Skip to content

antony@notes:~/suse$ cat "全離線安裝-SUSE-Manager-Server-4.3.md"

全離線安裝 SUSE Manager Server 4.3

2025-04-08· suse ·SUSE Manager

全離線安裝 SUSE Manager Server 4.3

Preface

本篇文章會在全離線的環境下建置 SUSE Manager Server

可以透過點擊以下目錄，選擇想看的內容，跳轉至特定章節

:::warning

:::spoiler {state=“open”} 目錄

[TOC]

:::

1. 架構說明

image

  • SUSE Manager Server 會透過 Http Proxy Server 上網到 scc.suse.com 或 updates.suse.com 下載 Packages

2. 安裝與設定 Http Proxy Server

2.1. 安裝 Http Proxy Server

$ sudo zypper -n install squid

此套件放在 sle-module-server-applications Packages Repository

2.2. 啟動 Squid 服務，並設為開機自動啟動

$ sudo systemctl enable --now squid

2.3. 檢查 Squid 運作是否正常

$ sudo systemctl status squid.service

螢幕輸出 :

● squid.service - Squid caching proxy
     Loaded: loaded (/usr/lib/systemd/system/squid.service; enabled; vendor preset: disabled)
     Active: active (running) since Tue 2024-01-09 16:43:05 CST; 53s ago
       Docs: man:squid(8)
    Process: 5502 ExecStartPre=/usr/lib/squid/initialize_cache_if_needed.sh (code=exited, status=0/SUCCESS)
    Process: 5506 ExecStart=/usr/sbin/squid -FC (code=exited, status=0/SUCCESS)
   Main PID: 5507 (squid)
      Tasks: 4
     CGroup: /system.slice/squid.service
             ├─ 5507 /usr/sbin/squid -FC
             ├─ 5509 "(squid-1)" --kid squid-1 -FC
             ├─ 5510 "(logfile-daemon)" /var/log/squid/access.log
             └─ 5511 "(pinger)"

Jan 09 16:43:05 http-proxy systemd[1]: Starting Squid caching proxy...
Jan 09 16:43:05 http-proxy squid[5507]: Squid Parent: will start 1 kids
Jan 09 16:43:05 http-proxy systemd[1]: Started Squid caching proxy.
Jan 09 16:43:05 http-proxy squid[5507]: Squid Parent: (squid-1) process 5509 started

squid 服務應顯示 loaded 並且是 active (running)

2.4. 使用 Squid 檢測

$ sudo squid -k check | echo $?

螢幕輸出 :

0

2.5. 將 Squid 用來監聽客戶端請求的通訊連接埠改成 8080

$ sudo sed -i 's|http_port 3128|#http_port 3128|g' /etc/squid/squid.conf

$ sudo sed -i "62ihttp_port 8080" /etc/squid/squid.conf

http_port PORT，這是 Squid 用來監聽客戶端請求的通訊連接埠。預設連接埠為 3128

2.6. 允許本機系統和其他系統的使用者存取 Squid 和上網

$ sudo sed -i 's|http_access deny all|#http_access deny all|g' /etc/squid/squid.conf

$ sudo sed -i '59ihttp_access allow all' /etc/squid/squid.conf

2.7. Reload Squid

$ sudo systemctl reload squid.service

2.8. 啟動防火牆

$ sudo systemctl enable --now firewalld.service

2.9. 設定防火牆允許 squid 服務

$ sudo firewall-cmd --add-port=8080/tcp --permanent

$ sudo firewall-cmd --reload

2.10. 再其他台機器測試是否開 8080 TCP Port

$ nc -w 1 192.168.11.195 8080; echo $?

螢幕輸出 :

0

2.11. 在本機測試是否能夠透過 squid 上網

$ squidclient -p 8080 https://www.google.com

螢幕輸出 :

HTTP/1.1 200 OK
Date: Tue, 09 Jan 2024 14:04:15 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-MQHNqGlQrWDv6h0C8DvUjQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2024-01-09-14; expires=Thu, 08-Feb-2024 14:04:15 GMT; path=/; domain=.google.com; Secure
Set-Cookie: AEC=Ae3NU9NHgU8wktpInxIwHf7c1B1M8ESd01oaq_xA3akE34sUyfSmsb_WEio; expires=Sun, 07-Jul-2024 14:04:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: NID=511=UTGSPeCwlOe_nlA6TIA4Ldko2xAj7kUY17QYZrRkxm_DsBhBWII92LzmU3Pz9I69NYktFhoJpYZI3lZL3BFTzJKu33M9qVM9bWjkl0H6FjGTjlE0XJJB3As9TBbgQ1ywcvgtVeSpr1_nvZ3wE4jnKb566WLgpKVfhLf-csMnzJQ; expires=Wed, 10-Jul-2024 14:04:15 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Accept-Ranges: none
Vary: Accept-Encoding
X-Cache: MISS from http-proxy
X-Cache-Lookup: MISS from http-proxy:8080
Via: 1.1 http-proxy (squid/5.7)
Connection: close

...以下省略

3. 安裝與設定 SUSE Manager Server

3.1. 安裝要求

Hardware

  • CPU:
    • Minimum 4 dedicated 64-bit CPU cores (x86-64)
  • Mem:
    • Test or Base Installation
      • Minimum 16 GB
    • Production Server
      • Minimum 32 GB
  • Disk:
    • / (root directory)
      • Minimum 40 GB
    • /var/lib/pgsql
      • Minimum 50 GB
    • /var/spacewalk
      • Minimum storage required: 100 GB (this will be verified by the implemented check)
      • 50 GB for each SUSE product and Package Hub
      • 360 GB for each Red Hat product
    • /var/cache
      • Minimum 10 GB. Add 100 MB per SUSE product, 1 GB per Red Hat or other product. Double the space if the server is an ISS Master.
    • Swap space
      • 3 GB

Operating System

  • SUSE Linux Enterprise Server 15 SP4
  • ISO: SLE-15-SP4-Full-x86_64-QU3.1-Media1.iso

3.2. 開始安裝 SUSE Manager Server

3.2.1. 啟動 SUSE Manager Server 所在的 VM

3.2.2. 選擇 Installation

image

3.2.3. 選擇要安裝的 Product: SUSE Manager Server 4.3

image

3.2.4. 同意 SUSE Manager Server 4.3 的 Licence

image

3.2.5. 點選右上角，網路設定

image

3.2.6. 點選 edit 設定 IP Address

image

3.2.6.1. 設定 Static IP

  • 勾選 Statically Assigned IP Address
  • IP Address 欄位輸入: <IP>
  • Subnet Mask 欄位輸入: /24
  • Hostname 欄位輸入: suma.example.com

image

3.2.7. 設定 Hostname/DNS

image

3.2.7.1. 設定 Hostname 與 Name Server

image

3.2.8. 設定 Routing

image

3.2.8.1. 設定 Default Gateway

image

3.2.9. 完成網路設定

image

3.2.10. 先暫時跳過註冊 Product

  1. 點選 Skip Registration

image

  1. 點選 OK

image

  1. 下一步，點選 Next

image

3.2.11. 使用預設的 Extension 和 Module

image

3.2.12. 點選 Next，不新增額外的 Product

image

3.2.13. System Role 選擇 SUSE Manager Server(single disk)

image

3.2.14. 設定磁區分割和檔案系統

3.2.14.1. Resize var_spacewalk 目錄區的大小至最大

  1. 點選 Expert Partitioner -> Start with current Proposal

image

  1. 點選 var_spacewalk -> Device -> Resize

image

  1. 預設是 Resize 到最大 Size，所以直接點選 Next

image

  1. 確認設定資訊沒問題後，點選 Accept

image

  1. 完成磁碟分割和檔案系統的設定，點選 Next

image

3.2.15. 設定時區

messageImage_1704816159400

3.2.16. 設定使用者

image

3.2.17. 檢查設定，關閉防火牆，並且 openssh 要打開

  1. 在 Firewall will be enabled 欄位，點選 disable

image

  1. 確認防火牆關閉且 SSH 服務有 enable，再點選 Install

image

  1. 確認安裝，點選 Install

image

  1. 安裝完後，系統會重啟

3.3. 設定 Http Proxy 與註冊 SUSE Manager Server

3.3.1. 設定 Proxy

$ sudo sed -i 's|PROXY_ENABLED="no"|#PROXY_ENABLED="no"|g' /etc/sysconfig/proxy

$ sudo sed -i '12iPROXY_ENABLED="yes"' /etc/sysconfig/proxy

$ sudo sed -i 's|HTTP_PROXY=""|#HTTP_PROXY=""|g' /etc/sysconfig/proxy

$ sudo sed -i '21iHTTP_PROXY="http://192.168.11.195:8080"' /etc/sysconfig/proxy

$ sudo sed -i 's|HTTPS_PROXY=""|#HTTPS_PROXY=""|g' /etc/sysconfig/proxy

$ sudo sed -i '30iHTTPS_PROXY="http://192.168.11.195:8080"' /etc/sysconfig/proxy

3.3.2. 重啟系統

$ sudo reboot

3.3.3. 跟 SUSE Customer Center 註冊系統

使用 root 帳號執行以下命令 :

$ SUSEConnect -e "xxx@xxx.xxx" -r "XXXXXXXXXXXXXXX"

-e，E-mail Address -r，Registration Code

螢幕輸出 :

Registering system to SUSE Customer Center
Using E-Mail:xxx

Announcing system to https://scc.suse.com ...

Activating SUSE-Manager-Server 4.3 x86_64 ...
-> Adding service to system ...

Activating sle-module-basesystem 15.4 x86_64 ...
-> Adding service to system ...
-> Installing release package ...

Activating sle-module-server-applications 15.4 x86_64 ...
-> Adding service to system ...
-> Installing release package ...

Activating sle-module-web-scripting 15.4 x86_64 ...
-> Adding service to system ...
-> Installing release package ...

Activating sle-module-suse-manager-server 4.3 x86_64 ...
-> Adding service to system ...
-> Installing release package ...

Successfully registered system

3.3.4. 檢查是否註冊成功

$ SUSEConnect -s

螢幕輸出 :

[{"name":"SUSE Employee subscription for SUSE Manager Server x86_64","identifier":"SUSE-Manager-Server","version":"4.3","arch":"x86_64","status":"Registered","regcode":"XXX","starts_at":"2023-04-19 02:33:18 UTC","expires_at":"2024-04-19 02:33:18 UTC","subscription_status":"ACTIVE","type":"XXX"},{"identifier":"sle-module-basesystem","version":"15.4","arch":"x86_64","status":"Registered"},{"identifier":"sle-module-server-applications","version":"15.4","arch":"x86_64","status":"Registered"},{"identifier":"sle-module-web-scripting","version":"15.4","arch":"x86_64","status":"Registered"},{"identifier":"sle-module-suse-manager-server","version":"4.3","arch":"x86_64","status":"Registered"}]

3.3.4. 更新套件儲存庫

$ zypper ref

3.4 設定 SUSE Manager Server

3.4.1. 使用 YAST 工具設定 SUSE Manager Server

$ yast2 susemanager_setup

3.4.2. Set up SUSE Manager from scratch

image

3.4.3. 輸入 SUSE Manager Administrator e-mail address

image

3.4.4. 設定 Certificate

輸入以下憑證資訊 :

image

3.4.5. Database Settings

輸入以下憑證資訊 :

image

3.4.6. 同意開始初始化設定

image

3.4.7. 檢查無任何錯誤資訊後，點選 Next

image

3.4.8. 完成 SUSE Manager Server 的初始化設定，點選 Finish

image

3.5. 設定 SUSE Manager Server 管理員帳號

3.5.1. 在瀏覽器中，輸入完成設定後提供的位址，使用此位址開啟 SUSE Manager Web UI。

3.5.2. 建立組織

輸入以下資訊 :

image

3.6. 將 SUSE Manager Server 更新至最新版 4.3.10

3.6.1. 在 SUSE Manager Server 以 root 身分停止 spacewalk 服務：

$ spacewalk-service stop

螢幕輸出 :

Shutting down spacewalk services...
Done.

3.6.2. 刷新套件儲存庫

$ zypper ref

3.6.3. 軟體更新

$ zypper up

螢幕輸出 :

Refreshing service 'Basesystem_Module_15_SP4_x86_64'.
Refreshing service 'SUSE_Manager_Server_4.3_x86_64'.
Refreshing service 'SUSE_Manager_Server_Module_4.3_x86_64'.
Refreshing service 'Server_Applications_Module_15_SP4_x86_64'.
Refreshing service 'Web_and_Scripting_Module_15_SP4_x86_64'.
Loading repository data...
Reading installed packages...

The following 477 packages are going to be upgraded:
The following package is going to change architecture:
  release-notes-susemanager  x86_64 -> noarch

The following 13 NEW packages are going to be installed:
  apache2-mod_wsgi apache-commons-math dosfstools kernel-default-5.14.21-150400.24.100.2 libfstrm0 libhidapi-hidraw0 libprocps8
  libprotobuf-c1 log4j-jcl mtools python3-jmespath python3-looseversion system-user-prometheus

The following 4 packages are going to be REMOVED:
  apache2-mod_wsgi-python3 apache-commons-math3 libfreebl3-hmac libsoftokn3-hmac

The following package requires a system reboot:
  kernel-default-5.14.21-150400.24.100.2

477 packages to upgrade, 13 new, 4 to remove, 1 to change arch.
Overall download size: 857.7 MiB. Already cached: 0 B. After the operation, additional 214.6 MiB will be used.

    Note: System reboot required.
Continue? [y/n/v/...? shows all options] (y): y
$ Update notifications were received from the following packages:
susemanager-schema-4.3.23-150400.3.33.2.noarch (/var/adm/update-messages/susemanager-schema-4.3.23-150400.3.33.2)
View the notifications now? [y/n] (n):
There are running programs which still use files and libraries deleted or updated by recent upgrades. They should be restarted to benefit from the latest updates. Run 'zypper ps -s' to list these programs.

Since the last system boot core libraries or services have been updated.
Reboot is suggested to ensure that your system benefits from these updates.

3.6.4. 重啟系統

$ reboot

3.6.5. 檢查 SUSE Manager 相關的所有服務是否都是 active

$ spacewalk-service status

螢幕輸出 :

● mgr-check-payg.service - Check and install payg billing service.
     Loaded: loaded (/usr/lib/systemd/system/mgr-check-payg.service; static)
     Active: active (exited) since Wed 2024-01-10 13:31:14 CST; 1min 52s ago
    Process: 868 ExecStart=/usr/sbin/spacewalk-startup-helper check-billing-service (code=exited, status=0/SUCCESS)
   Main PID: 868 (code=exited, status=0/SUCCESS)

● uyuni-update-config.service - Uyuni update config
     Loaded: loaded (/usr/lib/systemd/system/uyuni-update-config.service; static)
     Active: active (exited) since Wed 2024-01-10 13:31:29 CST; 1min 37s ago
    Process: 1893 ExecStart=/usr/sbin/uyuni-update-config (code=exited, status=0/SUCCESS)
   Main PID: 1893 (code=exited, status=0/SUCCESS)

● uyuni-check-database.service - Uyuni check database
     Loaded: loaded (/usr/lib/systemd/system/uyuni-check-database.service; static)
     Active: active (exited) since Wed 2024-01-10 13:32:12 CST; 54s ago
    Process: 1904 ExecStart=/usr/sbin/spacewalk-startup-helper check-database (code=exited, status=0/SUCCESS)
   Main PID: 1904 (code=exited, status=0/SUCCESS)

● tomcat.service - Apache Tomcat Web Application Container
     Loaded: loaded (/usr/lib/systemd/system/tomcat.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/tomcat.service.d
             └─override.conf
     Active: active (running) since Wed 2024-01-10 13:32:12 CST; 54s ago
   Main PID: 5222 (java)
      Tasks: 117 (limit: 576)
     CGroup: /system.slice/tomcat.service
             └─ 5222 /usr/lib64/jvm/jre/bin/java -ea -Xms256m -Xmx1G -Djava.awt.headless=true -Dorg.xml.sax.driver=com.redhat.rhn.fro…

● spacewalk-wait-for-tomcat.service - Spacewalk wait for tomcat
     Loaded: loaded (/usr/lib/systemd/system/spacewalk-wait-for-tomcat.service; static)
     Active: active (exited) since Wed 2024-01-10 13:32:45 CST; 21s ago
    Process: 5223 ExecStart=/usr/sbin/spacewalk-startup-helper wait-for-tomcat (code=exited, status=0/SUCCESS)
   Main PID: 5223 (code=exited, status=0/SUCCESS)

● salt-master.service - The Salt Master Server
     Loaded: loaded (/usr/lib/systemd/system/salt-master.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/salt-master.service.d
             └─override.conf
     Active: active (running) since Wed 2024-01-10 13:32:12 CST; 54s ago
       Docs: man:salt-master(1)
             file:///usr/share/doc/salt/html/contents.html
             https://docs.saltproject.io/en/latest/contents.html
   Main PID: 5220 (salt-master)
      Tasks: 56
     CGroup: /system.slice/salt-master.service
             ├─ 5220 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5468 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5469 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5473 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5474 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5475 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5476 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5478 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5479 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5480 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5481 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5482 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5483 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5484 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5485 /usr/bin/python3 /usr/bin/salt-master
             ├─ 5496 /usr/bin/python3 /usr/bin/salt-master
             └─ 5497 /usr/bin/python3 /usr/bin/salt-master

● salt-api.service - The Salt API
     Loaded: loaded (/usr/lib/systemd/system/salt-api.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/salt-api.service.d
             └─override.conf
     Active: active (running) since Wed 2024-01-10 13:32:12 CST; 54s ago
       Docs: man:salt-api(1)
             file:///usr/share/doc/salt/html/contents.html
             https://docs.saltproject.io/en/latest/contents.html
   Main PID: 5215 (salt-api)
      Tasks: 104
     CGroup: /system.slice/salt-api.service
             ├─ 5215 /usr/bin/python3 /usr/bin/salt-api
             └─ 5307 /usr/bin/python3 /usr/bin/salt-api

● spacewalk-wait-for-salt.service - Make sure that salt is started before httpd
     Loaded: loaded (/usr/lib/systemd/system/spacewalk-wait-for-salt.service; static)
     Active: active (exited) since Wed 2024-01-10 13:32:12 CST; 54s ago
    Process: 5221 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
   Main PID: 5221 (code=exited, status=0/SUCCESS)

● apache2.service - The Apache Webserver
     Loaded: loaded (/usr/lib/systemd/system/apache2.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/apache2.service.d
             └─override.conf
     Active: active (running) since Wed 2024-01-10 13:32:45 CST; 21s ago
   Main PID: 6911 (httpd-prefork)
     Status: "Processing requests..."
      Tasks: 8
     CGroup: /system.slice/apache2.service
             ├─ 6911 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             ├─ 6926 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             ├─ 6927 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             ├─ 6928 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             ├─ 6931 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             ├─ 6932 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             ├─ 6976 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…
             └─ 7313 /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DISSUSE -C "PidFile /run/httpd.pid" -C "Include /etc/apache2/sysconfi…

● rhn-search.service - Spacewalk search engine
     Loaded: loaded (/usr/lib/systemd/system/rhn-search.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/rhn-search.service.d
             └─override.conf
     Active: active (running) since Wed 2024-01-10 13:32:45 CST; 21s ago
   Main PID: 6918 (rhn-search)
      Tasks: 78
     CGroup: /system.slice/rhn-search.service
             ├─ 6918 /bin/sh /usr/sbin/rhn-search
             └─ 6934 /usr/bin/java -Djava.library.path=/usr/lib:/usr/lib64:/usr/lib/gcj/postgresql-jdbc:/usr/lib64/gcj/postgresql-jdb…

● cobblerd.service - Cobbler Helper Daemon
     Loaded: loaded (/usr/lib/systemd/system/cobblerd.service; enabled; vendor preset: disabled)
     Active: active (running) since Wed 2024-01-10 13:32:12 CST; 54s ago
   Main PID: 5213 (cobblerd)
      Tasks: 24
     CGroup: /system.slice/cobblerd.service
             ├─ 5213 /usr/bin/python3 -s /usr/bin/cobblerd -F
             └─ 7962 "[sha1sum]"

● taskomatic.service - Taskomatic
     Loaded: loaded (/usr/lib/systemd/system/taskomatic.service; enabled; vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/taskomatic.service.d
             └─override.conf
     Active: active (running) since Wed 2024-01-10 13:32:45 CST; 21s ago
   Main PID: 6919 (taskomatic)
      Tasks: 151
     CGroup: /system.slice/taskomatic.service
             ├─ 6919 /bin/sh /usr/sbin/taskomatic
             └─ 6935 /usr/bin/java -Djava.library.path=/usr/lib:/usr/lib64 -classpath "/usr/share/rhn/classes:/usr/share/rhn/lib/spac…

● spacewalk-wait-for-taskomatic.service - Spacewalk wait for taskomatic
     Loaded: loaded (/usr/lib/systemd/system/spacewalk-wait-for-taskomatic.service; static)
     Active: active (exited) since Wed 2024-01-10 13:32:52 CST; 14s ago
    Process: 6924 ExecStart=/usr/sbin/spacewalk-startup-helper wait-for-taskomatic (code=exited, status=0/SUCCESS)
   Main PID: 6924 (code=exited, status=0/SUCCESS)

● salt-secrets-config.service - Configures secrets between salt-master and other services
     Loaded: loaded (/usr/lib/systemd/system/salt-secrets-config.service; static)
    Drop-In: /usr/lib/systemd/system/salt-secrets-config.service.d
             └─override.conf
     Active: active (exited) since Wed 2024-01-10 13:31:17 CST; 1min 49s ago
    Process: 870 ExecStart=/usr/bin/salt-secrets-config.py (code=exited, status=0/SUCCESS)
   Main PID: 870 (code=exited, status=0/SUCCESS)

● mgr-websockify.service - TCP to WebSocket proxy
     Loaded: loaded (/usr/lib/systemd/system/mgr-websockify.service; static)
     Active: active (running) since Wed 2024-01-10 13:32:12 CST; 54s ago
    Process: 5214 ExecStartPre=/usr/bin/sh -c grep secret_key /etc/rhn/rhn.conf | tr -d ' ' | cut -f2 -d '=' | perl -ne 's/([0-9a-f]{2})/print chr hex $1/gie' > /etc/rhn/websockify.key (code=exited, status=0/SUCCESS)
   Main PID: 5224 (websockify)
      Tasks: 4
     CGroup: /system.slice/mgr-websockify.service
             └─ 5224 /usr/bin/python3 /usr/bin/websockify --token-plugin JWTTokenApi --token-source /etc/rhn/websockify.key localhost…

● cobbler-refresh-mkloaders.service - Refresh Cobbler bootloaders
     Loaded: loaded (/usr/lib/systemd/system/cobbler-refresh-mkloaders.service; static)
    Drop-In: /usr/lib/systemd/system/cobbler-refresh-mkloaders.service.d
             └─override.conf
     Active: active (exited) since Wed 2024-01-10 13:32:49 CST; 17s ago
    Process: 6920 ExecStart=/usr/bin/cobbler mkloaders (code=exited, status=0/SUCCESS)
   Main PID: 6920 (code=exited, status=0/SUCCESS)
● spacewalk.target - Spacewalk
     Loaded: loaded (/usr/lib/systemd/system/spacewalk.target; enabled; vendor preset: disabled)
     Active: active since Wed 2024-01-10 13:32:52 CST; 14s ago
● jabberd.service - Jabber Server
     Loaded: loaded (/usr/lib/systemd/system/jabberd.service; enabled; vendor preset: disabled)
     Active: active (exited) since Wed 2024-01-10 13:31:28 CST; 1min 38s ago
    Process: 1622 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
   Main PID: 1622 (code=exited, status=0/SUCCESS)
● osa-dispatcher.service - OSA Dispatcher daemon
     Loaded: loaded (/usr/lib/systemd/system/osa-dispatcher.service; enabled; vendor preset: disabled)
     Active: active (running) since Wed 2024-01-10 13:31:30 CST; 1min 36s ago
    Process: 1835 ExecStartPre=/bin/rm -f /run/osa-dispatcher.pid (code=exited, status=0/SUCCESS)
    Process: 1838 ExecStart=/usr/sbin/osa-dispatcher --pid-file /run/osa-dispatcher.pid (code=exited, status=0/SUCCESS)
   Main PID: 2082 (osa-dispatcher)
      Tasks: 1
     CGroup: /system.slice/osa-dispatcher.service
             └─ 2082 /usr/bin/python3 /usr/sbin/osa-dispatcher --pid-file /run/osa-dispatcher.pid

3.7. 從 SUSE Custom Center 同步 Products

3.7.1. 新增 Organization Credentials

  1. 在 SUSE Manager Web UI, 選擇 Admin -> Setup Wizard
  2. 從 Setup Wizard 頁面選擇 Organization Credentials
  3. 點選 Add a new credential

image

  1. 輸入 Username 和 Password，確認沒問題後按 Save

image

在 SCC 的 Users -> Organization Credentials 可以看到使用者帳號和密碼 image

3.7.2. 確認組織憑證已新增成功

image

3.7.3. 列出可加入的 Products

image

4. 使用自簽憑證

4.1 Create a new CA and Server Certificates

  1. 在 SUSE Manager Server 執行以下命令，將舊的 certificate 目錄區移到新的地方:
$ mv /root/ssl-build /root/old-ssl-build
  1. 產生新的 CA certificate:
$ rhn-ssl-tool --gen-ca -psumaadmin \
--dir="/root/ssl-build" \
--set-country="TW" \
--set-state="Taiwan" \
--set-city="Taipei" \
--set-org="IT" \
--set-org-unit="SUSELab" \
--set-common-name="SUSE Manager CA Certificate" \
--set-email="name@example.com"

螢幕輸出 :

Generating private CA key: /root/ssl-build/RHN-ORG-PRIVATE-SSL-KEY

Generating public CA certificate: /root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT
Using distinguishing variables:
    --set-country      = "TW"
    --set-state        = "Taiwan"
    --set-city         = "Taipei"
    --set-org          = "IT"
    --set-org-unit     = "SUSELab"
    --set-common-name  = "SUSE Manager CA Certificate"
    --set-email        = "name@example.com"

...working...
Generating CA public certificate RPM:
    /root/ssl-build/rhn-org-trusted-ssl-cert-1.0-1.src.rpm
    /root/ssl-build/rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm

Make the public CA certificate publically available:
    (NOTE: the SUSE Manager Server or Proxy installers may do this step for you.)
    The "noarch" RPM and raw CA certificate can be made publically accessible
    by copying it to the /srv/www/htdocs/pub directory of your SUSE Manager Server or
    Proxy.
  1. 產生新的 server certificate
$ rhn-ssl-tool --gen-server -psumaadmin \
--dir="/root/ssl-build" \
--set-country="TW" \
--set-state="Taiwan" \
--set-city="Taipei" \
--set-org="SUSELab" \
--set-org-unit="IT" \
--set-email="name@example.com" \
--set-hostname=`hostname -f` \
--set-cname="example.com"

螢幕輸出 :

Generating the web server's SSL private key: /root/ssl-build/suma/server.key

Generating web server's SSL certificate request: /root/ssl-build/suma/server.csr
Using distinguished names:
    --set-country      = "TW"
    --set-state        = "Taiwan"
    --set-city         = "Taipei"
    --set-org          = "IT"
    --set-org-unit     = "SUSELab"
    --set-hostname     = "suma.example.com"
    --set-email        = "name@example.com"
Rotated: rhn-ca-openssl.cnf --> rhn-ca-openssl.cnf.1

Generating/signing web server's SSL certificate: server.crt

...working...

Generating web server's SSL key pair/set RPM:
    /root/ssl-build/suma/rhn-org-httpd-ssl-key-pair-suma-1.0-1.src.rpm
    /root/ssl-build/suma/rhn-org-httpd-ssl-key-pair-suma-1.0-1.noarch.rpm

The most current SUSE Manager Proxy installation process against SUSE Manager hosted
requires the upload of an SSL tar archive that contains the CA SSL public
certificate and the web server's key set.

Generating the web server's SSL key set and CA SSL public certificate archive:
    /root/ssl-build/suma/rhn-org-httpd-ssl-archive-suma-1.0-1.tar

Deploy the server's SSL key pair/set RPM:
    (NOTE: the SUSE Manager or Proxy installers may do this step for you.)
    The "noarch" RPM needs to be deployed to the machine working as a
    web server, or SUSE Manager, or SUSE Manager Proxy.
    Presumably 'suma.example.com'.

4.2. Replace Certificates

  1. 透過 mgr-ssl-cert-setup 更換憑證
$ mgr-ssl-cert-setup --root-ca-file=/root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT \
--server-cert-file=/root/ssl-build/suma/server.crt \
--server-key-file=/root/ssl-build/suma/server.key

螢幕輸出 :

After changing the server certificate please execute:
$> spacewalk-service stop
$> systemctl restart postgresql.service
$> spacewalk-service start

As the CA certificate has been changed, please deploy the CA to all registered clients.
On salt-managed clients, you can do this by applying the highstate.
  1. 重啟以下服務
$ spacewalk-service stop && \
systemctl restart postgresql.service && \
spacewalk-service start

螢幕輸出 :

Shutting down spacewalk services...
Done.
Starting spacewalk services...
  Checking DB schema and running DB schema upgrade if needed. This may take a while.
  Call the following command to see progress: journalctl -f -u uyuni-check-database.service
 Done.
  1. 檢查 SUSE Manager Server 相關的所有服務是否正常
$ spacewalk-service status

檢查每一個 Service 是否都是 Active

  1. Root CA 部屬到每一個 Salt Clients 上

Systems -> 選擇 Salt Client -> States -> 點選 Test mode -> Apply Hightstate

image

在 Events -> History 檢查是否成功

image

States -> Apply Hightstate

image

在 Events -> History 檢查是否成功

image

  1. SSH 連線至 Client 端，執行以下命令，檢查 CA 憑證是否與 Server 一致
$ cat /etc/pki/ca-trust/source/anchors/RHN-ORG-TRUSTED-SSL-CERT

螢幕輸出 :

-----BEGIN CERTIFICATE-----
MIIDQzCCAiugAwIBAgIUZs8KZdMAEwnfzGoFVEFIhFpB03cwDQYJKoZIhvcNAQEL
BQAwMTERMA8GA1UEAwwIU1VTRS5MYWIxCzAJBgNVBAYTAlRXMQ8wDQYDVQQHDAZU
YWlwZWkwHhcNMjQwMTE4MDkyNDQ0WhcNMjUwMTA4MDkyNDQ0WjAxMREwDwYDVQQD
DAhTVVNFLkxhYjELMAkGA1UEBhMCVFcxDzANBgNVBAcMBlRhaXBlaTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBALIk9EsE0pAjhq/cqq0fwQCWLHU9SxWg
oJQlRnY9Xt+Gvrh3iWVi5y4nDX7MKco7JfhLJy+OyYtorru538FGBToSeSlog3hM
/wx12d2baHA2ZaavNp9IQcaUZU2DNzoLSamVzi8CQplPhCrrvL1EUD9iG8EUV43f
HK2w8cFVlOX5YPd8CRHLRD/nysD2ZZ5kfyADJhwTT5Qk/C0wi7jFpFnf89aXAjlU
ckKegfVAxL27ynIFxk7HL5Bvt5XwHfaBtmAPwRhem7HS6DEJxZM6Gx/c4HKI0YIC
GTAh2eTdzH8VOOBudlgbEmivSpWOwSCDzEWfH5XMWlF73yf8kCtprr0CAwEAAaNT
MFEwHQYDVR0OBBYEFEhqJvJ7F6g2xzSiQHAQLFlQHac2MB8GA1UdIwQYMBaAFEhq
JvJ7F6g2xzSiQHAQLFlQHac2MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
BQADggEBAJ+s0a6X4J2b/D8K2AazwDB3jyry1BXizoCYrIKspyO/2fMAgRjskSub
Bb3i+bUL+UiY1UbHEIfVHuzDi7JDAhuA+2l9SRjRO7HCXPum3j2REelLc6Y+yM9B
pAuwIXb2KfHiRM4Nen7tymMbOtaIm9XfDCY+TZ/vSIBu8tj9bUN4yctCYIoqbfAs
rWQwR6uWLmp4tcpS9d4lt+R0L8W6kxcVQwyaSABXF62IAQA9wVJQtcj4th07gsiR
FS8rbVRG52iX01L+fwxOwspZG7n+fp/eL4Ushj939giNnkn0GdHA3eaUfMIhn7KM
1mI/JrxRt+zCvMqdPLRHhZJNMd+OlCI=
-----END CERTIFICATE-----

5. Retrying to Set up SUSE Manager (可選) 

$ yast2 susemanager_setup
> 最後一部問 mgr-setup ，選 no

$ rm /root/.MANAGER_SETUP_COMPLETE
$ systemctl stop postgresql.service
$ rm -rf /var/lib/pgsql/data
$ mv /root/ssl-build /root/old-ssl-build

# Check the /etc/hosts file, and correct it if necessary.
$ cat /etc/hosts

# Check /etc/setup_env.sh on the target system, and ensure the database name is set:
$ cat /root/setup_env.sh | grep -w "MANAGER_DB_NAME"
export MANAGER_DB_NAME='susemanager'

$ sudo init 6
$ /usr/lib/susemanager/bin/mgr-setup -s

6. 參考資料

安裝 SUSE Manager 5.0Install NVIDIA GPU Operator on SL Micro