Configuring External Services

Copy the /etc/rndc.key file from the external DNS server to orcharhino:

$ scp root@dns.example.com:/etc/rndc.key /etc/foreman-proxy/rndc.key

Configure the ownership, permissions, and SELinux context:

$ restorecon -v /etc/foreman-proxy/rndc.key
$ chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key
$ chmod -v 640 /etc/foreman-proxy/rndc.key

To test the nsupdate utility, add a host remotely:

$ echo -e "server DNS_IP_Address\n \
update add aaa.example.com 3600 IN A Host_IP_Address\n \
send\n" | nsupdate -k /etc/foreman-proxy/rndc.key
$ nslookup aaa.example.com DNS_IP_Address
$ echo -e "server DNS_IP_Address\n \
update delete aaa.example.com 3600 IN A Host_IP_Address\n \
send\n" | nsupdate -k /etc/foreman-proxy/rndc.key

Enter the orcharhino-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file:

$ orcharhino-installer --foreman-proxy-dns=true \
--foreman-proxy-dns-managed=false \
--foreman-proxy-dns-provider=nsupdate \
--foreman-proxy-dns-server="DNS_IP_Address" \
--foreman-proxy-keyfile=/etc/foreman-proxy/rndc.key

In the orcharhino management UI, navigate to Infrastructure > orcharhino Proxies.

Locate the orcharhino and select Refresh from the list in the Actions column.

Associate the DNS service with the appropriate subnets and domain.

On your AlmaLinux host, install the ISC DHCP Service and Berkeley Internet Name Domain (BIND) utilities packages:

$ dnf install dhcp-server bind-utils

Generate a security token:

$ tsig-keygen -a hmac-md5 omapi_key

Edit the dhcpd configuration file for all subnets and add the key generated by tsig-keygen. The following is an example:

$ cat /etc/dhcp/dhcpd.conf
default-lease-time 604800;
max-lease-time 2592000;
log-facility local7;

subnet 192.168.38.0 netmask 255.255.255.0 {
	range 192.168.38.10 192.168.38.100;
	option routers 192.168.38.1;
	option subnet-mask 255.255.255.0;
	option domain-search "virtual.lan";
	option domain-name "virtual.lan";
	option domain-name-servers 8.8.8.8;
}

omapi-port 7911;
key omapi_key {
	algorithm hmac-md5;
	secret "My_Secret";
};
omapi-key omapi_key;

On orcharhino Server, define each subnet. Do not set DHCP orcharhino Proxy for the defined Subnet yet.

Configure the firewall for external access to the DHCP server:

$ firewall-cmd --add-service dhcp

Make the changes persistent:

$ firewall-cmd --runtime-to-permanent

On orcharhino Server, determine the UID and GID of the foreman user:

$ id -u foreman
993
$ id -g foreman
990

On the DHCP server, create the foreman user and group with the same IDs as determined in a previous step:

$ groupadd -g 990 foreman
$ useradd -u 993 -g 990 -s /sbin/nologin foreman

To ensure that the configuration files are accessible, restore the read and execute flags:

$ chmod o+rx /etc/dhcp/
$ chmod o+r /etc/dhcp/dhcpd.conf
$ chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

Enable and start the DHCP service:

$ systemctl enable --now dhcpd

Export the DHCP configuration and lease files using NFS:

$ dnf install nfs-utils
$ systemctl enable --now nfs-server

Create directories for the DHCP configuration and lease files that you want to export using NFS:

$ mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

To create mount points for the created directories, add the following line to the /etc/fstab file:

/var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
/etc/dhcp /exports/etc/dhcp none bind,auto 0 0

Mount the file systems in /etc/fstab:

$ mount -a

Ensure the following lines are present in /etc/exports:

/exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)

/exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

/exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

Reload the NFS server:

$ exportfs -rva

Configure the firewall for DHCP omapi port 7911:

$ firewall-cmd --add-port=7911/tcp

Optional: Configure the firewall for external access to NFS. Clients are configured using NFSv3.

$ firewall-cmd \
--add-service mountd \
--add-service nfs \
--add-service rpc-bind \
--zone public

Make the changes persistent:

$ firewall-cmd --runtime-to-permanent

Install the nfs-utils package:

$ dnf install nfs-utils

Create the DHCP directories for NFS:

$ mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

Change the file owner:

$ chown -R foreman-proxy /mnt/nfs

Verify communication with the NFS server and the Remote Procedure Call (RPC) communication paths:

$ showmount -e DHCP_Server_FQDN
$ rpcinfo -p DHCP_Server_FQDN

Add the following lines to the /etc/fstab file:

DHCP_Server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0

DHCP_Server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

Mount the file systems on /etc/fstab:

$ mount -a

To verify that the foreman-proxy user can access the files that are shared over the network, display the DHCP configuration and lease files:

$ su foreman-proxy -s /bin/bash
$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
$ exit

Enter the orcharhino-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file:

$ orcharhino-installer \
--enable-foreman-proxy-plugin-dhcp-remote-isc \
--foreman-proxy-dhcp-provider=remote_isc \
--foreman-proxy-dhcp-server=My_DHCP_Server_FQDN \
--foreman-proxy-dhcp=true \
--foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
--foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
--foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \
--foreman-proxy-plugin-dhcp-remote-isc-key-secret=My_Secret \
--foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911

Associate the DHCP service with the appropriate subnets and domain.

Create the TFTP directory for NFS:

$ mkdir -p /mnt/nfs/var/lib/tftpboot

In the /etc/fstab file, add the following line:

TFTP_Server_IP_Address:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0

Mount the file systems in /etc/fstab:

$ mount -a

Enter the orcharhino-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file:

$ orcharhino-installer \
--foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot \
--foreman-proxy-tftp=true

If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of the server that the TFTP service is running on:

$ orcharhino-installer --foreman-proxy-tftp-servername=TFTP_Server_FQDN

In the orcharhino management UI, navigate to Infrastructure > orcharhino Proxies.

Locate the orcharhino and select Refresh from the list in the Actions column.

Associate the TFTP service with the appropriate subnets and domain.

Obtain a Kerberos ticket for the account obtained from the IdM administrator:

$ kinit idm_user

Create a new Kerberos principal for orcharhino to use to authenticate on the IdM server:

$ ipa service-add orcharhino-proxy.network2.example.com

On the base operating system of either the orcharhino or orcharhino Proxy that is managing the DNS service for your deployment, install the ipa-client package:

$ dnf install ipa-client

Configure the IdM client by running the installation script and following the on-screen prompts:

$ ipa-client-install

Obtain a Kerberos ticket:

$ kinit admin

Remove any preexisting keytab:

$ rm /etc/foreman-proxy/dns.keytab

Obtain the keytab for this system:

$ ipa-getkeytab -p orcharhinoproxy/orcharhino.example.com@EXAMPLE.COM \
-s idm1.example.com -k /etc/foreman-proxy/dns.keytab

For the dns.keytab file, set the group and owner to foreman-proxy:

$ chown foreman-proxy:foreman-proxy /etc/foreman-proxy/dns.keytab

Optional: To verify that the keytab file is valid, enter the following command:

$ kinit -kt /etc/foreman-proxy/dns.keytab \
orcharhinoproxy/orcharhino.example.com@EXAMPLE.COM

Create and configure the zone that you want to manage:

Create and configure the reverse zone:

Configure your orcharhino Server or orcharhino Proxy Server to connect to your DNS service:

$ orcharhino-installer \
--foreman-proxy-dns-managed=false \
--foreman-proxy-dns-provider=nsupdate_gss \
--foreman-proxy-dns-server="idm1.example.com" \
--foreman-proxy-dns-tsig-keytab=/etc/foreman-proxy/dns.keytab \
--foreman-proxy-dns-tsig-principal="orcharhinoproxy/orcharhino.example.com@EXAMPLE.COM" \
--foreman-proxy-dns=true

For each affected orcharhino Proxy, update the configuration of that orcharhino Proxy in the orcharhino management UI:

On the IdM Server, add the following to the top of the /etc/named.conf file:

########################################################################

include "/etc/rndc.key";
controls  {
inet _IdM_Server_IP_Address_ port 953 allow { _orcharhino_IP_Address_; } keys { "rndc-key"; };
};
########################################################################

Reload the named service to make the changes take effect:

$ systemctl reload named

In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes:

Copy the /etc/rndc.key file from the IdM server to the base operating system of your orcharhino Server. Enter the following command:

$ scp /etc/rndc.key root@orcharhino.example.com:/etc/rndc.key

To set the correct ownership, permissions, and SELinux context for the rndc.key file, enter the following command:

$ restorecon -v /etc/rndc.key
$ chown -v root:named /etc/rndc.key
$ chmod -v 640 /etc/rndc.key

Assign the foreman-proxy user to the named group manually. Normally, orcharhino-installer ensures that the foreman-proxy user belongs to the named UNIX group, however, in this scenario orcharhino does not manage users and groups, therefore you need to assign the foreman-proxy user to the named group manually.

$ usermod -a -G named foreman-proxy

On orcharhino Server, enter the following orcharhino-installer command to configure orcharhino to use the external DNS server:

$ orcharhino-installer \
--foreman-proxy-dns-managed=false \
--foreman-proxy-dns-provider=nsupdate \
--foreman-proxy-dns-server="IdM_Server_IP_Address" \
--foreman-proxy-dns-ttl=86400 \
--foreman-proxy-dns=true \
--foreman-proxy-keyfile=/etc/rndc.key

Ensure that the key in the /etc/rndc.key file on orcharhino Server is the same key file that is used on the IdM server:

key "rndc-key" {
        algorithm hmac-md5;
        secret "secret-key==";
};

On orcharhino Server, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1.

$ echo -e "server 192.168.25.1\n \
update add test.example.com 3600 IN A 192.168.25.20\n \
send\n" | nsupdate -k /etc/rndc.key

On orcharhino Server, test the DNS entry:

$ nslookup test.example.com 192.168.25.1

Server:		192.168.25.1
Address:	192.168.25.1#53

Name:	test.example.com
Address: 192.168.25.20

To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones. Click the name of the zone and search for the host by name.

If resolved successfully, remove the test DNS entry:

$ echo -e "server 192.168.25.1\n \
update delete test.example.com 3600 IN A 192.168.25.20\n \
send\n" | nsupdate -k /etc/rndc.key

Confirm that the DNS entry was removed:

$ nslookup test.example.com 192.168.25.1

In the orcharhino management UI, navigate to Infrastructure > orcharhino Proxies.

For each orcharhino Proxy that you want to update, from the Actions list, select Refresh.

Configure the domain:

Configure the subnet:

On your orcharhino Proxy, install the required packages:

$ dnf install bind-utils

Generate a key:

$ dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key
$ cat Komapi_key.+*.private | grep ^Key|cut -d ' ' -f2-

Use orcharhino-installer to secure the dhcpd API:

$ orcharhino-installer \
--foreman-proxy-dhcp-key-name "My_Name" \
--foreman-proxy-dhcp-key-secret "My_Secret"

On orcharhino, enter the following command:

$ orcharhino-installer --enable-foreman-proxy-plugin-dhcp-infoblox \
--foreman-proxy-dhcp true \
--foreman-proxy-dhcp-provider infoblox \
--foreman-proxy-dhcp-server infoblox.example.com \
--foreman-proxy-plugin-dhcp-infoblox-username admin \
--foreman-proxy-plugin-dhcp-infoblox-password infoblox \
--foreman-proxy-plugin-dhcp-infoblox-record-type fixedaddress \
--foreman-proxy-plugin-dhcp-infoblox-dns-view default \
--foreman-proxy-plugin-dhcp-infoblox-network-view default

Optional: In the orcharhino management UI, navigate to Infrastructure > orcharhino Proxies, select the orcharhino Proxy with the DHCP Infoblox module, and ensure that the dhcp feature is listed.

In the orcharhino management UI, navigate to Infrastructure > Subnets.

For all subnets managed through Infoblox, ensure that the IP address management (IPAM) method of the subnet is set to DHCP.

On orcharhino, enter the following command to configure the Infoblox module:

$ orcharhino-installer --enable-foreman-proxy-plugin-dns-infoblox \
--foreman-proxy-dns true \
--foreman-proxy-dns-provider infoblox \
--foreman-proxy-plugin-dns-infoblox-dns-server infoblox.example.com \
--foreman-proxy-plugin-dns-infoblox-username admin \
--foreman-proxy-plugin-dns-infoblox-password infoblox \
--foreman-proxy-plugin-dns-infoblox-dns-view default

Optional: In the orcharhino management UI, navigate to Infrastructure > orcharhino Proxies, select the orcharhino Proxy with the Infoblox DNS module, and ensure that the dns feature is listed.

In the orcharhino management UI, navigate to Infrastructure > Domains.

For all domains managed through Infoblox, ensure that the DNS Proxy is set for those domains.

In the orcharhino management UI, navigate to Infrastructure > Subnets.

For all subnets managed through Infoblox, ensure that the DNS orcharhino Proxy and Reverse DNS orcharhino Proxy are set for those subnets.