[Katello] How should RedHat products be accessed behind Corporate firewalls & w/ a proxy?

Support
#1

I have previously imported (the manifest) and used Red Hat products in
Katello 2.4.*. I've recently built a Katello 3.1 server and would like to
do the same.

The manifest imports, but trying to select products returns:

getaddrinfo: Temporary failure in name resolution

I've seen this before (and in fact asked
<https://groups.google.com/forum/#!searchin/foreman-users/getaddrinfo|sort:relevance/foreman-users/kr7FV_ArDkI/hCSSSchxEAAJ>
about it before), but I think it just 'went away'.

Both Katello servers sit behind Corporate firewalls and use a Corporate
proxy. The local DNS source doesn't know about public domains (so can't
help with cdn.redhat.com).

When syncing the existing 2.4 Red Hat repositories, all requests
successfully use the details provided in:

/etc/pulp/server/plugins.conf.d/yum_importer.json

But browsing the Red Hat product list now returns the same cdn.redhat.com
lookup failure as the 3.1 server.

I've tried creating a host file entry for one of the public IPs for that
site, but that naturally returns:

Connection refused - connect(2)

As that address is not reachable; this is prevented by the firewalls.

I've tried setting the host file entry for cdn.redhat.com to the IP of the
proxy, then added a redirect rule in iptables to send the TCP443 request to
the correct port of the proxy, but then I get an SSL error, as Katello is
expecting a different conversation to the one the proxy wants to have.

From what I can tell, there wouldn't be a problem if there wasn't the
initial DNS lookup and this part solely used the json file.

Can anyone help please?

Cheers.

#2

We are using Satellite 6.2 behind our proxy servers without issue. The
settings which Sean mentions should get you out of trouble.

#3

Have you set these options using foreman-installer?

--katello-proxy-password      Proxy password for authentication

(default: nil)
–katello-proxy-port Port the proxy is running on (default:
nil)
–katello-proxy-url URL of the proxy server (default: nil)
–katello-proxy-username Proxy username for authentication
(default: nil)

··· On Tue, Nov 15, 2016 at 10:23 AM, JC wrote:

I have previously imported (the manifest) and used Red Hat products in
Katello 2.4.*. I’ve recently built a Katello 3.1 server and would like to
do the same.

The manifest imports, but trying to select products returns:

getaddrinfo: Temporary failure in name resolution

I’ve seen this before (and in fact asked
https://groups.google.com/forum/#!searchin/foreman-users/getaddrinfo|sort:relevance/foreman-users/kr7FV_ArDkI/hCSSSchxEAAJ
about it before), but I think it just ‘went away’.

Both Katello servers sit behind Corporate firewalls and use a Corporate
proxy. The local DNS source doesn’t know about public domains (so can’t
help with cdn.redhat.com).

When syncing the existing 2.4 Red Hat repositories, all requests
successfully use the details provided in:

/etc/pulp/server/plugins.conf.d/yum_importer.json

But browsing the Red Hat product list now returns the same cdn.redhat.com
lookup failure as the 3.1 server.

I’ve tried creating a host file entry for one of the public IPs for that
site, but that naturally returns:

Connection refused - connect(2)

As that address is not reachable; this is prevented by the firewalls.

I’ve tried setting the host file entry for cdn.redhat.com to the IP of
the proxy, then added a redirect rule in iptables to send the TCP443
request to the correct port of the proxy, but then I get an SSL error, as
Katello is expecting a different conversation to the one the proxy wants to
have.

From what I can tell, there wouldn’t be a problem if there wasn’t the
initial DNS lookup and this part solely used the json file.

Can anyone help please?

Cheers.

–
You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at https://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

#4

Sean / Andrew,

thank you both for your suggestions/comments.

I did consider specifying those options with the installer, but my (mis)
understanding <https://access.redhat.com/solutions/1122203> was that this
just set those attributes in /etc/pulp/server/plugins.conf.d/*.json (which
I had done manually after install) However, I then found this
<https://access.redhat.com/discussions/1348283> discussion, which reminded
me about /etc/foreman/plugins/katello.yaml. That thread suggest that both
sets of files should be modified when using the installer, but I found that
only the json files were changed in my case.

For the record I ran:

$ foreman-installer --scenario katello --katello-proxy-port 3128
–katello-proxy-url http://127.0.0.1

[ I use squid to route repo sync traffic; we have internal and external
repositories, the latter being passed to the Corporate proxies ]

So with katello.yaml updated:

:cdn_proxy:

:host: http://127.0.0.1

:port: 3128

:user:

:password:

It now works. Thanks again.

··· On 15 November 2016 at 20:41, Sean O'Keeffe wrote:

Have you set these options using foreman-installer?

--katello-proxy-password      Proxy password for authentication

(default: nil)
–katello-proxy-port Port the proxy is running on (default:
nil)
–katello-proxy-url URL of the proxy server (default: nil)
–katello-proxy-username Proxy username for authentication
(default: nil)

On Tue, Nov 15, 2016 at 10:23 AM, JC mr.jamie.caldwell@gmail.com wrote:

I have previously imported (the manifest) and used Red Hat products in
Katello 2.4.*. I’ve recently built a Katello 3.1 server and would like to
do the same.

The manifest imports, but trying to select products returns:

getaddrinfo: Temporary failure in name resolution

I’ve seen this before (and in fact asked
https://groups.google.com/forum/#!searchin/foreman-users/getaddrinfo|sort:relevance/foreman-users/kr7FV_ArDkI/hCSSSchxEAAJ
about it before), but I think it just ‘went away’.

Both Katello servers sit behind Corporate firewalls and use a Corporate
proxy. The local DNS source doesn’t know about public domains (so can’t
help with cdn.redhat.com).

When syncing the existing 2.4 Red Hat repositories, all requests
successfully use the details provided in:

/etc/pulp/server/plugins.conf.d/yum_importer.json

But browsing the Red Hat product list now returns the same cdn.redhat.com
lookup failure as the 3.1 server.

I’ve tried creating a host file entry for one of the public IPs for that
site, but that naturally returns:

Connection refused - connect(2)

As that address is not reachable; this is prevented by the firewalls.

I’ve tried setting the host file entry for cdn.redhat.com to the IP of
the proxy, then added a redirect rule in iptables to send the TCP443
request to the correct port of the proxy, but then I get an SSL error, as
Katello is expecting a different conversation to the one the proxy wants to
have.

From what I can tell, there wouldn’t be a problem if there wasn’t the
initial DNS lookup and this part solely used the json file.

Can anyone help please?

Cheers.

–
You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at https://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.

–
You received this message because you are subscribed to a topic in the
Google Groups “Foreman users” group.
To unsubscribe from this topic, visit https://groups.google.com/d/
topic/foreman-users/KM4CsFsDjZk/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at https://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.