Red Hat Subscription Asset Manager 1.2 Installation Guide. Installing and Using Red Hat Subscription Asset Manager Edition 3

Transcription

1 Red Hat Subscription Asset Manager 1.2 Installation Guide Installing and Using Red Hat Subscription Asset Manager Edition 3 Sarah Chua Lana Brindley

2 Red Hat Subscription Asset Manager 1.2 Installation Guide Installing and Using Red Hat Subscription Asset Manager Edition 3 Sarah Chua Red Hat Engineering Co ntent Services sachua@redhat.co m Lana Brindley Red Hat Engineering Co ntent Services lbrindle@redhat.co m

3 Legal Notice Copyright 2012 Red Hat, Inc. T his document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the United States and other countries. Java is a registered trademark of Oracle and/or its affiliates. XFS is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project. T he OpenStack Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community. All other trademarks are the property of their respective owners. Abstract A guide to installing and using Red Hat Subscription Asset Manager.

4 Table of Contents Table of Contents. Red.... Hat.... Subscription Asset Manager Document Conventions T ypographic Conventions Pull-quote Conventions Notes and Warnings 5 2. Getting Help and Giving Feedback Do You Need Help? We Need Feedback! 6. Chapter Introduction Comparing CloudForms System Engine and Subscription Asset Manager 8. Part..... I.. Installation Chapter Installation Installing from the Repository Installing from ISO 12. Chapter Configuration Chapter Accessing Part..... II... Usage Chapter Organizations Chapter Content Management Chapter Systems Subscriptions Activation Keys 29. Chapter Virtual Environments Chapter Administration General User Tasks Managing Users with LDAP Authentication Upgrading Subscription Asset Manager Backing Up Subscription Asset Manager Restoring Subscription Asset Manager Logging Regenerating and Replacing CA Certificates 48. Revision History

5 2 Red Hat Subscription Asset Manager 1.2 Installation Guide

6 Red Hat Subscription Asset Manager Red Hat Subscription Asset Manager Red Hat Subscription Asset Manager acts as a subscription management application for handling subscription information and software updates on client machines. Each client machine requires Red Hat Subscription Manager (RHSM). RHSM does not require access to the internet, but does need to be able to access the server machine running Subscription Asset Manager. T he server machine then uses Subscription Asset Manager to check for updates and push those updates out to the client machines. Important Consider upgrading to Red Hat CloudForms System Engine if you wish to have access to additional features such as content mirroring, remote installation of packages, and provisioning. 1. Document Conventions T his manual uses several conventions to highlight certain words and phrases and draw attention to specific pieces of information. In PDF and paper editions, this manual uses typefaces drawn from the Liberation Fonts set. T he Liberation Fonts set is also used in HTML editions if the set is installed on your system. If not, alternative but equivalent typefaces are displayed. Note: Red Hat Enterprise Linux 5 and later include the Liberation Fonts set by default Typographic Conventions Four typographic conventions are used to call attention to specific words and phrases. T hese conventions, and the circumstances they apply to, are as follows. Mono-spaced Bold Used to highlight system input, including shell commands, file names and paths. Also used to highlight keys and key combinations. For example: T o see the contents of the file m y_next_bestselling_novel in your current working directory, enter the cat m y_next_bestselling_novel command at the shell prompt and press Enter to execute the command. The above includes a file name, a shell command and a key, all presented in mono-spaced bold and all distinguishable thanks to context. Key combinations can be distinguished from an individual key by the plus sign that connects each part of a key combination. For example: Press Enter to execute the command. Press Ctrl+Alt+F2 to switch to a virtual terminal. T he first example highlights a particular key to press. T he second example highlights a key combination: a set of three keys pressed simultaneously. If source code is discussed, class names, methods, functions, variable names and returned values mentioned within a paragraph will be presented as above, in m ono-spaced bold. For example: 3

7 Red Hat Subscription Asset Manager 1.2 Installation Guide File-related classes include filesystem for file systems, file for files, and dir for directories. Each class has its own associated set of permissions. Proportional Bold T his denotes words or phrases encountered on a system, including application names; dialog box text; labeled buttons; check-box and radio button labels; menu titles and sub-menu titles. For example: Choose System Preferences Mouse from the main menu bar to launch Mouse Preferences. In the Buttons tab, select the Left-handed m ouse check box and click Close to switch the primary mouse button from the left to the right (making the mouse suitable for use in the left hand). T o insert a special character into a gedit file, choose Applications Accessories Character Map from the main menu bar. Next, choose Search Find from the Character Map menu bar, type the name of the character in the Search field and click Next. T he character you sought will be highlighted in the Character T able. Double-click this highlighted character to place it in the T ext to copy field and then click the Copy button. Now switch back to your document and choose Edit Paste from the gedit menu bar. T he above text includes application names; system-wide menu names and items; application-specific menu names; and buttons and text found within a GUI interface, all presented in proportional bold and all distinguishable by context. Mono-spaced Bold Italic or Proportional Bold Italic Whether mono-spaced bold or proportional bold, the addition of italics indicates replaceable or variable text. Italics denotes text you do not input literally or displayed text that changes depending on circumstance. For example: T o connect to a remote machine using ssh, type ssh username@ domain.name at a shell prompt. If the remote machine is example.com and your username on that machine is john, type ssh john@ exam ple.com. T he m ount -o rem ount file-system command remounts the named file system. For example, to remount the /home file system, the command is mount -o remount /home. T o see the version of a currently installed package, use the rpm -q package command. It will return a result as follows: package-version-release. Note the words in bold italics above username, domain.name, file-system, package, version and release. Each word is a placeholder, either for text you enter when issuing a command or for text displayed by the system. Aside from standard usage for presenting the title of a work, italics denotes the first use of a new and important term. For example: Publican is a DocBook publishing system Pull-quote Conventions T erminal output and source code listings are set off visually from the surrounding text. Output sent to a terminal is set in mono-spaced roman and presented thus: 4

8 Red Hat Subscription Asset Manager books Desktop documentation drafts mss photos stuff svn books_tests Desktop1 downloads images notes scripts svgs Source-code listings are also set in m ono-spaced rom an but add syntax highlighting as follows: static int kvm_vm_ioctl_deassign_device(struct kvm * kvm, struct kvm_assigned_pci_dev * assigned_dev) { int r = 0; struct kvm_assigned_dev_kernel * match; mutex_lock(&kvm->lock); match = kvm_find_assigned_dev(&kvm->arch.assigned_dev_head, assigned_dev->assigned_dev_id); if (!match) { printk(kern_info "%s: device hasn't been assigned before, " "so cannot be deassigned\n", func ); r = -EINVAL; goto out; } kvm_deassign_device(kvm, match); kvm_free_assigned_device(kvm, match); out: } mutex_unlock(&kvm->lock); return r; 1.3. Notes and Warnings Finally, we use three visual styles to draw attention to information that might otherwise be overlooked. Note Notes are tips, shortcuts or alternative approaches to the task at hand. Ignoring a note should have no negative consequences, but you might miss out on a trick that makes your life easier. Important Important boxes detail things that are easily missed: configuration changes that only apply to the current session, or services that need restarting before an update will apply. Ignoring a box labeled 'Important' will not cause data loss but may cause irritation and frustration. Warning Warnings should not be ignored. Ignoring warnings will most likely cause data loss. 5

9 Red Hat Subscription Asset Manager 1.2 Installation Guide 2. Getting Help and Giving Feedback 2.1. Do You Need Help? If you experience difficulty with a procedure described in this documentation, visit the Red Hat Customer Portal at T hrough the customer portal, you can: search or browse through a knowledgebase of technical support articles about Red Hat products. submit a support case to Red Hat Global Support Services (GSS). access other product documentation. Red Hat also hosts a large number of electronic mailing lists for discussion of Red Hat software and technology. You can find a list of publicly available mailing lists at Click on the name of any mailing list to subscribe to that list or to access the list archives We Need Feedback! If you find a typographical error in this manual, or if you have thought of a way to make this manual better, we would love to hear from you! Please submit a report in Bugzilla: against the product Subscription Asset Manager. When submitting a bug report, be sure to mention the manual's identifier: doc-installation_guide If you have a suggestion for improving the documentation, try to be as specific as possible when describing it. If you have found an error, please include the section number and some of the surrounding text so we can find it easily. 6

10 Chapter 1. Introduction Chapter 1. Introduction A subscription management application maintains a list of all subscriptions available to an organization and a list of all systems within that organization. More important, a subscription management application maps what subscriptions are attached to what systems. Red Hat subscription certificates also contain other information about product and content streams, and these can be interpreted by a subscription management application. While a subscription management application can be global and hosted (like the Customer Portal), that is not a requirement. Administrators can maintain their own subscription services, with their own local configuration. Subscription Asset Manager is an on-premise subscription management application. It moves the administration of subscriptions and systems away from the Customer Portal and into the local infrastructure. Subscription Asset Manager performs several critical back end management functions: Allocates subscriptions as a subscription management application Works as a real-time proxy for Red Hat's content delivery network Divides subscriptions into separate organizations and content streams into environments for more control over system management Subscription Asset Manager is about on-premise control over subscriptions, rather than using the centralized Customer Portal. Subscription Asset Manager allows administrators to have the most control over how systems are grouped within the subscriptions/content service. T he main company account can be divided into separate and independent organizations. T hese organizations can use different content streams (environments), can have different subscriptions attached to them, and can have different users assigned to them with levels of access set per organization. Subscription Asset Manager also allows administrators to define their own access control policies. Access control is controlled entirely through Subscription Asset Manager. T he on-premise Subscription Asset Manager server, not the remote Red Hat Customer Portal, processes user authentication requests and applies local access control policies. Subscription Asset Manager logs and generates reports about subscription usage which provides critical information to administrators about how software is being installed, used, and maintained on their systems. 7

11 Red Hat Subscription Asset Manager 1.2 Installation Guide Figure 1.1. T he relationship between Subscription Asset Manager and RHSM Subscription Asset Manager provides updates through the content delivery network (CDN) to multiple systems which have Red Hat Subscription Manager (RHSM) installed. RHSM sends update requests to Subscription Asset Manager. Subscription Asset Manager supports centralized corporate policies for subscription management and as such can be used to generate reports on subscription usage. It can also retrieve subscription information on specific systems and exercise fine-grained control over the Red Hat Enterprise Linux minor releases and errata advisories on each individual server. Customers using Subscription Asset Manager would benefit from the speed and security of having everything on site such as those with larger deployments or those working in low-bandwidth or network-impaired environments. Subscription Asset Manager is included with a Red Hat subscription. While it can only be installed on systems using Red Hat Enterprise Linux 6.2 and later, Subscription Asset Manager can manage systems using Red Hat Enterprise Linux 5.7 and later, and Red Hat Enterprise Linux 6.1 and later Comparing CloudForms System Engine and Subscription Asset Manager Subscription Asset Manager and CloudForms System Engine are both subscription services that give administrators on-premise control over subscriptions, through proxy requests to the CDN. Both Subscription Asset Manager and CloudForms System Engine provide the ability to manage subscriptions, but CloudForms System Engine adds content and system management features. CloudForms System Engine provides additional features both for content management and systems management: 8

12 Chapter 1. Introduction Apply synchronization plans Promote content using changesets Create package filters Create component outlines For additional management control, contact Red Hat Support to upgrade your Subscription Asset Manager to CloudForms System Engine. 9

13 Red Hat Subscription Asset Manager 1.2 Installation Guide Part I. Installation T his part describes the hardware and software prerequisites for Subscription Asset Manager. In order to install and use Subscription Asset Manager, you need to perform the following steps: Installation Configuration Set up Organizations and Environments Get subscriptions from the customer portal Upload packages to managed systems T hese steps are explained further in this guide. 10

14 Chapter 2. Installation Chapter 2. Installation Installation of Subscription Asset Manager can be done on a physical or virtual networked host. Subscription Asset Manager is included with a Red Hat Enterprise Linux subscription. You need to be registered to Red Hat Subscription Management to install Subscription Asset Manager. You can use Subscription Asset Manager to manage subscriptions on both physical systems and virtual machines. Important T erms Networked Host A networked host is a computer connected to a computer network. A networked host may offer information resources, services, and applications to users or other nodes on the network. Virtual Machine A complete operating system running on a physical host, separated from the host's operating system. Virtual machines are managed by a hypervisor. Hypervisor A program that allows multiple operating systems to share a single hardware host. Installation Prerequisites T o install Subscription Asset Manager, you will require: A networked host with the following minimum specifications: 64-bit architecture Red Hat Enterprise Linux 6.2 or later A minimum memory of 1.5 GB and swap enabled with at least 1 GB Ports 443 and 8088 for HTTPS (secure HTTP) must be open for incoming connections. Register the system to Red Hat Subscription Management Installing from the Repository T he following procedure installs Subscription Asset Manager on a host, using files downloaded from the repository. Procedure 2.1. Installing from the Repository 1. Check that you have the [rhel-6-server-sam-rpm s] repository enabled. Run the following command: # yum-config-manager --enable rhel-6-server-sam-rpms 2. Install the katello-headpin-all package using yum install as the root user: # yum install -y katello-headpin-all 11

15 Red Hat Subscription Asset Manager 1.2 Installation Guide Important Before Subscription Asset Manager can be used, it needs to be configured. For more information about configuring Subscription Asset Manager, see the Configuration chapter Installing from ISO T he following procedure installs Subscription Asset Manager on a host, using files downloaded from ISO. Procedure 2.2. Installing from ISO 1. Mount the ISO to [MOUNT_DIR]. 2. Change directory to [MOUNT_DIR]. 3. Execute the install_packages script which is located there. Important Before Subscription Asset Manager can be used, it needs to be configured. For more information about configuring Subscription Asset Manager, see the Configuration chapter. 12

16 Chapter 3. Configuration Chapter 3. Configuration Subscription Asset Manager is configured automatically using the katello-configure script. Procedure 3.1. Running the Configuration Script 1. As root, run the configuration script: # katello-configure --deployment=sam 2. When the configuration script has completed successfully, it displays: Starting Katello configuration The top-level log file is [/var/log/katello/katello-configure /main.log] Creating Katello database user ############################################################... OK Creating Katello database ############################################################... OK Creating Candlepin database user ############################################################... OK Creating Candlepin database ############################################################... OK Candlepin setup ############################################################... OK Populating Katello database schema ############################################################... OK # 3. T he katello-configure command supports the ability to override various default settings, including the administrator username, password, and organization name. T o create your initial administrator username, password, and organization name, use the format: # katello-configure --deployment=sam --user-name=username --userpass=password --org-name=organization_name For example: # katello-configure --deployment=sam --user-name=adminuser --userpass=password --org-name=example_org Procedure 3.2. Configuration Using an Answer File For automated installation with customized options, an answer file can be created and used with the katello-configure command. 1. Copy the answer file located at /usr/share/katello/install/default-answer-file to a location on your local file system: # cp /usr/share/katello/install/default-answer-file /root/my-answer-file 2. Open the local copy of the answer file in your preferred text editor and edit the values to suit your environment: 13

17 Red Hat Subscription Asset Manager 1.2 Installation Guide # Path of the answer file. answer_file = # Katello database name. # PostgreSQL database name used to store the Katello database # objects. db_name = katelloschema # Katello database user. db_user = katellouser # Katello database password. db_password = katellopw Do not forget to save your answer file once you have finished editing it. 3. Pass the answer file to the katello-configure command: # katello-configure --deployment=sam --answer-file=/root/my-answer-file Starting Katello configuration The top-level log file is [/var/log/katello/katello-configure /main.log] Creating Katello database user ############################################################... OK Creating Katello database ############################################################... OK Creating Candlepin database user ############################################################... OK Creating Candlepin database ############################################################... OK Candlepin setup ############################################################... OK Populating Katello database schema ############################################################... OK If the configuration script encounters an error, it will display details of the error, for example: Starting Katello configuration The top-level log file is [/var/log/katello/katello-configure /main.log] err: /Stage[main]/Postgres::Service/Service[postgresql]/ensure: change from stopped to running failed: Could not start Service[postgresql]: Execution of '/sbin/service postgresql start' returned 1: at /usr/share/katello/install/puppet/modules/postgres/manifests/service.pp:6 Different error conditions can also show up with the name of the log file containing the error, for example: Failed, please check processing_logfile Logs can be found in: /var/log/katello /var/log/thum bslug /var/log/candlepin /var/log/tom cat6 14

18 Chapter 3. Configuration Additional Configuration Options Additional options can be passed to the katello-configure command, to change the configuration. View a complete list of options using the command: # katello-configure --help 15

19 Red Hat Subscription Asset Manager 1.2 Installation Guide T able 3.1. Configuration Options Parameter answer-file=answer_file user-name=user_name user-pass=user_pass user- =user_ org-name=org_name proxy-url=proxy_url Description Path to an answer file to be used for configuration The administrative username (default value: admin) T he administrative user's password (default value: admin) Katello user's (default value: root@localhost) Initial organization (default value: ACME_Corporation) HTTP proxy URL (for example: proxy-port=proxy_port HT T P Proxy port (default value: 3128) proxy-user=proxy_user proxy-pass=proxy_pass db-nam e=db_name db-user=db_user db-password=db_password deploym ent=deployment auth-m ethod=auth_method ldap-server=ldap_server ldap-encryption=ldap_encryption ldap-basedn=ldap_basedn ldap-groups-basedn=ldap_groups_basedn ldap-roles=ldap_roles HT T P proxy username, if authentication is required HT T P proxy password, if authentication is required Katello database name Katello database username Katello database password T he deployment type to use Authentication method (database, ldap) LDAP server hostname Encryption method used in communication with LDAP server Base DN for user accounts Base DN for user groups Use LDAP for roles membership definition (default value: false) ldap_port=ldap_port Port for ldap server (default value: 389) ldap_server_type=ldap_server_type ldap_anon_queries=ldap_anon_queries ldap_service_user=ldap_service_user ldap_service_pass=ldap_service_pass ldap_ad_dom ain=ldap_ad_domain non-interactive=non_interactive skip-ssl-cageneration=skip_ssl_ca_generation ssl-ca-password=ssl_ca_password 16 Type of ldap server to query (default value: posix, available options: free_ipa and active_directory) Allow anonymous queries for AD or FreeIPA mode (default value: false) Service username for non-anonymous queries in FreeIPA and AD mode Service password for non-anonymous queries in FreeIPA and AD mode Domain for AD LDAP Queries Non-interactive installer mode skip SSL CA generation SSL CA password

20 Chapter 3. Configuration ssl-ca-country=ssl_ca_country ssl-ca-state=ssl_ca_state ssl-ca-city=ssl_ca_city ssl-ca-org=ssl_ca_org ssl-ca-org-unit=ssl_ca_org_unit ssl-ca-cn=ssl_ca_cn ssl-ca-em ail=ssl_ca_ ssl-certexpiration=ssl_cert_expiration ssl-ca-passwordfile=ssl_ca_password_file keystore-passwordfile=keystore_password_file nss-db-passwordfile=nss_db_password_file only-show-config help, h SSL CA country SSL CA state SSL CA city SSL CA organization SSL CA organization unit SSL CA common name SSL CA address SSL certificate expiration (in days) SSL CA password file path Keystore password file path NSS DB password file path Print details of the configuration and exit without making any changes Show this short summary Note Subscription Asset Manager can also be used with multiple network interfaces and hostnames. For instructions on setting this up, see 17

21 Red Hat Subscription Asset Manager 1.2 Installation Guide Chapter 4. Accessing With Subscription Asset Manager, you can administer subscriptions on-premise. Once subscriptions are assigned to Subscription Asset Manager, the complete list of subscriptions and products, including product certificates and entitlement certificates, are listed in a manifest. T he manifest is a master list of everything that Subscription Asset Manager requires to handle on-premise subscription services. Important T erms Certificate Certificates grant the right for a client machine to download, update, and receive support for a product. Entitlement The attachment of a subscription by a client machine. For example, a machine can receive an entitlement for Red Hat Enterprise Linux Server. Also known as a software license that grants the right to download, update, and receive support for a product. Manifest A list of subscriptions and products that Subscription Asset Manager is able to manage. Subscription Access to a product and support for a certain length of time. There can be multiple products in a single subscription. Subscription Asset Manager is accessed using a web interface. In order to use the web interface, you will require a username and password. You can create your username and password during the initial configuration. Important By default, the initial username and password are both set to admin. If you have used the default values during the configuration process, change them immediately after logging in for the first time. Procedure 4.1. First login 1. Subscription Asset Manager is accessed using a web browser at the address To identify your hostname, use the hostname command at the prompt: $ hostname To identify your IP address, use the ip add show command at the prompt and locate the inet address for your primary connection: $ ip add show 18

22 Chapter 4. Accessing 2. Use your preferred internet browser to navigate to You do not need to be able to reach the internet to use the interface, but you will need network access to the machine hosting the Subscription Asset Manager installation. Important An untrusted connection warning appears on your web browser when accessing Subscription Asset Manager for the first time. Accept the self-signed certificate and add the Subscription Asset Manager URL as a security exception to override the settings. T his procedure might differ depending on the browser being used. Only do this if you are sure that the Subscription Asset Manager URL is a trusted source. Figure 4.1. Untrusted Connection Warning 3. Enter the username and password that you created during the configuration process. Note If you forget your username or password, click on Forgot Username or Password and an with instructions on resetting your password with be sent to you. T he Subscription Asset Manager dashboard shows a status overview of the subscriptions and systems currently registered, and a list of the latest notifications. Dashboard The dashboard is the first screen seen after logging in to Subscription Asset Manager. It provides a status overview of the subscriptions and systems currently registered, and a list of the latest notifications. 19

23 Red Hat Subscription Asset Manager 1.2 Installation Guide Figure 4.2. T he Subscription Asset Manager Dashboard Dashboard Components System Subscription Status T he System Subscription Status section gives an overview of the status of the subscriptions currently being managed by Subscription Asset Manager. T he three possible states are: T able 4.1. System Subscription States State Description Icon Invalid Subscriptions Insufficient Entitlem ents Current Subscriptions T hese systems have one or more installed products that are not listed in the manifest, even if valid subscriptions exist. A system will also have an Invalid Subscription status if all its available subscriptions are being used by other systems. These systems need attention immediately. T hese systems have a subscription that covers the installed products but not all the available sockets. For example, if the system has four available sockets, but the subscription is for only two sockets, the system would be given an Insufficient Entitlements label. T his will also occur if the number of sockets is greater than the number of machines. T hese systems should be monitored to ensure they are configured as expected. T hese systems have been registered and their products are subscribed with all sockets covered. A system that is registered with no installed products will also have a Current Subscriptions status. Latest Notifications 20

24 Chapter 4. Accessing All messages produced by the system are listed in the Latest Notifications section. T his includes administration information, product and subscription changes, and any errors. This section should be monitored for global notifications sent to all users as well as to pick up any unusual activity or errors. 21

25 Red Hat Subscription Asset Manager 1.2 Installation Guide Part II. Usage T his part describes general usage and configuration information for Subscription Asset Manager. It will guide you through using Subscription Asset Manager and Red Hat Subscription Management to update and maintain client systems. 22

26 Chapter 5. Organizations Chapter 5. Organizations Your main account can be divided into separate and independent organizations. Organizations are used to group systems, clouds, and products. T hey are logical groups based on ownership, purpose, content, security level, or other attributes. Multiple organizations can be viewed, created, and managed within the web interface. Software and system subscriptions can be attached across many organizations, and access to those organizations controlled. Each organization must be created and used by a single Red Hat Network (RHN) account, however each RHN account can manage multiple organizations. Organizations can have different subscriptions attached to them, and can have different users assigned to them with different levels of access for each organization. Access control in this scenario is done entirely locally. T he on-premise subscription management application, not the remote Red Hat Customer Portal, processes user authentication requests and applies local access control policies. A subscription management application such as Subscription Asset Manager is registered with Red Hat Subscription Management and attached with a large block of subscriptions in the form of a manifest. T his allows the subscription management application to manage system inventory, subscription services, and content delivery on-premise across multiple organizations. T his has performance benefits by lowering bandwidth, and it offers significant management benefits to administrators by allowing onpremise and flexible control over subscription. Organizations can then be subdivided into application life cycle management environments (environments). An environment is a logical grouping for content and configuration of systems. Since a system can belong to multiple environments, it is possible to organize systems into overlapping circles according to the real-world infrastructure. By default, Subscription Asset Manager will have one organization already created after registration, called ACME_Corporation, which can be modified to suit your own installation, or deleted. Important T erms Application Life Cycle Management Environment (Environment) A logical environment for content and configuration of systems. Environments are managed by content providers, using subscription management applications. Environments model steps in a life cycle, where content and configuration can be promoted from one environment to the next. Other environments can be created to suit the deployment. Organization Organizations are used to group systems, clouds and products. T hey are logical groups based on ownership, purpose, content, security level, or other attributes. Procedure 5.1. Creating a New Organization 1. Move cursor over the Administer menu at the top right corner and click on Manage Organizations. 2. Click the + New Organization link. 3. Enter the name of the new organization in the Name field. 4. Enter a description of the new organization in the Description field. 23

27 Red Hat Subscription Asset Manager 1.2 Installation Guide 5. Enter the name of the initial application life cycle management environment in the Nam e field. 6. Enter a description of the initial application life cycle management environment in the Description field. 7. Click the Save button to save your new organization and its default environment. Procedure 5.2. Removing an Organization 1. Move cursor over the Administer menu at the top right corner and click on Manage Organizations. 2. Select the organization you want to remove. 3. Click on the Rem ove Organization link. An alert box appears: Are you sure you want to remove this organization? 4. Click the Yes button. Note In Subscription Asset Manager, an organization can be used to organize systems and the subscriptions which should be attached to those systems. If you remove an organization, all systems within that organization will be un-registered. T he subscriptions can then be applied to other organizations, and attached to other systems. Procedure 5.3. Add New Environment 1. Move cursor over the Administer menu at the top right corner and click on Manage Organizations. 2. Click on the name of the required organization from the left panel. 3. Click the Add New Environm ent button. 4. Type in a name in the Name field. 5. T ype in a description in the Description field. 6. Select the Prior Environm ent from the drop-down menu. 7. Click the Create button to save your changes. Procedure 5.4. Remove Environment 1. Move cursor over the Administer menu at the top right corner and click on Manage Organizations. 2. Click on the name of the required organization. 3. Select the environment you wish to remove from the environment promotion paths. 4. Click the Rem ove Environm ent button. An alert box appears: Are you sure? 5. Click the Yes button. 24

28 Chapter 5. Organizations Note Only the last environment can be deleted. If three environments exist in the following order: Library, Dev and Prod, you can delete only the Prod environment. Procedure 5.5. Create a New Organization Debug Certificate 1. Move cursor over the Administer menu at the top right corner and click on Manage Organizations. 2. Select an existing organization from the list of the left. Organization information and functions display on the right. 3. Click Debug Certificate to unhide debug certificate options. 4. Click the Download button. T his generates a debug certificate. Save the certificate in a secure location. Note Debug Certificates are automatically generated for system template downloads if they do not already exist in the organization for which they are being downloaded. 25

29 Red Hat Subscription Asset Manager 1.2 Installation Guide Chapter 6. Content Management Every registered system has a certain number of software entitlements. T hese entitlements are listed in a manifest. Manifests are used by Subscription Asset Manager to manage your systems on site, without having to log directly in to your Red Hat Network account. Important T erms Entitlement The attachment of a subscription by a client machine. For example, a machine can receive an entitlement for Red Hat Enterprise Linux Server. Also known as a software license that grants the right to download, update, and receive support for a product. Manifest A list of subscriptions and products that Subscription Asset Manager can manage. Important After a subscription manifest has been uploaded to Subscription Asset Manager, it can no longer be accessed through Red Hat Network (RHN). You can obtain a manifest for your system by logging in to the Red Hat Customer Portal and downloading the appropriate manifest, or by contacting Red Hat Support. See the Managing Distributors chapter of Red Hat Subscription Management for more information. Procedure 6.1. Upload a Subscription Manifest 1. Click the Content application tab. 2. Click the +Import Manifest link. 3. Click the Browse button to specify the location of the manifest. 4. Click the Upload button to upload subscription manifest. Procedure 6.2. Remove a Subscription Manifest 1. Click the Content application tab. 2. Click the +Import Manifest link. 3. Click the Rem ove Subscriptions button to remove a previously uploaded manifest. 26

30 Chapter 7. Systems Chapter 7. Systems Systems use subscriptions to define the software packages they are able to install. Systems must have a current subscription in order to be able to download updates. Subscription Asset Manager attaches subscriptions to local systems based on organization and environment. Whenever a subscription is purchased by an organization, that subscription can be attached to the system. This means that a portion of the subscription is attached to that system. When the system contacts the content delivery network and downloads the software, the licenses have been already assigned to the system and the system has valid certificates for its subscriptions. Before Subscription Asset Manager can manage a system, the system needs to be registered using RHSM. Activation keys can be created and used to define a set of parameters for new systems during registration. Important T erms Activation Key A registration macro used to identify a set of parameters for new systems. Once created, an activation key can be used to define the default environment and subscriptions to be used during registration. Registration Adding a system to the software inventory, so that it can be managed by a subscription management application, such as Subscription Asset Manager. Subscription Access to a product and support for a certain length of time. There can be multiple products in a single subscription. System Any physical or virtual machine managed by a subscription management application, such as Subscription Asset Manager. Procedure 7.1. Register a System 1. Obtain a copy of the CA certificate for the Subscription Asset Manager server and install it in the RHSM certificate directory. # rpm -ivh 2. Launch RHSM by using the following command: # subscription-manager-gui 3. Click the Register button to register your system. 4. Enter your Subscription Asset Manager username and password. Once you have entered your account details, click the Register button. 5. RHSM scans the network for available organizations. When the configured organizations are 27

31 Red Hat Subscription Asset Manager 1.2 Installation Guide detected, RHSM prompts for the organization for the system to join. It is only possible to register with one organization. If the selected organization has multiple environments available, then RHSM will detect them and provide a list. It is possible to join multiple environments. Use the Ctrl key to select multiple environments from the list. If no environment is selected, then RHSM uses the default environment for the organization. Important It is only possible to join an environment during registration. Environments cannot be changed after registration. Note You can also register your system using the command line interface and the # subscriptionmanager register --user [user] --password [password] --org [org] --env [env] --auto command. You will need to provide credentials to RHSM and set your user preferences for the default organization and environment. If you do not provide credentials, the default settings in Subscription Asset Manager will be applied Subscriptions Register your system using RHSM, and then manage system subscriptions using Subscription Asset Manager. Note It takes up to 4 hours for the subscription status on the RHSM client system to be updated. If the subscription status needs to be updated immediately, run the subscription-manager refresh command from the command line interface. Procedure 7.2. Assign Subscription 1. Click the Systems application tab. 2. Select the system that you wish to assign subscriptions to. 3. Move your cursor over the Details application subtab and click System Info. 4. Select the Release Version you wish to subscribe your system to and save your preference. 5. Click the Subscriptions application subtab. 6. Under the System Current Subscriptions list, select the preferred Auto-Subscribe and Service Level option to ensure that the system prefers the appropriate type of subscription when auto-subscribing. 7. Under the Available Subscriptions list, select the subscription you wish to assign to the system. 8. Click the Subscribe button to assign subscription. 28

32 Chapter 7. Systems Note By default, systems are subscribed to the latest release version. For example, when Red Hat releases Red Hat Enterprise Linux 6.3, your system will have access to the latest Red Hat Enterprise Linux 6.3 content. Step 4 allows you to select a specific release version (for example Red Hat Enterprise Linux 6.1) if you do not wish to upgrade. This can be a security issue since you would not get updates, but it may be appropriate for your system needs. Procedure 7.3. Remove Subscription 1. Click the Systems application tab. 2. Select the system that you wish to remove subscriptions from. 3. Click the Subscriptions application subtab. 4. Under the System Current Subscriptions list, select the subscription you wish to remove from the system. 5. Click the Unsubscribe button to remove subscription Activation Keys Another way of managing systems is the use of activation keys which allows you to define the default environment and subscriptions to be used during system registration. Procedure 7.4. Create a New Activation Key 1. Move cursor over Content Subscriptions and click Activation Keys. 2. Click the + New Key button. 3. Type in a name for the new activation key in the Name field. 4. T ype in a description in the Description field. 5. Select the Environm ent. 6. Click the Save button to create your new activation key. Procedure 7.5. Add Subscriptions to Activation Key 1. Move cursor over Content Subscriptions and click Activation Keys. 2. Select the activation key you wish to add subscriptions to. 3. Click on the Available Subscriptions application subtab. A list of available subscriptions is displayed. 4. Select the subscriptions you wish to add. 5. Click the Add to Key button to add subscriptions to the activation key. Procedure 7.6. Remove Subscriptions from Activation Key 1. Move cursor over Content Subscriptions and click Activation Keys. 2. Select the activation key you wish to remove subscriptions from. 3. Click the Applied Subscriptions application subtab. 4. A list of subscriptions is displayed. Select the subscriptions you wish to remove. 5. Click the Rem ove button to remove subscriptions from the activation key. 29

33 30 Red Hat Subscription Asset Manager 1.2 Installation Guide

34 Chapter 8. Virtual Environments Chapter 8. Virtual Environments When a system is registered to RHSM, RHSM will identify if the system is a physical networked host or a virtual machine. RHSM can detect guests for several different virtualization services, including: KVM Xen HyperV VMWare ESX RHSM records a unique identifier called a guest ID as one of the system facts for a virtual machine. A special process, virt-who, checks virtual processes and then relays that information to RHSM and any configured subscription management application, such as Subscription Asset Manager. Each virtual machine on a host is assigned a guest ID, which is associated with the host and used to generate the identity certificate for the virtual machine when it is registered. Some Red Hat Enterprise Linux variants are specifically planned for virtual machines. T he corresponding subscriptions are divided into a certain quantity of physical networked hosts and virtual machines. Red Hat Enterprise Linux add-ons may even be inherited, so that when a subscription is attached to a host machine, all of its virtual machines are automatically included in that subscription. Red Hat layered products usually do not draw any distinction between virtual and physical systems; the same type of subscription is used for both. If the system is a virtual machine, then virtual subscriptions are listed with the available subscriptions. If no more virtual subscriptions are available, then the subscription service will apply physical subscriptions. Figure 8.1. Using Subscription Asset Manager in a Virtual Environment Procedure 8.1. Using Subscription Asset Manager in a Virtual Environment 31

35 Red Hat Subscription Asset Manager 1.2 Installation Guide Important If you are using VMware ESX for virtualization management, you will need to follow the steps in Procedure 8.2, Using Subscription Asset Manager in a VMware ESX Environment in order to use Subscription Asset Manager in a virtualized environment. 1. If you have not previously installed virt-who, you will need to run yum install virt-who. 2. T o install Subscription Asset Manager in a virtual environment, register all physical hosts using RHSM. See Procedure 7.1, Register a System for instructions on registering a system using RHSM. 3. After registering all physical hosts, you need to attach a subscription to all physical hosts using RHSM. Launch RHSM and select the All Available Subscriptions tab. 4. Expand More Search options and use the following check boxes to filter the results: m atch m y system shows only subscriptions which match the system architecture. m atch m y installed products shows subscriptions which work with currently installed products on the system. have no overlap with existing subscriptions excludes subscriptions with duplicate products. If a subscription is already attached to a system for a specific product or if multiple subscriptions supply the same product, then the subscription service filters those subscriptions and shows only the best fit. Click Update. 5. Select one of the available subscriptions. 6. Click the Subscribe button. 7. Start virt-who on all physical hosts with the service virt-who start command: # service virt-who start If the operation is successful, messages similar to these will be added to the /var/log/rhsm/rhsm.log log file: :37:36,571 - Virt-who is running in libvirt mode :37:36,571 - Starting infinite loop with 3600 seconds interval and event handling :37:36,991 virt.py:51 - Virtual machine found: rhel6- pv-migration: 1c8f267e-e7d7-371c-0bec-0d7b5480af :37:37,007 virt.py:57 - Virtual machine found: rhel6- fv: 3dc76b6d-49bf-61c8-b504-92fe0de1f :37:37,011 virt.py:57 - Virtual machine found: rhel6- pv: 0301def5-927e-7bc1-fc59-91e9d42c8f :37:37,011 - Sending update to updateconsumer: ['0301def5-927e-7bc1-fc59-91e9d42c8f16', '1c8f267e-e7d7-371c-0bec-0d7b5480af25', '3dc76b6d-49bf-61c8-b504-92fe0de1f073'] 8. Create a virtual machine and register it using RHSM. See Procedure 7.1, Register a System for instructions on registering a system using RHSM. 9. Attach a subscription to your virtual machine by using RHSM following steps 2 to 5 described above. Procedure 8.2. Using Subscription Asset Manager in a VMware ESX Environment 32