Satellite 6.1 on RHEL 6

Really, really reconsider running Satellite 6 on RHEL 6.  While technically Red Hat support it there are just too many performance reasons to ignore RHEL 7.  Get your SOE updated to RHEL 7 if you have to before going with Satellite 6. 
-------

subscription-manager clean
subscription-manager register
subscription-manager list --available | tee /root/subs.avail
sed -n '/^Subscription Name:   Red Hat Satellite$/,/^Pool ID:/ p' /root/subs.avail
subscription-manager attach --pool=<satellite_pool_id>
subscription-manager release --set=6Server
subscription-manager repos --disable=*

Repositories to subscribe to for RHEL 6.
subscription-manager repos --enable rhel-6-server-rpms --enable rhel-server-rhscl-6-rpms --enable rhel-6-server-satellite-6.1-rpms

yum repolist
yum remove java*
yum update

iptables -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p udp --dport 67 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p udp --dport 68 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p udp --dport 69 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p tcp --dport 5647 -j ACCEPT \
&& iptables -A INPUT -m state --state NEW -p tcp --dport 8140 -j ACCEPT \
&& iptables-save > /etc/sysconfig/iptables

service iptables start
chkconfig iptables on

init 6

yum install katello

katello-installer --foreman-initial-organization "Spud" \
--foreman-initial-location "Private"

Could not set 'present' on ensure: 422 Unprocessable Entity at 12:/usr/share/katello-installer/modules/foreman_proxy/manifests/register.pp

Found my answer here.  It really does seem to be an issue for some KVM test rigs:
http://unixrevolution.blogspot.com.au/2015/09/satellite-6-installation-issues.html

Resolution: 

foreman-rake config -- -k idle_timeout -v 60
foreman-rake config -- -k proxy_request_timeout -v 99

katello-installer --foreman-initial-organization "Spud" \
--foreman-initial-location "Private"

Install Red Hat Satellite 6.1 on RHEL 7.1 with Internet Access

References

• Red Hat Satellite 6.1 - Installation Guide 

KVM Hardware

•  3 cores of an i7 @2.9GHz
• 10GB RAM (Red Hat recommends a minimum of 12, some play with as little as 8GB. 
• 100GB Virt SCSI Disk ("/" root only file system layout)

Disk usage for RHEL 7 + Red Hat Satellite + following RHEL 7 Repositories = 32GB
I recommend starting with a 100GB disk if you intend to keep and use the Satellite instance.

Laptop Hardware

• Intel(R) Core(TM) i7-4800MQ CPU @ 2.70GHz
• 16GB RAM
• 150GB SATA Disk @7200rpm ("/" root only file system layout)

 Installing Red Hat Satellite 6.1 (with Direct Internet Access)

Fix up the Product Subscriptions: 
(I did a crazy thing and re-used a RHEL 7 Workstation installation so I had to copy the file /etc/pki/product/69.pem from a RHEL 7 Server to the laptop/workstation, and remove the other "product" pem file for "Workstation. See Why does command 'subscription-manager list' return: "No Installed Products found" ?)
subscription-manager register
subscription-manager remove --all
subscription-manager list --available --all | sed -n '/^Subscription Name:   Red Hat Satellite$/,/^Pool ID:/ p'
subscription-manager subscribe --pool=<pool_id_Red_Hat_Satellite>
subscription-manager release --set=7Server

Disable any existing repositories:
subscription-manager repos --disable=*

Confirm all the repositories are disabled:
subscription-manager repos --list-enabled
Repositories to subscribe to for RHEL 7:
subscription-manager repos --enable rhel-7-server-extras-rpms --enable rhel-7-server-satellite-6.1-rpms --enable rhel-server-rhscl-7-rpms --enable rhel-7-server-rh-common-rpms --enable rhel-7-server-satellite-tools-6.1-rpms --enable rhel-7-server-rpms
Check the repositories listed are the *only* that were just subscribed:
yum repolist

Going to request that "java" is removed twice as it is a common source of installation failure!
yum remove java*
yum update

Enable external entities to connect to the following *optional* services on the Red Hat Satellite server:   DNS
firewall-cmd --permanent --add-port="53/udp" --add-port="53/tcp"

Enable external entities to connect to the following *optional* services on the Red Hat Satellite server:  DHCP
firewall-cmd --permanent --add-port="67/udp" --add-port="68/udp"

Enable external entities to connect to the following *optional* services on the Red Hat Satellite server:  TFTP
firewall-cmd --permanent --add-port="69/udp"

Enable external entities to connect to the following *optional* services on the Red Hat Satellite server:  Puppet Master
firewall-cmd --permanent --add-port="8140/tcp"

Enable external entities to connect to the following services on the Red Hat Satellite server:  HTTP, HTTPS, Katello Message Router
firewall-cmd --permanent --add-port="80/tcp" --add-port="443/tcp" --add-port="5647/tcp"

firewall-cmd --reload

The following reboot is optional but it is recommended following software updates and firewall rule changes.
systemctl reboot


yum remove java*  # Yes this is a repeat, making sure you did it!
Java will be installed as a dependency of the "katello" package.
yum install katello


Backup and edit /etc/katello-installer/answers.katello-installer.yaml
cp /etc/katello-installer/answers.katello-installer.yaml /etc/katello-installer/answers.katello-installer.yaml_$(date '+%y%m%d%H%M')

Change the values for "initial_organization" and "initial_location" to something meaningful to your installation in the file /etc/katello-installer/answers.katello-installer.yaml
...
  foreman:
...
    initial_organization: "Default Organization"
...
    initial_location: "Default Location"
...







For a "simple" installation of Red Hat Satellite without DNS, DHCP and TFTP run "katello-installer" without options or changes to the default answers file.  "katello-installer" can be re-run again to add any of those components at a later time.
katello-installer
Save the initial password for the admin user.

Secure "elasticsearch" to only be accessible by the users "foreman" and "root".
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT && firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP && firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p tcp -m tcp --dport 9200 -j DROP
firewall-cmd --reload

First Login

Log into the Red Hat Satellite URL and credentials provided by the instructions at the end of the "katello-installer" command. Save the admin user's password or set a new password via:
Admin User -> My Account -> User.  Enter the new password at the "Password" and "Verify" fields and then click the "Submit" button.

Load a Satellite Manifest

 Content -> Red Hat Subscriptions -> [Mange Manifest ->] Actions -> Upload New Manifest - Browse -> Upload

Initial Red Hat Content Sync

Content -> Red Hat Repositories -> RPMs -> Red Hat Enterprise Linux Server -> Red Hat Satellite Tools 6.1 (for RHEL 7 Server) (RPMS) -> Enabled (tick)

Content -> Sync Status -> Expand All -> Red Hat Satellite Tools 6.1 for RHEL 7 Server RPMs x86_64 (tick) -> Synchronize Now

Wait for it to download the content to make sure there are no issues with Satellite reaching back to Red Hat's Content Delivery Network.

Base RHEL Content Sync

Content -> Red Hat Repositories -> RPMs -> Red Hat Enterprise Linux Server -> Red Hat Enterprise Linux 7 Server (RPMS) -> Red Hat Enterprise Linux 7 Server RPMs X86_64 7Server -> Enabled (tick)
Consider enabling the repositories for:

• Extras
• Fastrack
• Optional
• Optional Fastrack
• RH Common
• Supplementary

 Content -> Sync Status -> Select All -> Synchronize Now

Configuration Note

There is no single path to follow to configure Satellite 6. Many of the resources depend on other resources but you define each single resource in turn.  For example an Organization has many Subnets and a Subnet can be associated with many Organizations.

It gets a lot more complicated than that. Some resources when you initially define them only show a few fields to complete. Afterwards when viewing that same resource you may find it has many tabs of configurable items.

Don't beat yourself up for not configuring in an optimum order.  There probably is not one. You will find as you configure Satellite you will have to revisit some resources to add additional configuration information. Satellite allows for this and it is just the nature of circular relationships.

Sanity Check

Before you can ever run katello-installer again, for example to add other modules such as dhcp and tftp, make sure the same fully qualified host name is returned by both commands:
facter fqdnhostname -f

It is my experience that an entry for the Satellite server needs to be added to /etc/hosts  for its primary NIC. Adding alias to the 127.0.0.1 entry does not cut it ;-)

Configure DHCP and TFTP

Backup and edit /etc/katello-installer/answers.katello-installer.yaml
...
    tftp: true
    tftp_syslinux_root:
    tftp_syslinux_files:
    tftp_root: /var/lib/tftpboot/
    tftp_dirs:
      - /var/lib/tftpboot/pxelinux.cfg
      - /var/lib/tftpboot/boot
    tftp_servername:
...
    dhcp: true
    dhcp_listen_on: https
    dhcp_option_domain:
      - spud.did.it
    dhcp_managed: true
    dhcp_interface: enp0s25
    dhcp_gateway: "192.168.1.1"
    dhcp_range: "192.168.1.100 192.168.1.239"
    dhcp_nameservers: "192.168.1.1"
    dhcp_vendor: isc
    dhcp_config: /etc/dhcp/dhcpd.conf
    dhcp_leases: /var/lib/dhcpd/dhcpd.leases
    dhcp_key_name: ""
    dhcp_key_secret: ""
...

Update Satellite 6 configuration:
katello-installer

Checks

cat /etc/dhcp/dhcpd.conf
systemctl status dhcpd
cat /etc/xinetd.d/tftp
find /var/lib/tftpboot/
systemctl status xinetd

Import Subnets

Infrastructure -> Capsules -> (drop down list for Satellite server) Import subnets
Fill in any missing details about the sub-net.

IPAM == IP Address Management

You can select one of three possible IPAM modes:

• DHCP - will manage the IP on DHCP through assigned DHCP proxy, auto-suggested IPs come from DHCP
• Internal DB - use internal DB to auto-suggest free IP based on other interfaces on same subnet respecting range if specified, useful mainly with static boot mode
• None - leave IP management solely on user, no auto-suggestion

Finish Configuring the Subnet

Infrastructure ->Subnets -> (imported subnet name)

Domain Configuration

Satellite 6 considers a domain and a DNS zone as the same thing. That is, if you are planning to manage a site where all the machines are or the form hostname.somewhere.com then the domain is somewhere.com. This allows Satellite 6 to associate a puppet variable with a domain/site and automatically append this variable to all external node requests made by machines at that site.
The fullname field is used for human readability in reports and other pages that refer to domains, and also available as an external node parameter.

Configure a Compute Resource

Infrastructure -> Compute Resources -> New Compute Resource

Headless firewall-config on RHEL 7.1

The following package dependencies are missing on firewall-config-0.3.9-11.el7.noarch

• libcanberra-gtk3-0.30-5.el7.x86_64
• PackageKit-gtk3-module-0.8.9-11.el7.x86_64
• NetworkManager-glib.x86_64
• xorg-x11-fonts-ISO8859-1-100dpi
• xorg-x11-fonts-ISO8859-1-75dpi
• xorg-x11-fonts-misc
• xorg-x11-fonts-Type1
• xorg-x11-font-utils

Without these extra packages running firewall-config over "ssh -Y" fails.

Try this to get it working in one command:

yum install firewall-config xorg-x11-xauth libcanberra-gtk3-0.30-5.el7.x86_64 PackageKit-gtk3-module-0.8.9-11.el7.x86_64 NetworkManager-glib.x86_64 xorg-x11-fonts-ISO8859-1-100dpi xorg-x11-fonts-ISO8859-1-75dpi xorg-x11-fonts-misc xorg-x11-fonts-Type1 xorg-x11-font-utils

============================
The error message was:


# firewall-config

** (firewall-config:1325): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-uu77vqCHr1: Connection refused
Gtk-Message: Failed to load module "pk-gtk-module"
Gtk-Message: Failed to load module "canberra-gtk-module"
ERROR:root:Could not find any typelib for NetworkManager
Traceback (most recent call last):
  File "/usr/bin/firewall-config", line 34, in <module>
    from gi.repository import NetworkManager
ImportError: cannot import name NetworkManager
 

Red Hat Satellite 5.6 to 5.7 Cheat Sheet

References:

• Red Hat Satellite 5.7 - Installation Guide
• Satellite 5.7.0 Installer for RHEL-6 ISO (RHN account required)
• Red Hat Satellite 5 Integrity Checker

Procedure

1. Commence the download of the installation ISO for Red Hat Satellite 5.7 Installer from the Red Hat Customer Portal, Downloads section.
2. Create the new Red Hat Satellite 5.7 Certificate and attach the required subscriptions. It may take some time for the certificate to become available so it is good to start this early on. Don’t forget to include a Satellite entitlement otherwise the “Download Certificate” button will never activate. You may have to wait awhile and refresh the page but mostly I find it works within a few minutes.
3. Backup your database. Note that PostgreSQL (postmaster) takes awhile to shutdown:
   

   rhn-satellite stop
   mkdir /var/satellite/Backups/20150219-2211.dump
   db-control backup /var/satellite/Backups/20150219-2211.dump
   

4. Consider using spacewalk-data-fsck to help clean-up the Red Hat Satellite database before you start. This takes a long while!
   

   spacewalk-data-fsck -v -r
   

5. Ensure you Red Hat Satellite 5.6 server is up-to-date:
   

   yum update
   

   Depending on what packages get updated you may want to reboot and stop Red Hat Satellite to get back to the same state:
   

    init 6
    rhn-satellite stop
   

6. Check the database schema version and the installed schema package are the same. Otherwise you may have to update the database schema:
   

   service postgresql start
   rhn-schema-version
   rpm -q --qf '%{version}-%{release}\n' satellite-schema
   

   If the versions are different then update the schema:
   

   spacewalk-schema-upgrade
   

7. Install the software that will perform the upgrade to Red Hat Satellite 5.7. It is in the Red Hat Satellite 5.6 software channel redhat-rhn-satellite-5.6-server-x86_64-6:
   

   yum install rhn-upgrade
   

8. Ensure there is more free space on the file system that will house /opt/rh/postgresql92/root/var/lib/pgsql/data than is presently consumed at /var/lib/pgsql. A minimum of 12GB is required:
   

       du -hs /var/lib/pgsql/
   

   Consider deleting the satsync directory contents if you require additional free space for the upgrade to occur.
   Important – /opt/rh/postgresql92/root/var/lib/pgsql/data
   

   Due to an updated version of the PostgreSQL Embedded Database, the database location has changed from /var/lib/pgsql/data in Red Hat Satellite 5.6 to /opt/rh/postgresql92/root/var/lib/pgsql/data in Red Hat Satellite 5.7. Make sure to allocate enough hard disk space to this location.

   rm -rf /var/cache/rhn/satsync/*
   

9. Transfer the ISO for Red Hat Satellite 5.7 Installer to the Red Hat Satellite server.
10. Transfer the Red Hat Satellite 5.7 certificate from RHN to the server.
11. Mount the ISO for Red Hat Satellite 5.7 Installer:
    

    mount -o ro,loop /root/satellite-5.7.0-20150108-rhel-6-x86_64.iso /mnt
    

12. Run the installer with the upgrade switch:
    Important
    

    Use additional options if your Red Hat Satellite is disconnected or using a Managed Database or External Database.

    cd /mnt
    ./install.pl --upgrade
    

    Accept the offer to resolve the dependencies.
    “Installing RHN packages” appears to take a really long time (many many minutes). Going to bed now :-p
    Yes it does take a long time and then “Setting up SELinux…” takes a while longer!
13. Upgrade the database schema:
    

    spacewalk-schema-upgrade
    

    Check the database schema version and the installed schema package are the same. Otherwise you may have to update the database schema:
    

    rhn-schema-version
    rpm -q --qf '%{version}-%{release}\n' satellite-schema
    

14. Activate the Red Hat Satellite.
    If using a connected Satellite:
    

    rhn-satellite-activate --rhn-cert [PATH-TO-NEW-CERT] --ignore-version-mismatch
    

    If disconnected, run:
    

    rhn-satellite-activate --rhn-cert [PATH-TO-NEW-CERT] --disconnected --ignore-version-mismatch
    

15. Rebuild search indexes with the following command:
    

    service rhn-search cleanindex
    

16. The upgrade process saves a backup of rhn.conf and other configuration files to /etc/sysconfig/rhn/backup-$DATE-$TIME. Refer to the backup copy of the rhn.conf file and ensure any previous custom values are set in the new Red Hat Satellite’s /etc/rhn/rhn.conf file. For example:
    

    debug = 3
    pam_auth_service = rhn-satellite
    

17. Restart all Red Hat Satellite services:
    

    /usr/sbin/rhn-satellite restart
    

---

Written with StackEdit.

RHEL 7 -- 2 node GFS2

• Scenario
• Using
• Prepare “Resilient Storage” Channel
• Install Software on each Node
• Shared Block Device
• Configure Clustering
  • Initial Steps for all Nodes
  • Steps for One Node Only (any node)
• Cluster Fencing Configuration
• Configure Cluster for GFS2
  • Steps for One Node Only (any node)
  • Steps for All Nodes
  • Steps for One Node Only (any node)
• Mounting GFS2 File System

Scenario

• RHEL Workstation and Hypervisor
• RHEL Workstation VM on private NAT network
• Share an LVM volume between both workstations without using a network file server to slow things down.

Using

• RHEL 7.0 (fully up to date as of 24/01/2015)
• RHEL 7.1 (beta) - Red Hat Global File System 2 (Release notes indicate there have been corrections since the 7.0 release)
• RHEL 7.1 (beta) - High Availability Add-On Administration

Prepare “Resilient Storage” Channel

The “Resilient Storage” channel is only available on the RHEL 7 Server base channel. I’m going to clone the “Resilient Storage” channel on my local Satellite server to the RHEL 7 Workstation base channel so my two workstations have access to the necessary packages. I may not have Red Hat support from this point forward ;-)

Subscribed both RHEL 7 Workstation systems to the cloned rhel-x86_64-server-rs-7 channel.

Install Software on each Node

On each node in the cluster, install the Red Hat High Availability Add-On software packages along with all available fence agents from the High Availability channel:

GFS2

yum install rgmanager lvm2-cluster gfs2-utils

Clustering:

yum install pcs fence-agents-all

Shared Block Device

Create the block device to be shared between both workstations. My case this is the laptop/hypervisor:

# lvcreate -n gfs2_docs -L 50G laptop500

Format the new block device. I am precreating 3 journals as I’m expecting this to be so successful that I will have a third VM using the same share before too long :-D

# mkfs.gfs2 -p lock_dlm -t laptop:docs -j 3 /dev/laptop500/gfs2_docs
/dev/laptop500/gfs2_docs is a symbolic link to /dev/dm-10
This will destroy any data on /dev/dm-10
Are you sure you want to proceed? [y/n]y
Device:                    /dev/laptop500/gfs2_docs
Block size:                4096
Device size:               50.00 GB (13107200 blocks)
Filesystem size:           50.00 GB (13107198 blocks)
Journals:                  3
Resource groups:           200
Locking protocol:          "lock_dlm"
Lock table:                "laptop:docs"
UUID:                      0fb834e7-0f8c-d4b6-f0fb-193b56b8299a

Configure Clustering

Initial Steps for all Nodes

Allow the clustering service to be accessed through the firewall:

# firewall-cmd --permanent --add-service=high-availability
success
# firewall-cmd --add-service=high-availability
success

Set the same password for clustering administration on each node:

# passwd hacluster
Changing password for user hacluster.
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.

Enable the pcsd daemon:

# systemctl start pcsd.service
# systemctl enable pcsd.service
ln -s '/usr/lib/systemd/system/pcsd.service' '/etc/systemd/system/multi-user.target.wants/pcsd.service'

Steps for One Node Only (any node)

Authenticate the hacluster user for each node in the cluster:

# pcs cluster auth reilly.spurrier.net.au rhel7desk.spurrier.net.au
Username: hacluster
Password: 
reilly.spurrier.net.au: Authorized
rhel7desk.spurrier.net.au: Authorized

Create the Cluster:

# pcs cluster setup --start --name laptop reilly.spurrier.net.au rhel7desk.spurrier.net.au
Shutting down pacemaker/corosync services...
Redirecting to /bin/systemctl stop  pacemaker.service
Redirecting to /bin/systemctl stop  corosync.service
Killing any remaining services...
Removing all cluster configuration files...
reilly.spurrier.net.au: Succeeded
reilly.spurrier.net.au: Starting Cluster...
rhel7desk.spurrier.net.au: Succeeded
rhel7desk.spurrier.net.au: Starting Cluster...

Enable Cluster services on all nodes at boot time:

pcs cluster enable --all

Check the Cluster’s status:

# pcs cluster status
Cluster Status:
 Last updated: Fri Feb 13 23:43:11 2015
 Last change: Fri Feb 13 23:40:21 2015 via crmd on reilly.spurrier.net.au
 Stack: corosync
 Current DC: reilly.spurrier.net.au (1) - partition WITHOUT quorum
 Version: 1.1.10-32.el7_0.1-368c726
 2 Nodes configured
 0 Resources configured

PCSD Status:
  reilly.spurrier.net.au: Online
  rhel7desk.spurrier.net.au: Online

Cluster Fencing Configuration

Maybe this is where the whole project comes to an end. Both the GFS2 and the High Availability Add-on - Administration manuals warn that fencing must be enabled. As this is my laptop with a desktop VM forming the cluster I don’t want them fencing each other!

I will ignore Fencing Devices for now and see how bad things get.

Configure Cluster for GFS2

Steps for One Node Only (any node)

Set the global Pacemaker parameter no_quorum_policy to freeze:

# pcs property set no-quorum-policy=freeze

Set up a dlm resource. This is a required dependency for clvmd and GFS2. I have changed the on-fail attribute to restart instead of the recommended value of fence.

# pcs resource create dlm ocf:pacemaker:controld op monitor interval=30s on-fail=restart clone interleave=true ordered=true

Steps for All Nodes

Enable clustered locking:

# /sbin/lvmconf --enable-cluster

Steps for One Node Only (any node)

Set up clvmd as a cluster resource. I have changed the on-fail attribute to restart instead of the recommended value of fence.

# pcs resource create clvmd ocf:heartbeat:clvm op monitor interval=30s on-fail=restart clone interleave=true ordered=true

Set up clvmd and dlm dependency and start up order. clvmd must start after dlm and must run on the same node as dlm:

# pcs constraint order start dlm-clone then clvmd-clone
Adding dlm-clone clvmd-clone (kind: Mandatory) (Options: first-action=start then-action=start)
# pcs constraint colocation add clvmd-clone with dlm-clone

Configure a clusterfs resource. I have changed the on-fail attribute to restart instead of the recommended value of fence.

# pcs resource create clusterfs Filesystem device="/dev/laptop500/gfs2_drew" directory="/home/drew/docs" fstype="gfs2" "options=noatime" op monitor interval=10s on-fail=restart clone interleave=true

Verify that GFS2 is mounted as expected:

mount | grep docs

Set up GFS2 and clvmd dependency and startup order.

# pcs constraint order start clvmd-clone then clusterfs-clone
# pcs constraint colocation add clusterfs-clone with clvmd-clone

---

not required

Mounting GFS2 File System

# mount -t gfs2 -o noatime /dev/laptop500/gfs2_docs /mnt/docs

---

Written with StackEdit.

IPA Cluster with Windows Server 2012 Trust

• Scenario
• Using
• Build Master IPA Server
  • Fix the servers network identity
  • Enable NTP
  • Update software
  • Reboot
  • Install IPA
  • Login and Test IPA Master
• Build Replica IPA Server
  • On the Master IPA Server

Scenario

• IPA cluster consists of 2 RHEL 6.6 servers
• Windows Server 2012 will be used for the Active Directory component
• IPA will manage a sub domain of the Active Directory domain (ipa.demo.net)
• IPA realm is (IPA)
• Active Directory domain is (demo.net)
• Active Directory realm is (WINDOWS)
• No existing DNS service is pre-existing

Using

• RHEL 6.6
• ipa-server 3.0.0

Build Master IPA Server

Fix the servers network identity

• /etc/sysconfig/network
• /etc/sysconfig/network-scripts/ifcfg-eth0
• /etc/resolv.conf (DNS to resolve Red Hat Satellite service)
• /etc/ntp.conf
• /etc/hosts (no existing DNS so add an entry for this host)
  echo '192.168.1.53 ipa1.ipa.demo.net ipa1' >> /etc/hosts

Enable NTP

 [root@ipa1 ~]# chkconfig ntpdate on
 [root@ipa1 ~]# chkconfig ntpd on

Update software

 [root@ipa1 ~]# yum update

Reboot

 [root@ipa1 ~]# init 6

Log back in and make sure it is as you expect it to be:

[root@ipa1 ~]# hostname
[root@ipa1 ~]# ntpq -c lpeers
[root@ipa1 ~]# route -n

Install IPA

[root@ipa1 ~]# yum install ipa-server bind bind-dyndb-ldap
[root@ipa1 ~]# ipa-server-install --hostname=ipa1.ipa.demo.net -n ipa.demo.net -r IPA --setup-dns
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
    This program will set up the IPA Server.

This includes:
  * Configure a stand-alone CA (dogtag) for certificate management
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure DNS (bind)

To accept the default shown in brackets, press the Enter key.

Existing BIND configuration detected, overwrite? [no]: yes
Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.


Server host name [ipa1.ipa.demo.net]: 

Warning: skipping DNS resolution of host ipa1.ipa.demo.net
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password: 
Password (confirm): 

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password: 
Password (confirm): 

Do you want to configure DNS forwarders? [yes]: 
Enter the IP address of DNS forwarder to use, or press Enter to finish.
Enter IP address for a DNS forwarder: 192.168.1.3
DNS forwarder 192.168.1.3 added
Enter IP address for a DNS forwarder: 
Do you want to configure the reverse zone? [yes]: 
Please specify the reverse zone name [1.168.192.in-addr.arpa.]: 
Using reverse zone 1.168.192.in-addr.arpa.

The IPA Master Server will be configured with:
Hostname:      ipa1.ipa.demo.net
IP address:    192.168.1.53
Domain name:   ipa.demo.net
Realm name:    IPA

BIND DNS server will be configured to serve IPA domain with:
Forwarders:    192.168.1.3
Reverse zone:  1.168.192.in-addr.arpa.

Continue to configure the system with these values? [no]: yes

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server for the CA (pkids): Estimated time 30 seconds
  [1/3]: creating directory server user
  [2/3]: creating directory server instance
  [3/3]: restarting directory server
Done configuring directory server for the CA (pkids).
Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds
  [1/21]: creating certificate server user
  [2/21]: creating pki-ca instance
  [3/21]: configuring certificate server instance
  [4/21]: disabling nonces
  [5/21]: creating CA agent PKCS#12 file in /root
  [6/21]: creating RA agent certificate database
  [7/21]: importing CA chain to RA certificate database
  [8/21]: fixing RA database permissions
  [9/21]: setting up signing cert profile
  [10/21]: set up CRL publishing
  [11/21]: set certificate subject base
  [12/21]: enabling Subject Key Identifier
  [13/21]: setting audit signing renewal to 2 years
  [14/21]: configuring certificate server to start on boot
  [15/21]: restarting certificate server
  [16/21]: requesting RA certificate from CA
  [17/21]: issuing RA agent certificate
  [18/21]: adding RA agent as a trusted user
  [19/21]: configure certificate renewals
  [20/21]: configure Server-Cert certificate renewal
  [21/21]: Configure HTTP to proxy connections
Done configuring certificate server (pki-cad).
Configuring directory server (dirsrv): Estimated time 1 minute
  [1/38]: creating directory server user
  [2/38]: creating directory server instance
  [3/38]: adding default schema
  [4/38]: enabling memberof plugin
  [5/38]: enabling winsync plugin
  [6/38]: configuring replication version plugin
  [7/38]: enabling IPA enrollment plugin
  [8/38]: enabling ldapi
  [9/38]: disabling betxn plugins
  [10/38]: configuring uniqueness plugin
  [11/38]: configuring uuid plugin
  [12/38]: configuring modrdn plugin
  [13/38]: enabling entryUSN plugin
  [14/38]: configuring lockout plugin
  [15/38]: creating indices
  [16/38]: enabling referential integrity plugin
  [17/38]: configuring ssl for ds instance
  [18/38]: configuring certmap.conf
  [19/38]: configure autobind for root
  [20/38]: configure new location for managed entries
  [21/38]: restarting directory server
  [22/38]: adding default layout
  [23/38]: adding delegation layout
  [24/38]: adding replication acis
  [25/38]: creating container for managed entries
  [26/38]: configuring user private groups
  [27/38]: configuring netgroups from hostgroups
  [28/38]: creating default Sudo bind user
  [29/38]: creating default Auto Member layout
  [30/38]: adding range check plugin
  [31/38]: creating default HBAC rule allow_all
  [32/38]: Upload CA cert to the directory
  [33/38]: initializing group membership
  [34/38]: adding master entry
  [35/38]: configuring Posix uid/gid generation
  [36/38]: enabling compatibility plugin
  [37/38]: tuning directory server
  [38/38]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds
  [1/10]: adding sasl mappings to the directory
  [2/10]: adding kerberos container to the directory
  [3/10]: configuring KDC
  [4/10]: initialize kerberos container
  [5/10]: adding default ACIs
  [6/10]: creating a keytab for the directory
  [7/10]: creating a keytab for the machine
  [8/10]: adding the password extension to the directory
  [9/10]: starting the KDC
  [10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached 
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring the web interface (httpd): Estimated time 1 minute
  [1/13]: setting mod_nss port to 443
  [2/13]: setting mod_nss password file
  [3/13]: enabling mod_nss renegotiate
  [4/13]: adding URL rewriting rules
  [5/13]: configuring httpd
  [6/13]: setting up ssl
  [7/13]: setting up browser autoconfig
  [8/13]: publish CA cert
  [9/13]: creating a keytab for httpd
  [10/13]: clean up any existing httpd ccache
  [11/13]: configuring SELinux for httpd
  [12/13]: restarting httpd
  [13/13]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Restarting the directory server
Restarting the KDC
Configuring DNS (named)
  [1/9]: adding DNS container
  [2/9]: setting up our zone
  [3/9]: setting up reverse zone
  [4/9]: setting up our own record
  [5/9]: setting up kerberos principal
  [6/9]: setting up named.conf
  [7/9]: restarting named
  [8/9]: configuring named to start on boot
  [9/9]: changing resolv.conf to point to ourselves
Done configuring DNS (named).

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

Restarting the web server
==============================================================================
Setup complete

Next steps:
        1. You must make sure these network ports are open:
                TCP Ports:
                  * 80, 443: HTTP/HTTPS
                  * 389, 636: LDAP/LDAPS
                  * 88, 464: kerberos
                  * 53: bind
                UDP Ports:
                  * 88, 464: kerberos
                  * 53: bind
                  * 123: ntp

        2. You can now obtain a kerberos ticket using the command: 'kinit admin'
           This ticket will allow you to use the IPA tools (e.g., ipa user-add)
           and the web user interface.

Be sure to back up the CA certificate stored in /root/cacert.p12
This file is required to create replicas. The password for this
file is the Directory Manager password

Login and Test IPA Master

Ensure your web browser can resolve the fully-qualified host name of the ipa1 server. Even if this means adding an entry to the hosts file.

Point a web browser to:

https://ipa1.ipa.demo.net
Username:  admin
Password:  <as typed during installation>

Build Replica IPA Server

On the Master IPA Server

Prepare the initialisation file for the Replica:

[root@ipa1 ~]# ipa-replica-prepare ipa2.ipa.demo.net --ip-address 192.168.122.54
Directory Manager (existing master) password: 

Preparing replica for ipa2.ipa.demo.net from ipa1.ipa.demo.net
Creating SSL certificate for the Directory Server
Creating SSL certificate for the dogtag Directory Server
Creating SSL certificate for the Web Server
Exporting RA certificate
Copying additional files
Finalizing configuration
Packaging replica information into /var/lib/ipa/replica-info-ipa2.ipa.demo.net.gpg
Adding DNS records for ipa2.ipa.demo.net
Using reverse zone 122.168.192.in-addr.arpa.

---

Written with StackEdit.