<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-GB" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> <p class="MsoNormal">Hi Phil<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">The answer is staring you in the face in red: the RHEL repos use a certificate which your system doesn’t trust. You’ll need to fetch a copy of the cert and install it into your appropriate PKI tools on the Spacewalk server (part of the OS, not Spacewalk) to allow it to trust the certificate.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">You’re very much not the only person to have raised this on this mailing list – a check of the archives might help you!<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">Graeme<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><o:p> </o:p></p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black"><spacewalk-list-bounces@redhat.com> on behalf of "P.Cookson@bham.ac.uk" <P.Cookson@bham.ac.uk><br> <b>Reply-To: </b>"spacewalk-list@redhat.com" <spacewalk-list@redhat.com><br> <b>Date: </b>Tuesday, 11 December 2018 at 16:39<br> <b>To: </b>"spacewalk-list@redhat.com" <spacewalk-list@redhat.com><br> <b>Subject: </b>Re: [Spacewalk-list] [EXTERNAL] Spacewalk 2.8 - Patching RHEL 6/7 Servers<o:p></o:p></span></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <p class="MsoNormal"><span style="color:#1F497D">Hi Jeffrey</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">I haven’t had much success patching RHEL systems with my original proof of concept (PoC) environment that had Spacewalk 2.8 installed on an <b>OEL</b> 7 server.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">I’ve therefore, created a 2<sup>nd</sup> PoC environment with Spacewalk 2.8 installed on a <b>RHEL</b> 7 server, as you’ve described. I’ve left the RHEL 7 server repo (rhel-7-server-rpms) with its default configuration, as you have below, but when I try and sync I see the following error:</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">[root@<server name> yum.repos.d]# <b>cat /var/log/rhn/reposync/rhel7_x86_64.log</b></span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">2018/12/11 15:50:42 +01:00 Command: ['/usr/bin/spacewalk-repo-sync', '--channel', 'rhel7_x86_64', '--type', 'yum']</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">2018/12/11 15:50:42 +01:00 Sync of channel started.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">2018/12/11 15:50:42 +01:00</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">2018/12/11 15:50:42 +01:00 Processing repository with URL: </span><span style="color:red">https://cdn.redhat.com/content/dist/rhel/server/7/$releasever/$basearch/os</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:red">2018/12/11 15:50:43 +01:00 ERROR: failure: repodata/repomd.xml from rhel7_x86_64: [Errno 256] No more mirrors to try.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:red">https://cdn.redhat.com/content/dist/rhel/server/7/$releasever/$basearch/os/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's certificate issuer has been marked as not trusted by the user."</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:red">2018/12/11 15:50:43 +01:00 ERROR: failure: repodata/repomd.xml from rhel7_x86_64: [Errno 256] No more mirrors to try.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:red">https://cdn.redhat.com/content/dist/rhel/server/7/$releasever/$basearch/os/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's certificate issuer has been marked as not trusted by the user."</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:red">2018/12/11 15:50:43 +01:00 Sync of channel completed in 0:00:00.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">[root@<server name>yum.repos.d]#</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">Did you perform some additional configuration perhaps/any ideas? Might be useful if you could forward a screen dump of your channel/repo setup screen for RHEL 7, from the Web UI, too?</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">Regards</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">Phil</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> spacewalk-list-bounces@redhat.com <spacewalk-list-bounces@redhat.com> <b>On Behalf Of </b>Jeffrey.Irwin@rivertechllc.com<br> <b>Sent:</b> 27 November 2018 14:21<br> <b>To:</b> spacewalk-list@redhat.com<br> <b>Subject:</b> Re: [Spacewalk-list] [EXTERNAL] Spacewalk 2.8 - Patching RHEL 6/7 Servers</span><o:p></o:p></p> </div> </div> <p class="MsoNormal"> <o:p></o:p></p> <p><span style="font-family:"Calibri",sans-serif;color:black">RHEL 6 (my mirror repo) pulling from RH</span><o:p></o:p></p> <p><span style="font-family:"Calibri",sans-serif;color:black"> </span><o:p></o:p></p> <div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">[rhel-6-server-rpms]</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">metadata_expire = 86400</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslclientcert = /etc/pki/entitlement/3922910052842520258.pem</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">baseurl = <a href="https://cdn.redhat.com/content/dist/rhel/server/6/$releasever/$basearch/os"> https://cdn.redhat.com/content/dist/rhel/server/6/$releasever/$basearch/os</a></span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">ui_repoid_vars = releasever basearch</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslverify = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">name = Red Hat Enterprise Linux 6 Server (RPMs)</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslclientkey = /etc/pki/entitlement/3922910052842520258-key.pem</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">gpgkey = <a href="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"> file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release</a></span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">enabled = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslcacert = /etc/rhsm/ca/redhat-uep.pem</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">gpgcheck = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"><br> Spacewalk pulling from mirror (above)</span><o:p></o:p></p> </div> <div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">[rhel-6-server-rpms]</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">name = Red Hat Enterprise Linux 6 Server (RPMs)</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">baseurl = <a href="https://xxx.xxx.xxx.xxx/rhel-6-server-rpms/"> https://xxx.xxx.xxx.xxx/rhel-6-server-rpms/</a></span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">enabled = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">gpgcheck = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">gpgkey = <a href="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"> file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release</a></span><o:p></o:p></p> </div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">RHEL 7</span><o:p></o:p></p> </div> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p> </div> <div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">[rhel-7-server-rpms]</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">metadata_expire = 86400</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslclientcert = /etc/pki/entitlement/redhat.pem</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">baseurl = <a href="https://cdn.redhat.com/content/dist/rhel/server/7/$releasever/$basearch/os"> https://cdn.redhat.com/content/dist/rhel/server/7/$releasever/$basearch/os</a></span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">ui_repoid_vars = releasever basearch</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslverify = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">name = Red Hat Enterprise Linux 7 Server (RPMs)</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslclientkey = /etc/pki/entitlement/redhat-key.pem</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">gpgkey = <a href="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"> file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release</a></span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">enabled = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">sslcacert = /etc/rhsm/ca/redhat-uep.pem</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black">gpgcheck = 1</span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p> </div> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:black"><br> </span><o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p> </div> <p><span style="font-family:"Calibri",sans-serif;color:black"> </span><o:p></o:p></p> <div> <div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;color:#212121"> <hr size="2" width="98%" align="center"> </span></div> <div id="divRplyFwdMsg"> <p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> <a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a> <<a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a>> on behalf of <a href="mailto:P.Cookson@bham.ac.uk">P.Cookson@bham.ac.uk</a> <<a href="mailto:P.Cookson@bham.ac.uk">P.Cookson@bham.ac.uk</a>><br> <b>Sent:</b> Tuesday, November 27, 2018 4:16 AM<br> <b>To:</b> <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a><br> <b>Subject:</b> Re: [Spacewalk-list] [EXTERNAL] Spacewalk 2.8 - Patching RHEL 6/7 Servers</span><span style="font-size:12.0pt;color:#212121"> </span><o:p></o:p></p> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:#212121"> </span><o:p></o:p></p> </div> </div> <div> <div> <p class="MsoNormal"><span style="color:#1F497D">Hi Jeffrey</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">Thanks for your reply. It seems I would have been better off by starting with installing Spacewalk on a RHEL 7 server rather than an OL 7 server then? Can you just clarify/confirm what URL’s you’ve configured for the RHEL 6/7 repositories please (obviously, for the RHEL 6 local, just take out any sensitive information)?</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">Regards</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D">Phil</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span lang="EN-US" style="color:#212121">From:</span></b><span lang="EN-US" style="color:#212121"> <a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a> <<a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a>> <b>On Behalf Of </b><a href="mailto:Jeffrey.Irwin@rivertechllc.com">Jeffrey.Irwin@rivertechllc.com</a><br> <b>Sent:</b> 26 November 2018 19:58<br> <b>To:</b> <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a><br> <b>Subject:</b> Re: [Spacewalk-list] [EXTERNAL] Spacewalk 2.8 - Patching RHEL 6/7 Servers</span><o:p></o:p></p> </div> </div> <p class="MsoNormal"><span style="color:#212121"> </span><o:p></o:p></p> <p><span style="font-family:"Calibri",sans-serif;color:black">I have been able to do this by building a rhel 6 server and creating a local repo mirror. I then created a rhel 7 and installed spacewalk. That way i have the entitlements for rhel 6 and 7 covered. From there, I set up the channels and pointed the rhel 7 to the redhat network, and the rhel 6 was pointed to my local repo server. I can now get all the rhel 6 and 7 patches into spacewalk.</span><o:p></o:p></p> <div> <div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;color:#212121"> <hr size="2" width="98%" align="center"> </span></div> <div id="divRplyFwdMsg"> <p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> <a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a> <<a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a>> on behalf of <a href="mailto:P.Cookson@bham.ac.uk">P.Cookson@bham.ac.uk</a> <<a href="mailto:P.Cookson@bham.ac.uk">P.Cookson@bham.ac.uk</a>><br> <b>Sent:</b> Monday, November 26, 2018 7:20 AM<br> <b>To:</b> <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a><br> <b>Subject:</b> [EXTERNAL] [Spacewalk-list] Spacewalk 2.8 - Patching RHEL 6/7 Servers</span><span style="font-size:12.0pt;color:#212121"> </span><o:p></o:p></p> <div> <p class="MsoNormal"><span style="font-size:12.0pt;color:#212121"> </span><o:p></o:p></p> </div> </div> <div> <div> <p class="MsoNormal"><span style="color:#212121">Good afternoon</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121">I’m currently looking in to options for introducing a single centralised patching solution for both Oracle Linux 6/7 and RHEL 6/7 systems. There are about 100 Oracle Linux servers and 50 RHEL servers. I’m starting with the Spacewalk product and therefore, built a proof of concept environment by installing Spacewalk 2.8 on an Oracle 7 system. Subsequently, I’ve added channels/repositories for Oracle 6/7 and successfully patched a number of test client systems.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121">However, I can’t seem to obtain clear instructions for how to patch RHEL 6/7 systems using Spacewalk. I believe the functionality of Red Hat Satellite and Spacewalk is basically the same but the ability to connect directly to RHN to synchronize software repositories and errata's has been disabled. I’ve seen some tentative clues that this can be circumvented as well as some reference to using “mrepo” but the latter just seems over complicated really.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121">Alternatively, if Red Hat Satellite is purchased to patch the RHEL 6/7 servers, has anyone had success with using it to patch Oracle 6/7 servers?</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121">In addition to patching, I also need to investigate their provisioning capabilities too.</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121"> </span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121">Regards</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121">Phil</span><o:p></o:p></p> <p class="MsoNormal"><span style="color:#212121"> </span><o:p></o:p></p> </div> </div> </div> </div> </div> </div> </div> </body> </html>