How to access and manage RHEL within Red Hat Satellite

If you use Red Hat Satellite to manage your infrastructure, you probably occasionally run into situations where you need to access Red Hat Enterprise Linux (RHEL) systems to gather information directly, make changes to systems, review log files, analyze performance metrics, troubleshoot issues, and more.

Previously, if you were in the Satellite web interface and needed to drill down to a specific RHEL system to complete a task, you would generally need to open a secure shell (SSH) client application, establish an SSH connection, and authenticate to the host. Once you were logged in over SSH, you could run the necessary commands on the host.

Since Satellite 6.7, you have the ability to integrate Satellite with the RHEL web console. This powerful web interface allows you to perform a large variety of tasks on a RHEL system. Some of the many things you can manage from the web console include:

• System services
• Local user accounts
• Storage devices and file systems
• The firewall
• Networking

You can also easily review log files and performance metric graphs and access a command-line interface from the web console.

Both RHEL 8 and RHEL 7 include the web console, although some functionality is exclusive to RHEL 8. More information is available in the RHEL 8 documentation and the RHEL 7 documentation.

Once the integration is configured, you can log into a host's web console by clicking a single button in Satellite. This integration can simplify administration and save you time.

Web console connection prerequisites

Satellite 6.7 introduced the Satellite web console integration. The web console connection and authentication are established using the existing Satellite remote execution framework. This means you'll need to have remote execution working in the environment, including having SSH keys distributed to each host. For more information on how to configure remote execution, refer to Configuring and setting up remote jobs in the Satellite documentation.

You'll also need to have the cockpit-system package for the Cockpit server-administration tool installed on each of the RHEL hosts. I'll cover how to install this package on the hosts using Satellite, in case you don't already have it installed.

It's also important to note that several items are not required for the integration to work, as all communication happens through SSH:

• The cockpit.socket service does not need to be started or enabled on the hosts.
• The cockpit-ws (Cockpit web service) package does not need to be installed on the hosts.
• You don't need any additional firewall ports open, such as the 9090 port used by web console.

Configure the web console

Web console integration in Satellite defaults to off. To enable it, run:

# satellite-installer --enable-foreman-plugin-remote-execution-cockpit

You'll see output similar to this:

You can validate that remote execution is working in the environment by going to the Monitor menu in Satellite and selecting Jobs. From there, click on the Run Job button in the upper-right corner. The following example sets the Search Query to an asterisk (*) to run the job on all the Satellite clients. The command is set to hostname to run a simple non-intrusive command to validate the remote execution setup in the environment.

If any hosts report a failure on this job, there is likely either an issue with the remote execution configuration or the host is offline or unreachable.

The RHEL hosts will also need to have the cockpit-system package installed. If you don't already have it installed on all your hosts, you can use the Service Action - Enable Web Console job template to install it. Again, from the Monitor menu in Satellite, select Jobs. From there, click on the Run Job button in the upper-right corner. Set the Job category to Ansible Services and the Job template to Service Action - Enable Web Console. Add a Search Query to return the hosts you would like to install the package on (which could be an individual host, hosts from a lifecycle environment, or any other search query). This example specifies all hosts in the lifecycle_environment = DEV.

The job installs the cockpit-system package on each of the systems returned by the search query.

Access the web console from Satellite

Once the configuration completes, you can access the web console on a host by going to the Hosts menu and selecting All Hosts. From here, click on the host where you want to access the web console. There should be a menu along the top-right section of the screen that includes a Web Console button:

When you click the Web Console button, you be automatically logged into the web console on the host:

Understand Satellite permissions

The cockpit_hosts user permission provides access to the web console functionality in Satellite.

[ Boost your Linux skills with a free online course: RHEL technical overview. ]

Several of the included roles in Satellite provide the cockpit_hosts permission (such as the Manager and Organization admin roles). It is also possible to create a custom role that includes this permission. You could then assign the custom role to a user to provide them the ability to access the web console.

The cockpit_hosts permission provides full root access to the hosts through the web console, so you should carefully review all roles and users within your Satellite environment to understand which roles provide the cockpit_hosts permission and which users are members of these roles.

Install additional Cockpit packages

There are several other Cockpit packages available that you can install to provide additional web console functionality in RHEL, including:

• cockpit-machines for managing virtual machines
• cockpit-storaged for managing storage
• cockpit-podman for managing Podman containers

You can use several methods to install additional Cockpit packages if you wish:

• You can install the Cockpit packages from the command line with the yum command. Run yum search cockpit* to see a list of available packages.
• Once logged into the web console, the Applications menu shows a list of installable Cockpit applications. Note that the Applications menu is available in the web console only if the cockpit-packagekit package is already installed, so you might need to access the terminal in the web console and run yum install cockpit-packagekit.
• You can also install additional Cockpit packages from Satellite with a remote execution job. Go to the Monitor menu, select Jobs, and click the blue Run Job button in the upper-right corner. Set the Job category to Ansible Packages and the Job template to Package Action - Ansible Default. Specify a Search Query that resolves to the hosts you would like to install the additional Cockpit packages on (in this example, I specify hosts in my lifecycle_environment = DEV). Ensure the state setting is set to present, and specify the additional Cockpit package you would like to install under the name field (in this example, the cockpit-machines package).

Troubleshooting

Here are some common issues you might run into when configuring the RHEL web console and Satellite integration:

• Missing Web Console button: You pull up a host under the All Hosts menu and the Web Console button is not available: This can happen if your account doesn't have access to the cockpit_hosts permission (see the previous section on Satellite permissions). The Web Console button will also be missing if you haven't run the satellite-installer --enable-foreman-plugin-remote-execution-cockpit command (see the previous section on configuration).
• The server has no web console: You click on the Web Console button, but a message appears that the server has no web console: This means the cockpit-system package is not installed on the host. See the previous configuration section on using the Service Action - Enable Web Console job template to install the cockpit-system package. You can also click the dropdown on Schedule Remote Job and click Enable web console. This initiates a run of the Service Action - Enable Web Console on this individual host.
• Authentication failed for user <user@server>: You click on the Web Console button, but a message appears that authentication failed for the user: This indicates that there might be a problem with the Satellite remote execution configuration. Validate that you have correctly followed the documentation on configuring remote execution and the SSH keys.
• No route to server: You click the Web Console button but a message appears that there is no route to the host: This indicates that Satellite was unable to establish an SSH connection to the host. The host could be offline, or a network issue or firewall might be blocking the SSH connection.

[ You might also be interested in reading 5 Linux network troubleshooting commands. ]

Complete tasks from the web console

The integration of the RHEL web console with Satellite simplifies the administration of your environment and can save you time. Accessing the web console for a host from Satellite is a click away. You can then view log files, access performance metric graphs, run a command from the web console terminal, or complete many of the other available tasks from the web console.