Best Practices Best Practices
Total Page:16
File Type:pdf, Size:1020Kb
Best Practices Best Practices Publication Date: 2019-09-03 SUSE LLC 10 Canal Park Drive Suite 200 Cambridge MA 02141 USA https://www.suse.com/documentation Contents 1 Introduction 1 1.1 What’s Covered in this Guide? 1 1.2 Prerequisites 1 1.3 Network Requirements 3 1.4 Hardware Recommendations 6 2 Managing Your Subscriptions 9 2.1 SUSE Customer Center (SCC) 9 2.2 Disconnected Setup with RMT or SMT (DMZ) 9 Repository Management Tool (RMT) and Disconnected Setup (DMZ) 10 • Repository Management Tool (SMT) and Disconnected Setup (DMZ) 11 • Updating Repositories on SUSE Manager From Storage Media 12 • Refreshing Data on the Storage Medium 13 3 Expanded Support 15 3.1 Managing Red Hat Enterprise Linux Clients 15 Server Configuration for Red Hat Enterprise Linux Channels 15 • Red Hat Enterprise Linux Channel Management Tips 16 • Mirroring RHEL Media into a Channel 16 • Registering RES Salt Minions with SUSE Manager 17 • Register a Salt Minion via Bootstrap 19 • Manual Salt Minion Registration 20 3.2 Preparing Channels and Repositories for CentOS Traditional Clients 20 3.3 Registering CentOS Salt Minions with SUSE Manager 23 3.4 Managing Ubuntu Clients 24 3.5 Prepare to Register Ubuntu Clients 25 iii Best Practices 4 Salt Formulas and SUSE Manager 28 4.1 What are Salt Formulas? 28 4.2 Installing Salt Formulas via RPM 28 4.3 File Structure Overview 30 4.4 Editing Pillar Data in SUSE Manager 31 Simple edit-group Example 38 4.5 Writing Salt Formulas 41 4.6 Separating Data 42 4.7 SUSE Manager Generated Pillar Data 43 4.8 Formula Requirements 44 4.9 Using Salt Formulas with SUSE Manager 45 4.10 SUSE Manager for Retail Salt Formulas 46 Pxe Formula 46 • Branch Network Formula 48 • Saltboot Formula 50 • Image Sync Formula 53 4.11 Salt Formulas Coming with SUSE Manager 53 Locale 53 • Domain Name System (Bind) 53 • Dhcpd 59 • Tftpd 61 • Vsftpd 62 5 Configuration Management with Salt 65 5.1 Configuration Management Overview 65 5.2 State Data: Levels of Hierarchy 65 5.3 Salt States Storage Locations 66 5.4 SUSE Manager States 66 5.5 Pillar Data 67 5.6 Group States 67 6 Salt Minion Scalability 69 6.1 Salt Minion Onboarding Rate 69 iv Best Practices 6.2 Minions Running with Unaccepted Salt Keys 69 6.3 Salt Timeouts 69 Presence Ping Timeout 70 6.4 Batching 71 Salt SSH Minions (SSH Push) 72 7 Activation Key Management 73 7.1 What are Activation Keys? 73 7.2 Provisioning and Configuration 74 7.3 Activation Keys Best Practices 74 Key Label Naming 75 • Channels which will be Included 75 7.4 Combining Activation Keys 76 7.5 Using Activation Keys and Bootstrap with Traditional Clients (Non- Salt) 77 7.6 Using Activation Keys when Registering Salt Minions 78 Using an Activation Key and Custom Grains File 78 • Using an Activation Key in the Minion Configuration File 79 8 Contact Methods 80 8.1 Selecting a Contact Method 80 8.2 Traditional Contact Method (rhnsd) 80 Configuring SUSE Manager rhnsd Daemon or Timer 81 • Viewing rhnsd Daemon or Timer Status 82 8.3 Push via SSH 82 Configuring the Server for Push via SSH 83 • Using sudo with Push via SSH 84 • Client Registration 85 • API Support for Push via SSH 86 • Proxy Support with Push via SSH 87 8.4 Push via Salt SSH 87 Overview 88 • Requirements 88 • Bootstrapping 89 • Configuration 90 • Action Execution 90 • Known Limitation 90 • For More Information 90 v Best Practices 8.5 OSAD 91 Enabling and Configuring OSAD 92 9 Advanced Patch Lifecycle Management 94 10 Live Patching with SUSE Manager 95 10.1 Introduction 95 10.2 Initial Setup Requirements 95 10.3 Live Patching Setup 95 10.4 Cloning Channels 97 10.5 Removing Non-live Kernel Patches from the Cloned Channels 98 10.6 Promoting Channels 98 10.7 Applying Live Patches to a Kernel 99 11 SUSE Manager Server Migration 101 11.1 Service Pack Migration Introduction 101 11.2 Service Pack Migration 101 11.3 Upgrading PostgreSQL to Version 9.6 102 11.4 Updating SUSE Manager 102 11.5 Migrating SUSE Manager version 3.1 to 3.2 103 Using YaST 104 • Using zypper 105 11.6 SUSE Manager Migration from Version 2.1 to Version 3 106 Prerequisites 107 • Setup the Target Machine 108 • Performing the Migration 109 • Speeding up the Migration 110 • Packages on External Storage 111 • Troubleshooting a Broken Web UI after Migration 111 • Example Session 111 vi Best Practices 12 Client Migration 117 12.1 Upgrading SLE 12 SPx to version 15 117 System Upgrade Preparation 118 • Sample Autoinstallation Script for System Upgrade (SLES 12 SP4 to SLES 15) 120 12.2 Migrating SLE 12 or later to version 12 SP4 121 13 PostgreSQL Database Migration 129 13.1 New SUSE Manager Installations 129 13.2 Migrating an Existing Installation 129 13.3 Performing a Fast Migration 130 13.4 Typical Migration Sample Session 131 14 Backup and Restore 135 14.1 Backing up SUSE Manager 135 14.2 Administering the Database with smdba 137 14.3 Database Backup with smdba 138 Performing a Manual Database Backup 139 • Scheduling Automatic Backups 140 14.4 Restoring from Backup 141 14.5 Archive Log Settings 141 14.6 Retrieving an Overview of Occupied Database Space 142 14.7 Moving the Database 143 14.8 Recovering from a Crashed Root Partition 144 14.9 Database Connection Information 145 15 Authentication Methods 146 15.1 Authentication Via PAM 146 15.2 Authentication Via eDirectory and PAM 147 vii Best Practices 15.3 Example Quest VAS Active Directory Authentication Template 148 16 Using a Custom SSL Certificate 149 16.1 Prerequisites 149 16.2 Setup 149 16.3 Using a Custom Certificate with SUSE Manager Proxy 150 17 Troubleshooting 151 17.1 Registering Cloned Salt Minions 151 17.2 Registering Cloned Traditional Systems 152 17.3 Typical OSAD/jabberd Challenges 154 Open File Count Exceeded 154 • jabberd Database Corruption 155 • Capturing XMPP Network Data for Debugging Purposes 156 • Engineering Notes: Analyzing Captured Data 157 17.4 Gathering Information with spacewalk-report 158 17.5 RPC Connection Timeout Settings 161 17.6 Client/Server Package Inconsistency 162 17.7 Corrupted Repository Data 163 17.8 Unable to Get Local Issuer Certificate 163 18 Additional Resources 164 18.1 Learning YAML Syntax for Salt States 164 18.2 Getting Started with Jinja Templates 164 18.3 Salt Best Practices 164 19 A SUSE Manager 2.1 and 3.2 Product Comparison 165 A GNU Licenses 169 20 GNU Free Documentation License 170 viii Best Practices 1 Introduction This document targets system administrators. 1.1 What’s Covered in this Guide? This document describes SUSE recommended best practices for SUSE Manager. This information has been collected from a large number of successful SUSE Manager real world implementations and includes feedback provided by product management, sales and engineering. Note: SUSE Manager Version Information In this manual if not other specified, SUSE Manager version 3.2 is assumed and this version is required if a feature is discussed. SUSE Manager 3.2 and SUSE Manager 3.2 Proxy were originally released as a SLES 12 SP3 extension. With the next maintenance update (December 2018), SUSE Manager 3.2 and SUSE Manager 3.2 Proxy will be based on SLES 12 SP4 and support SLE 12 SP4 clients officially. In the following sections and chapters, it is highly recommended to use SLE 12 SP4 instead of SP3. Whenever features of the SUSE Manager 3.2 host operating system are documented and not other specified version 12 SP4 is assumed. This chapter will discuss the following topics: Prerequisites Network Requirements Hardware Requirements 1.2 Prerequisites Purchased Registration Keys. During initial setup SUSE Manager will request a product Regis- tration Key . This key will be provided to you after purchasing the product. You can nd your key located under your SUSE Customer Center account. Log-in with your SUSE Customer Center credentials or register for a new account. -https://scc.suse.com 1 What’s Covered in this Guide? Evaluation Keys. If you wish to run a test system (non-production) a 60 day evaluation key may be obtained. On the SUSE Manager product page click TRY SUSE MANAGER. The evaluation key limits the number of systems that may be registered with SUSE Manager to 10. For more information see: https://www.suse.com/products/suse-manager/ SCC Organization Credentials. During setup you will also be asked to enter your SUSE Customer Center Organization Credentials . Users and Passwords. During both the SUSE Linux Enterprise installation and setup of SUSE Manager several users and passwords will be created: SUSE Linux Enterprise root user account PostgreSQL database user and password Certificate of Authority password SUSE Manager administrator user and password Tip: Safe Passwords Maintain security by creating safe passwords. Store passwords within a secure location. Use the following guidelines when creating your passwords. At least 8 characters long Should contain uppercase characters A B C Should contain lowercase characters a b c Should contain numbers 1 2 3 Should contain symbols ~ ! @ # 2 Prerequisites 1.3 Network Requirements SUSE Manager and SUSE Manager Proxy both contact several external addresses in order to maintain updates and subscriptions. The following lists provide the up-to-date hostnames for each service requiring permission when used in combination with corporate firewall and content filters. SUSE CUSTOMER CENTER HOSTNAMES (REQUIRED) https://scc.suse.com https://updates.suse.com NOVELL CUSTOMER CENTER HOSTNAMES (LEGACY) https://secure-www.novell.com https://nu.novell.com For SUSE Manager to function properly it requires the following pre-configured components within your network.