User manual REDHAT NETWORK SATELLITE 5.1.1 INSTALLATION GUIDE

[. . . ] Red Hat Network Satellite 5. 1. 1 Installation Guide Red Hat Network Satellite Installation Guide Red Hat Network Satellite 5. 1. 1 Installation Guide Red Hat Network Satellite Edition 5. 1. 1 1. Red Hat Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RHN Satellite Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Terms to Understand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Receiving the Certificate The RHN Entitlement Certificate is an XML document that looks something like this: <?xml version="1. 0" encoding="UTF-8"?> <rhn-cert version="0. 1"> <rhn-cert-field name="product">RHN-SATELLITE-001</rhn-cert-field> <rhn-cert-field name="owner">Clay's Precious Satellite</rhn-cert-field> <rhn-cert-field name="issued">2005-01-11 00:00:00</rhn-cert-field> <rhn-cert-field name="expires">2005-03-11 00:00:00</rhn-cert-field> <rhn-cert-field name="slots">30</rhn-cert-field> <rhn-cert-field name="provisioning-slots">30</rhn-cert-field> <rhn-cert-field name="nonlinux-slots">30</rhn-cert-field> <rhn-cert-field name="channel-families" quantity="10" family="rhelcluster"/> <rhn-cert-field name="channel-families" quantity="30" family="rhel-wsextras"/> <rhn-cert-field name="channel-families" quantity="10" family="rhelgfs"/> <rhn-cert-field name="channel-families" quantity="10" family="rhel-esextras"/> <rhn-cert-field name="channel-families" quantity="40" family="rhel-as"/ > <rhn-cert-field name="channel-families" quantity="30" family="rhntools"/> <rhn-cert-field name="satellite-version">3. 6</rhn-cert-field> <rhn-cert-field name="generation">2</rhn-cert-field> <rhn-cert-signature> -----BEGIN PGP SIGNATURE----Version: Crypt::OpenPGP 1. 03 iQBGBAARAwAGBQJCAG7yAAoJEJ5yna8GlHkysOkAn07qmlUrkGKs7/5yb8H/nboG mhHkAJ9wdmqOeKfcBa3IUDL53oNMEBP/dg== 33 Chapter 5. Entitlements =0Kv7 -----END PGP SIGNATURE----</rhn-cert-signature> </rhn-cert> Note Do not try to use this RHN Entitlement Certificate; it is just an example. The initial RHN Entitlement Certificate is generated by a member of the RHN team and emailed to a consultant or customer prior to installation. This process helps guarantee that we do not inadvertently install any RHN Satellite Servers that the RHN team does not know about. Save the XML file to the Satellite machine in preparation for activation. 5. 2. Uploading the RHN Entitlement Certificate If your RHN Satellite Server is connected to the Internet, you have the option of uploading your new RHN Entitlement Certificate through the RHN website. Log into https://rhn. redhat. com with your organization's Satellite-entitled account. Click Systems in the top navigation bar and then the name of the RHN Satellite Server. You may also find the Satellite through the Satellite line item within the Channels category. In the System Details page, click the Satellite subtab and examine the existing certificate. Ensure you have a backup of this file by copying and pasting its contents into a text editor. You will receive a message describing the deactivation at the top of the page. You may then browse to the location of your new RHN Entitlement Certificate or paste its contents into the text field provided. Your Satellite now has access to additional channels and client entitlements outlined in the new certificate. Managing the RHN Certificate with RHN Satellite Activate For disconnected Satellites or customers who prefer to work locally, Red Hat provides a command line tool for managing your RHN Entitlement Certificate and activating the Satellite using that certificate: RHN Satellite Activate (rhn-satellite-activate). This is included with the Satellite installation as part of the rhns-satellite-tools package. 5. 3. 1. Command Line Entitlement Options The rhn-satellite-activate tool offers a handful of command line options for activating a Satellite using its RHN Entitlement Certificate: 34 Activating the Satellite Option -h, --help --sanity-only --disconnected --rhn-cert=/PATH/TO/CERT --systemid=/PATH/TO/SYSTEMID Description Display the help screen with a list of options. Uploads new certificate and activates the Satellite based upon the other options passed (if any). For testing only - Provides an alternative system ID by path and file. RHN Entitlement Certificate Options To use these options, insert the option and the appropriate value, if needed, after the rhnsatellite-activate command. Refer to Section 5. 3. 2, "Activating the Satellite". 5. 3. 2. Activating the Satellite You should use the options in Table 5. 1, "RHN Entitlement Certificate Options" to accomplish the following tasks in this order: 1. Validate the RHN Entitlement Certificate's sanity (or usefulness). [. . . ] To enable the Satellite to use PAM and your organization's authentication infrastructure, follow the steps below. Note To ensure that PAM authentication functions properly, install the pam-devel package. Set up a PAM service file (usually /etc/pam. d/rhn-satellite) and have the Satellite use it by adding the following line to /etc/rhn/rhn. conf: pam_auth_service = rhn-satellite This assumes the PAM service file is named rhn-satellite. To enable a user to authenticate against PAM, select the checkbox labeled Pluggable Authentication Modules (PAM). It is positioned below the password and password confirmation fields on the Create User page. As an example, for a Red Hat Enterprise Linux 4 i386 system, to authenticate against Kerberos one could put the following in /etc/pam. d/rhn-satellite: #%PAM-1. 0 auth auth auth account required sufficient required required pam_env. so pam_krb5. so no_user_check pam_deny. so pam_krb5. so no_user_check Please note that changing the password on the RHN website changes only the local password on the RHN Satellite Server, which may not be used at all if PAM is enabled for that user. [. . . ]