Red Hat NETWORK SATELLITE 5.0.0 - User manual

Red Hat Network Satellite
5.0.0
Installation Guide 5.0.0
ISBN: N/A
Publication date:

Red Hat Network Satellite

Red Hat Network Satellite: Installation Guide 5.0.0
Copyright ©2007 Red Hat, Inc.
Copyright ©2007 by Red Hat, Inc. This material may be distributed only subject to the terms and conditions set forth in
the Open Publication License, V1.0 or later (the latest version is presently available at
http://www.opencontent.org/openpub/).
Distribution of substantively modified versions of this document is prohibited without the explicit permission of the
copyright holder.
Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is
prohibited unless prior permission is obtained from the copyright holder.
Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat, Inc. in the United States and other
countries.
All other trademarks referenced herein are the property of their respective owners.
The GPG fingerprint of the [email protected] key is:
CA 20 86 86 2B D6 9D FC 65 F6 EC C4 21 91 80 CD DB 42 A6 0E
1801 Varsity Drive
Raleigh, NC 27606-2072
USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588
Research Triangle Park, NC 27709
USA

Red Hat Network Satellite

1. Introduction ........................................................................................................... 1
1. Red Hat Network ........................................................................................... 1
2. RHN Satellite Server ...................................................................................... 2
3. Terms to Understand ...................................................................................... 2
4. How it Works ................................................................................................. 3
5. Summary of Steps ......................................................................................... 5
6. Upgrades ...................................................................................................... 7
2. Requirements ........................................................................................................ 9
1. Software Requirements .................................................................................. 9
2. Hardware Requirements ................................................................................10
3. Database Requirements ................................................................................11
4. Additional Requirements ................................................................................13
3. Example Topologies ..............................................................................................19
1. Single Satellite Topology ...............................................................................19
2. Multiple Satellite Horizontally Tiered Topology ................................................20
3. Satellite-Proxy Vertically Tiered Topology .......................................................20
4. Installation ............................................................................................................23
1. Base Install ...................................................................................................23
2. RHN Satellite Server Installation Program ..................................................23
2.1. Options to the Satellite Installation Program .........................................33
3. Automated RHN Satellite Server Installation ...................................................34
4. Sendmail Configuration .................................................................................35
5. MySQL Installation ........................................................................................36
5. Entitlements ..........................................................................................................37
1. Receiving the Certificate ................................................................................37
2. Uploading the RHN Entitlement Certificate ......................................................38
3. Managing the RHN Certificate with RHN Satellite Activate .............................38
3.1. Command Line Entitlement Options ....................................................39
3.2. Activating the Satellite ........................................................................39
4. Satellite Entitlement Certificate Expiration .......................................................40
6. Importing and Synchronizing ..................................................................................41
1. Exporting with RHN Satellite Exporter ..........................................................41
1.1. rhn-satellite-exporter .................................................................41
1.2. Exporting ...........................................................................................42
2. Importing with RHN Satellite Synchronization Tool ......................................43
2.1. satellite-sync ................................................................................43
2.2. Preparing for Import from Local Media .................................................46
2.3. Running the Import .............................................................................48
3. Synchronizing ...............................................................................................49
3.1. Synchronizing Errata and Packages Directly via RHN ...........................50
3.2. Synchronizing Errata and Packages via Local Media ............................51
7. Troubleshooting ....................................................................................................53
1. Log Files ......................................................................................................53
2. General Problems .........................................................................................53
3. Host Not Found/Could Not Determine FQDN ..................................................55
4. Connection Errors .........................................................................................56
v

5. Updated Software Components .....................................................................57
6. Satellite Debugging by Red Hat .....................................................................58
8. Maintenance .........................................................................................................59
1. Managing the Satellite Service .......................................................................59
2. Updating the Satellite ....................................................................................59
3. Backing Up the Satellite ................................................................................60
4. Using RHN DB Control .................................................................................61
4.1. DB Control Options ............................................................................61
4.2. Backing up the Database ....................................................................62
4.3. Verifying the Backup ...........................................................................63
4.4. Restoring the Database ......................................................................63
5. Cloning the Satellite with Embedded DB .........................................................64
6. Establishing Redundant Satellites with Stand-Alone DB ...................................64
7. Conducting Satellite-Specific Tasks ................................................................65
7.1. Using the Tools menu ........................................................................66
7.2. Deleting Users ...................................................................................67
8. Automating Synchronization ..........................................................................68
9. Implementing PAM Authentication ..................................................................69
10. Enabling Push to Clients ..............................................................................70
A. Sample RHN Satellite Server Configuration File .....................................................73
Index .......................................................................................................................75
Red Hat Network Satellite
vi

Introduction
RHN Satellite Server provides a solution to organizations requiring absolute control over and
privacy of the maintenance and package deployment of their servers. It allows Red Hat Network
customers the greatest flexibility and power in keeping servers secure and updated.
Two types of RHN Satellite Server are available: One with a stand-alone database on a
separate machine and one with an embedded database installed on the same machine as the
Satellite. This guide describes the installation of both types of Satellite.
Although the two types of RHN Satellite Server are functionally similar, some differences do
exist. These variations are primarily isolated to hardware requirements, installation steps, and
maintenance activities. They may also appear during troubleshooting. This guide identifies
distinctions between the Satellite types by marking the differing instructions as either
Stand-Alone Database or Embedded Database.
1. Red Hat Network
Red Hat Network (RHN) is the environment for system-level support and management of Red
Hat systems and networks of systems. Red Hat Network brings together the tools, services, and
information repositories needed to maximize the reliability, security, and performance of their
systems. To use RHN, system administrators register the software and hardware profiles,
known as System Profiles, of their client systems with Red Hat Network. When a client system
requests package updates, only the applicable packages for the client are returned (based upon
the software profile stored on the RHN Servers).
Advantages of using Red Hat Network include:
• Scalability — with Red Hat Network, a single system administrator can set up and maintain
hundreds or thousands of Red Hat systems more easily, accurately, and quickly than they
could maintain a single system without Red Hat Network.
• Standard Protocols — standard protocols are used to maintain security and increase
capability. For example, XML-RPC gives Red Hat Network the ability to do much more than
merely download files.
• Security — all communication between registered systems and Red Hat Network takes place
over secure Internet connections.
• View Errata Alerts — easily view Errata Alerts for all your client systems through one website.
• Scheduled Actions — use the website to schedule actions, including Errata Updates, package
installs, and software profile updates.
• Simplification — maintaining Red Hat systems becomes a simple, automated process.
Chapter 1.
1

2. RHN Satellite Server
RHN Satellite Server allows organizations to utilize the benefits of Red Hat Network without
having to provide public Internet access to their servers or other client systems. System Profiles
are stored locally on the customer's RHN Satellite Server. The Red Hat Network website is
served from a local Web server and is not accessible from the Internet. All package
management tasks, including Errata Updates, are performed through the local area network.
Advantages of using RHN Satellite Server include:
• Security — an end-to-end secure connection is maintained from the client systems to the
RHN Satellite Server without connecting to the public Internet.
• Efficiency — packages are delivered significantly faster over a local area network.
• Control — clients' System Profiles are stored on the local RHN Satellite Server, not on the
central Red Hat Network Servers.
• Customized updates — create a truly automated package delivery system for custom
software packages required by client systems, as well as Red Hat packages. Custom
channels allow fine-grained control of the delivery of custom packages.
• Access control — system administrators can be restricted to access only those systems
within their maintenance responsibilities.
• Bandwidth management — the bandwidth used for transactions between the clients and the
RHN Satellite Server is controlled by the organization on the local area network; RHN
Satellite Server clients do not have to compete with other clients accessing the central Red
Hat Network file servers.
• Scalability — RHN Satellite Server may oversee an entire organization's servers in
combination with RHN Proxy Server.
3. Terms to Understand
Before understanding RHN Satellite Server, it is important to become familiar with the following
Red Hat Network terms:
•Channel — A channel is a list of software packages. There are two types of channels: base
channels and child channels. A base channel consists of a list of packages based on a
specific architecture and Red Hat release. A child channel is a channel associated with a
base channel that contains extra packages.
•Organization Administrator — An Organization Administrator is a user role with the highest
level of control over an organization's Red Hat Network account. Members of this role can
add other users, systems, and system groups to the organization as well as remove them. A
Chapter 1. Introduction
2

Red Hat Network organization must have at least one Organization Administrator.
•certificate authority — A Channel Administrator is a user role with full access to channel
management capabilities. Users with this role are capable of creating channels, assigning
packages to channels, cloning channels, and deleting channels. This role can be assigned by
an Organization Administrator through the Users tab of the RHN website.
•Red Hat Update Agent — The Red Hat Update Agent is the Red Hat Network client
application that allows users to retrieve and install new or updated packages for the client
system on which the application is run. For Red Hat Enterprise Linux 5 users, use the yum
command; for Red Hat Enterprise Linux 4 and lower, use the up2date command.
•Traceback — A traceback is a detailed description of "what went wrong" that is useful for
troubleshooting the RHN Satellite Server. Tracebacks are automatically generated when a
critical error occurs and are mailed to the individual(s) designated in the RHN Satellite
Server's configuration file.
For more detailed explanations of these terms and others, refer to the Red Hat Network
Reference Guide.
4. How it Works
RHN Satellite Server consists of the following components:
• Database — for the Stand-Alone Database, this may be the organization's existing database
or, preferably, a separate machine. RHN Satellite Server supports Oracle 9i R2. For the
Embedded Database, the database comes bundled with RHN Satellite Server and is installed
on the same machine as the Satellite during the installation process.
•RHN Satellite Server — core "business logic" and entry point for Red Hat Update Agent
running on client systems. The RHN Satellite Server also includes an Apache HTTP Server
(serving XML-RPC requests).
• RHN Satellite Server Web interface — advanced system, system group, user, and channel
management interface.
• RPM Repository — package repository for Red Hat RPM packages and custom RPM
packages identified by the organization.
• Management Tools:
• Database and file system synchronization tools
• RPM importing tools
• Channel maintenance tools (Web-based)
How it Works
3

• Errata management tools (Web-based)
• User management tools (Web-based)
• Client system and system grouping tools (Web-based)
•Red Hat Update Agent on the client systems
The Red Hat Update Agent on the client systems must be reconfigured to retrieve updates
from the organization's internal RHN Satellite Server instead of the central Red Hat Network
Servers. After this one-time reconfiguration, client systems may retrieve updates locally using
the Red Hat Update Agent, or system administrators may schedule actions through the RHN
Satellite Server website.
Important
Red Hat strongly recommends that clients connected to RHN Satellite Server be
running the latest update of Red Hat Enterprise Linux to ensure proper
connectivity.
When a client requests updates, the organization's internal RHN Satellite Server queries its
database, authenticates the client system, identifies the updated packages available for the
client system, and sends the requested RPMs back to the client system. Depending upon the
client's preferences, the package may also be installed. If the packages are installed, the client
system sends an updated package profile to the database on the RHN Satellite Server; those
packages are removed from the list of outdated packages for the client.
The organization can configure the website for the RHN Satellite Server to be accessible from
the local area network only or from both the local area network and the Internet. The Satellite's
version of the RHN website allows full control over client systems, system groups, and users.
The RHN Satellite Server management tools are used to synchronize the RHN Satellite Server
database and package repository with Red Hat Network. The RHN Satellite Server import tool
allows the system administrator to include custom RPM packages in the package repository.
RHN Satellite Server can be used in conjunction with RHN Proxy Server to deliver a distributed,
self-contained Red Hat Network deployment for the organization. For example, an organization
can maintain one RHN Satellite Server in a secure location. Red Hat systems with local network
access to the RHN Satellite Server can connect to it. Other remote offices can maintain RHN
Proxy Server installations that connect to the RHN Satellite Server. The different locations
inside the organization must be networked, but this can be a private network; an Internet
connection is not required for any of the systems. Refer to the RHN Proxy Server Installation
Guide for more information.
Chapter 1. Introduction
4

Figure 1.1. Using RHN Satellite Server and RHN Proxy Server Together
5. Summary of Steps
Implementing a fully functional RHN Satellite Server requires more than installing software and
a database. Client systems must be configured to use the Satellite. Custom packages and
channels should be created for optimal use. Since these tasks extend beyond the basic
installation, they are covered in detail in other guides, as well as this RHN Satellite Server
Installation Guide. For a full list of the necessary technical documents, refer to Chapter 2,
Requirements.
For this reason, this section seeks to provide a definitive list of all required and recommended
steps, from evaluation through custom package deployment. They should take place in roughly
this order:
1. After an evaluation, you contact your Red Hat sales representative to purchase RHN Satellite
Server.
2. Your Red Hat contact sends you an RHN Entitlement Certificate via email.
3. Your Red Hat contact creates a Satellite-entitled account on the RHN website and sends you
Summary of Steps
5

the login information.
4. Log into the RHN website (rhn.redhat.com) and download the distribution ISOs for Red Hat
Enterprise Linux AS 3 or 4 and RHN Satellite Server 5.0.0. These can be found within the
Downloads tab of the respective Channel Details pages. Refer to the RHN Reference
Guide for instructions.
5. While still logged into the RHN website, download the Channel Content ISOs to be served by
your Satellite, also available through the Downloads tab of your Satellite's Channel Details
page. These Channel Content ISOs differ from the distribution ISOs previously mentioned in
that they contain metadata necessary for parsing and serving packages by Satellite.
6. If installing a Stand-Alone Database, prepare your database instance using the formula
provided in Chapter 2, Requirements.
7. Install Red Hat Enterprise Linux AS and then RHN Satellite Server 5.0.0 on the Satellite
machine.
8. Create the first user account on the Satellite by opening the Satellite's hostname in a Web
browser and clicking Create Account. This will be the Satellite Administrator's (also referred
to as the Organization Administrator) account.
9. Use the RHN Satellite Synchronization Tool to import the channels and associated
packages into the Satellite.
10.Register a representative machine for each distribution type, or channel (Red Hat Enterprise
Linux AS 2.1, 3, 4), to the Satellite.
11.Copy (using SCP) the rhn_register and up2date configuration files from the
/etc/sysconfig/rhn/ directory of each machine individually to the /pub/ directory on the
Satellite. The rhn-org-trusted-ssl-cert-*.noarch.rpm will already be there.
12.Download and install from the Satellite the configuration files and
rhn-org-trusted-ssl-cert-*.noarch.rpm on the remaining client systems of the same
distribution type. Repeat this and the previous step until all distribution types are complete.
13.Through the Satellite's website, create an Activation Key for each distribution aligned to the
appropriate base channel. At this point, system groups and child channels may also be
predefined.
14.Run the Activation Key from the command line (rhnreg_ks) of each client system. Note that
this step can be scripted to batch register and reconfigure all remaining client systems in a
distribution.
15.Record all relevant usernames, passwords and other login information and store in multiple
secure places.
16.Now that the Satellite is populated with standard Red Hat channels and packages and all
clients are connected to it, you may begin creating and serving custom channels and
packages. Once the custom RPMs are developed, you can import them into the Satellite
Chapter 1. Introduction
6

using RHN Push and add custom channels in which to store them through the Satellite's
website. Refer to the RHN Channel Management Guide for details.
6. Upgrades
The process for upgrading a Satellite from one version to another is not covered within this
Satellite Guide, but can be found within the Red Hat Knowledgebase (
http://kbase.redhat.com/faq/ [http://kbase.redhat.com/faq/]) and can be found by performing a
search for upgrade satellite or by following this link —
http://kbase.redhat.com/faq/FAQ_49_8610.shtm.
Upgrades
7

8

Requirements
These requirements must be met before installation.
1. Software Requirements
To perform an installation, the following software components must be available:
• Base operating system — RHN Satellite Server is supported with Red Hat Enterprise Linux
AS 3 Update 5 or later, or Red Hat Enterprise Linux AS 4 or later. The operating system can
be installed from disc, local ISO image, kickstart, or any of the methods supported by Red
Hat, but must provide the @Base package group and the ntp package.
Note
When Red Hat Enterprise Linux is mentioned, it refers to the x86, 32-bit version.
All other variants of Red Hat Enterprise Linux are currently unsupported as a
base operating system for the Satellite.
Warning
Security-enhanced Linux (SELinux) must be disabled or in permissive mode prior
to installation of RHN Satellite Server. To do this during CD or ISO image
installation, select Permissive when presented with options for SELinux support.
To do this for kickstart installation, include the command selinux
--permissive or wait for the install to complete, edit the /etc/selinux/config
file to read SELINUX=permissive and reboot the system.
More in-depth coverage of SELinux is available at http://www.redhat.com/docs/.
You may also refer to the Red Hat Knowledgebase article on SELinux and RHN
Satellite Server at http://kbase.redhat.com/faq/.
• Satellite installation disc or ISO — this contains the RHN Satellite Server Installation
Program. All packages required in order to suport the Program are installed automatically,
and require no intervention from the user.
Chapter 2.
9

Note
Installing packages other than the packages contained in the @Base package
group and the ntp package can lead to package conflicts.
• Channel content — All software packages and data exported for all entitled Red Hat
channels. This content may be loaded directly on the Satellite after installation using the RHN
Satellite Synchronization Tool or obtained from your Red Hat representative if
synchronization is not possible, such as in a disconnected environment.
When installing Red Hat Enterprise Linux AS 3 or 4 from CD or ISO image, there is no need to
select any package groups, only the base install is required. When installing either operating
system via kickstart, select the @ Base package group.
2. Hardware Requirements
The following hardware configuration is required for the two types of RHN Satellite Server:
Stand-Alone Database Embedded Database
Required - Pentium IV processor, 2.4GHz,
512K cache or equivalent Required - Pentium IV processor, 2.4GHz, 512K cache or equivalent
Recommended - Pentium IV processor,
2.4GHz dual processor, 512K cache or
equivalent
Recommended - Pentium IV processor,
2.4GHz dual processor, 512K cache or
equivalent
Required - 2 GB of memory Required - 2 GB of memory
Recommended - 4 GB of memory Strongly recommended - 4 GB of memory
3 GB storage for base install of Red Hat
Enterprise Linux AS 3 GB storage for base install of Red Hat Enterprise Linux AS
6 GB storage per channel, in the
/var/satellite/ directory by default but
configurable at install
6 GB storage per channel, in the
/var/satellite/ directory by default but
configurable at install
Recommended - an external SAN for more
reliable backups Recommended - an external SAN for more reliable backups
12 GB storage for the database repository, in
the /rhnsat partition (local storage only)
Strongly recommended - a SCSI drive
connected to a level 5 RAID
Separate partition (or better, a separate set of
physical disks) for storing backups. This can
be any directory specifiable at backup time.
Chapter 2. Requirements
10

Table 2.1. Stand-Alone Database and Embedded Database Satellite
Hardware Requirements
The following hardware configuration is required for the Stand-Alone Database:
• Two processors
• 2 GB of memory
See Section 3, “Database Requirements” for instructions on estimating the tablespace of the
database and setting its environment variables.
Keep in mind, the frequency with which client systems connect to the Satellite is directly related
to load on the Apache Web server and the database. Reducing the default interval of four hours
(or 240 minutes) as set in the /etc/sysconfig/rhn/rhnsd configuration file of the client
systems significantly increases the load on those components.
Additional hardware requirements include:
• The Stand-Alone Database must not run on the same server as the RHN Satellite Server.
• The package repository may be any large storage device easily and securely accessed by the
other components. The space requirements depend on the number of packages that will be
stored. Default Red Hat channels contain approximately 3 GB of packages each, and that
size grows with each synchronization; customers must also account for the space
requirements of packages in their own private channels. Whatever storage solution the
customer chooses, its mount point may be defined during the installation process.
If you are installing RHN Satellite Server with Embedded Database, skip to Section 4,
“Additional Requirements”.
3. Database Requirements
This section applies only to RHN Satellite Server with Stand-Alone Database as the
requirements for the Embedded Database are included in the Satellite machine's hardware
requirements. Red Hat supports RHN Satellite Server 5.0.0 installations in conjunction with
Oracle 9i R2. The Stand-Alone Database must not run on the same server as the RHN Satellite
Server.
A single 6 GB tablespace is recommended as more than sufficient for most installations. It is
possible for many customers to function with a smaller tablespace. An experienced Oracle
database administrator (DBA) will be necessary to assess sizing issues. The following formula
should be used to determine the required size of your database:
Database Requirements
11

• 192 KB per client system
• 64 MB per channel
For instance, an RHN Satellite Server containing 10 channels serving 10,000 systems would
require 1.92 GB for its clients and 640 MB for its channels. If custom channels are to be
established for testing and staging of packages, they must be included in this formula.
Keep in mind, the database storage needs may grow rapidly, depending upon the variance of
the following factors:
• The number of public Red Hat packages imported (typical: 5000)
• The number of private packages to be managed (typical: 500)
• The number of systems to be managed (typical: 1000)
• The number of packages installed on the average system (typical: 500)
Although you should be generous in your database sizing estimates, you must consider that
size affects the time to conduct backups and adds load to other system resources. If the
database is shared, its hardware and spacing are entirely dependent on what else is using it.
Additionally, block sizes must be a minimum of 8 KB for RHN Satellite Server to install properly.
The Oracle database should have a user assigned to RHN Satellite Server with full DDL and
DML access to that user's default tablespace. The user needs standard connection information
for the database at the time of installation.
The precise access levels required by the Oracle user are as follows:
• ALTER SESSION
• CREATE SEQUENCE
• CREATE SYNONYM
• CREATE TABLE
• CREATE VIEW
• CREATE PROCEDURE
• CREATE TRIGGER
• CREATE TYPE
• CREATE SESSION
Chapter 2. Requirements
12

Additional database requirements include:
• Security Identifier (SID)
• Listener Port
• Username
• Uniform Extent Size
• Auto Segment Space Management
• UTF-8 character set
Note
Ensure that the NLS/charset setting is set to "UTF8"' when using an external
database, not 'AL32UTF8' or other charsets. Using other charsets may lead to
problems later.
The disk layout on the database machine is independent of the RHN Satellite Server and
entirely up to the customer.
4. Additional Requirements
The following additional requirements must be met before the RHN Satellite Server installation:
• Full Access
Client systems need full network access to the RHN Satellite Server solution's services and
ports.
•Firewall Rules
RHN strongly recommends firewalling the RHN Satellite Server solution from the Internet.
However, various TCP ports must be opened on the Satellite, depending on your
implementation of RHN Satellite Server:
Port Direction Reason
80 Outbound Satellite uses this port to reach
rhn.redhat.com [https://rhn.redhat.com],
xmlrpc.rhn.redhat.com
[http://xmlrpc.rhn.redhat.com] and
satellite.rhn.redhat.com
Additional Requirements
13

Port Direction Reason
http://satellite.rhn.redhat.com](unless
running in a disconnected mode for
Satellite)
80 Inbound WebUI and client requests come in via
either http or https
443 Inbound WebUI and client requests come in via
either http or https
443 Outbound To reach rhn.redhat.com
[https://rhn.redhat.com],
xmlrpc.rhn.redhat.com
[http://xmlrpc.rhn.redhat.com] and
satellite.rhn.redhat.com
[http://satellite.rhn.redhat.com](unless
running in a disconnected mode for
Satellite)
4545 Outbound RHN Satellite Server Monitoring makes
connections to rhnmd running on client
systems, if Monitoring is enabled and
probes are configured for registered
systems.
5222 Inbound If you plan to push actions to client
systems
5269 Inbound If you push actions to an RHN Proxy
Server
Table 2.2. Ports to open on the Satellite
•Synchronized System Times
There is great time sensitivity when connecting to a Web server running SSL (Secure Sockets
Layer); it is imperative that the time settings on the clients and server be reasonably close
together so the SSL certificate does not expire before or during use. For this reason, Red Hat
requires the Satellite and all client systems to use Network Time Protocol (NTP). This also
applies to the separate database machine in RHN Satellite Server with Stand-Alone
Database, which must also be set to the same time zone as the Satellite.
•Fully Qualified Domain Name (FQDN)
The system upon which the RHN Satellite Server will be installed must resolve its own FQDN
properly. If this is not the case, cookies will not work properly on the website.
Chapter 2. Requirements
14