat Network Monitoring
Daemon, note that client systems will need to allow connections on port 4545 (or port 22, if they will
use sshd instead).
By default, the Red Hat Network Registration Client and the Red Hat Update Agent refer to the
main Red Hat Network Servers. Users must reconfigure client systems to refer to the RHN Satellite
Server or RHN Proxy Server. This can be done in three different ways: using the --configure op-
tion, updating the configuration file(s) manually, or scripting a change to multiple settings at once. To
see how virtually all reconfiguration can be scripted, see Chapter 6 Manually Scripting the Configu-
ration.
Note that the latest versions of the Red Hat Update Agent can be configured to accommodate several
RHN Servers, thereby providing failover protection in case the primary server is inaccessible. Refer
to Section 2.2.4 Implementing Server Failover for instructions on enabling this feature.
2.2.1. Registering with Activation Keys
Red Hat recommends using activation keys for registering and configuring client systems that will
be using RHN Proxy Server or RHN Satellite Server. Activation keys can be used to register, entitle,
and subscribe systems in a batch. Refer to the Activation Keys section of the Red Hat Update Agent
chapter within the RHN Management Reference Guide for instructions on use.
It is possible to incorporate activation keys into a scripted configuration process, such as the one
described in Chapter 6 Manually Scripting the Configuration. To do this, create a bootstrap.sh file
much like the one described, place it in the Proxy or Satellite’s /pub directory and combine it with
the rhnreg_ks utility. For example:
wget -O http://your-satellite-FQDN/pub/bootstrap.sh | bash \
&& rhnreg_ks --activation-key b0fa829d751aEXAMPLE6983a72c8346e \
--serverUrl https://your-satellite-FQDN/XMLRPC
Warning
Systems running Red Hat Enterprise Linux 2.1 and versions of Red Hat Linux prior to 8.0 may
experience problems using Activation Keys to migrate SSL certificate settings from rhn_register
to up2date. All other settings, such as the server URL, will be properly transferred. Therefore, the
SSL certificate information on those systems will have to be set manually.

Chapter 2. Client Applications 5
2.2.2. Using the --configure Option
Both the Red Hat Network Registration Client and the Red Hat Update Agent that ship with
Red Hat Enterprise Linux provide interfaces for configuring various settings. For full listings of these
settings, refer to the chapters dedicated to the applications in the RHN Management Reference Guide.
Each application offers a graphical user interface (GUI) for configuration that enables you to change
the settings required by RHN Proxy Server or RHN Satellite Server. The only requirement for using
this option is to have the client systems running the X Window System. The command to launch the
GUI configuration interface will look like:
application_filename --configure
To reconfigure the Red Hat Update Agent, as root, run the following command:
up2date --configure
You are presented with a dialog box offering various settings that may be reconfigured. In the Gen-
eral tab, under Select a Red Hat Network Server to use replace the default value with the
fully qualified domain name (FQDN) of the RHN Satellite Server or RHN Proxy Server, such as
https://your_proxy_or_sat.your_domain.com/XMLRPC. Retain the /XMLRPC at the
end. Then click OK.
Figure 2-1. Red Hat Update Agent GUI Configuration
Make sure you enter the domain name of your RHN Satellite Server or RHN Proxy Server correctly.
Entering an incorrect domain or leaving the field blank may prevent up2date --configure from
launching. This may be resolved, however, by editing the value in the up2date configuration file.
Refer to Section 2.2.3 Updating the Configuration Files Manually for precise instructions.

6 Chapter 2. Client Applications
Warning
Systems running Red Hat Enterprise Linux 3 or newer have registration functionality built into the Red
Hat Update Agent and therefore do not have the Red Hat Network Registration Client installed.
Systems running Red Hat Enterprise Linux 2.1 (and versions of Red Hat Linux prior to 8.0) still need
to reconfigure and use the Red Hat Network Registration Client, as well as the Red Hat Update
Agent.
To reconfigure the Red Hat Network Registration Client, conduct an almost identical set of steps.
As root, run the following command:
rhn_register --configure
You are presented with a dialog box offering basic settings that may be reconfigured. Under
Select a Red Hat Network server to use: replace the default value with the fully
qualified domain name (FQDN) of the RHN Satellite Server or RHN Proxy Server, such as
https://your_proxy_or_sat.your_domain.com/XMLRPC. Retain the /XMLRPC at the
end. Then click OK.
Figure 2-2. Red Hat Network Registration Client GUI Configuration
If your version of rhn_register does not display the server field, and you cannot upgrade to a later
version, you may enter the domain name of your RHN Satellite Server or RHN Proxy Server directly
into the rhn_register configuration file. Refer to Section 2.2.3 Updating the Configuration Files
Manually for precise instructions.
2.2.3. Updating the Configuration Files Manually
As an alternative to the GUI interface described in the previous section, users may also reconfigure the
Red Hat Network Registration Client and the Red Hat Update Agent by editing the applications’
configuration files.