# Satellite

- Servidores:

- xx.xx.xx.222 Poc Satellite hsat01 rhel 8 Satellite
- xx.xx.xx.223 Poc Satellite hsat02 rhel 8 Capsule
- xx.xx.xx.232 Poc Satellite hsat03 rhel 7 client
- xx.xx.xx.199 Poc Satellite hsat06 centos 7 Client
- xx.xx.xx.203 Poc Satellite hsat07 rhel 7 Client
- xx.xx.xx.121 Poc Satellite hsat08 centos 7 Client

Gestão de conteudo no satellite

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.10/html/content_management_guide/index

### Satellite Server

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/installing_satellite_server_in_a_connected_network_environment/installing_server_connected_satellite#registering-to-red-hat-subscription-management_satellite

subscription-manager list --all --available --matches 'Red Hat Satellite'

subscription-manager attach --pool=2c94327f82fed3340183380b73900f37

subscription-manager repos --disable "*"

subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms --enable=satellite-6.11-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.11-for-rhel-8-x86_64-rpms

dnf module enable satellite:el8

dnf update

dnf install satellite

satellite-installer --scenario satellite --foreman-initial-organization "My_Organization" --foreman-initial-location "My_Location" --foreman-initial-admin-username admin_user_name --foreman-initial-admin-password admin_password

scp ~/manifest_file.zip [e-mail]:~/.

hammer subscription upload --file ~/manifest_file.zip --organization "My_Organization"

Setup Remote Execution using non-root https://access.redhat.com/solutions/2650071

hammer settings set --name remote_execution_ssh_user --value rexuser
hammer settings set --name remote_execution_effective_user --value root

Alocar subscrições https://access.redhat.com/management/subscription_allocations

#### SSH server satellite
cat /etc/ssh/ssh_config.d/01-client.conf
ServerAliveCountMax 300
ServerAliveInterval 30

### Para analise pré upgrade RHEL7 para RHEL8

satellite-installer --enable-foreman-plugin-leapp

#### Registrar VM no Satellite

rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

- 19 Setembro 2022
- Configurar o Satellite 6.11
- Criar chave de ativação

- Registrar Client RHEL 7.x
Registrar VM

rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

- Registrar Cliente RHEL 8.x
- Converter CentOS 7.9

Variáveis do Convert2rhel

LAB= #org
SPO= #location

hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_rhel_wait_for_syncs --variable-type boolean --default-value false --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_organization --variable-type string --default-value "LAB" --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_password --variable-type string --default-value " SENHA " --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_username --variable-type string --default-value "admin" --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_server_url --variable-type string --default-value "https://satellite.example.com" --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_validate_certs --variable-type boolean --default-value true --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_content_rhel_enable_rhel7 --variable-type boolean --default-value true --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_content_rhel_enable_rhel8 --variable-type boolean --default-value true --override true
hammer ansible variables create --location "$SPO" --organization "$LAB" --ansible-role redhat.satellite.convert2rhel --variable satellite_manifest_path --variable-type string --default-value "/usr/share/satellite/manifest_satellite611_20220916T163540Z.zip" --override true

## Capsule Server

Atividades no Lado do Satellite

Interface Web

Importar Repositório no Satellite

satellite-capsule-6.11-for-rhel-8-x86_64-rpms
satellite-maintenance-6.11-for-rhel-8-x86_64-rpms

Instalação Capsule Server

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/installing_capsule_server/preparing-environment-for-capsule-installation

Liberar Firewall - No Satellite Server

Liberar Firewall para o Capsule Conectar

firewall-cmd --add-port="5646/tcp"
firewall-cmd --runtime-to-permanent
No Capsule Sever - Liberar Firewall

firewall-cmd \
--add-port="53/udp" --add-port="53/tcp" \
--add-port="67/udp" \
--add-port="69/udp" \
--add-port="80/tcp" --add-port="443/tcp" \
--add-port="5647/tcp" \
--add-port="8140/tcp" \
--add-port="8443/tcp" \
--add-port="8000/tcp" --add-port="9090/tcp"
firewall-cmd --runtime-to-permanent
firewall-cmd --list-all

Registrar a VM do Capsule

1- Registra VM

subscription-manager repos --disable "*"
subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms --enable=rhel-8-for-x86_64-appstream-rpms --enable=satellite-capsule-6.11-for-rhel-8-x86_64-rpms --enable=satellite-maintenance-6.11-for-rhel-8-x86_64-rpms
dnf module enable satellite-capsule:el8

Atualizar a VM
yum update
dnf install satellite-capsule

Atividades do Lado do Satellite - SSH

mkdir /root/capsule_cert
capsule-certs-generate --foreman-proxy-fqdn capsule.example.com --certs-tar /root/capsule_cert/capsule_certs.tar

Copiar a linha de comando gerada aqui.

1. Ensure that the satellite-capsule package is installed on the system.
2. Copy the following file /root/capsule_cert/capsule_certs.tar to the system hsat02.domain.com.br at the following location /root/capsule_certs.tar
scp /root/capsule_cert/capsule_certs.tar [e-mail]:/root/capsule_certs.tar
3. Run the following commands on the Capsule (possibly with the customized
parameters, see satellite-installer --scenario capsule --help and
documentation for more info on setting up additional services):

satellite-installer \
--scenario capsule \
--certs-tar-file "/root/capsule_certs.tar"\
--foreman-proxy-register-in-foreman "true"\
--foreman-proxy-foreman-base-url "https://hsat01.domain.com.br"\
--foreman-proxy-trusted-hosts "hsat01.domain.com.br"\
--foreman-proxy-trusted-hosts "hsat02.domain.com.br"\
--foreman-proxy-oauth-consumer-key "P4vMHf5BmfazEXJE5UYnjXPJ2zZiowGm"\
--foreman-proxy-oauth-consumer-secret "Xpp33vXS4GxPDuSe8G6BEKbRhxyezYAu"

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/configuring_red_hat_satellite_to_use_ansible/getting-started-with-ansible_ansible

satellite-installer --scenario capsule --enable-foreman-proxy-plugin-ansible

Copiar arquivo com certificados para o Capsule

scp /root/capsule_cert/capsule.example.com-certs.tar \
[e-mail]:/root/capsule.example.com-certs.tar

Criar chave de ativação amarrada ao contentview

## Compliance Scap

Valida se a feature do openscap está habilitada no satellite

hammer capsule info --name satellite.sample.com.br

Valida se o pacote do opensacap esta instalado
yum info scap-security-guide

Fazer upload das polices default
hammer scap-content bulk-upload --type default

Importar ansible roles no webUI
Configure>Roles

/usr/bin/foreman_scap_client ds 1 2>&1 | logger -t foreman_scap_client