6 Installation with YaST #

After having selected the installation medium, determine the suitable installation method and boot option that best matches your needs:

The way the system is started for the installation depends on the architecture—system start-up is different for PC (AMD64/Intel 64) or mainframe, for example. If you install SUSE Linux Enterprise Server as a VM Guest on a KVM or Xen hypervisor, follow the instructions for the AMD64/Intel 64 architecture.

6.2.2 PC (AMD64/Intel 64/Arm AArch64): System Start-up #

  

SUSE Linux Enterprise Server supports several boot options from which you can choose, depending on the hardware available and on the installation scenario you prefer. Booting from the SUSE Linux Enterprise Server media is the most straightforward option, but special requirements might call for special setups:

Table 6.1: Boot Options #

  

Boot Option	Description
DVD	This is the easiest boot option. This option can be used if the system has a local DVD-ROM drive that is supported by Linux.
Flash Disks (USB Mass Storage Device)	In case your machine is not equipped with an optical drive, you can boot the installation image from a flash disk. To create a bootable flash disk, you need to copy either the DVD or the Mini CD ISO image to the device using the dd command (the flash disk must not be mounted, all data on the device will be erased): dd if=PATH_TO_ISO_IMAGE of=USB_STORAGE_DEVICE bs=4M Important: Compatibility Note that booting from a USB Mass Storage Device is not supported on UEFI machines and on the POWER architecture.
PXE or BOOTP	Booting over the network must be supported by the system's BIOS or firmware, and a boot server must be available in the network. This task can also be handled by another SUSE Linux Enterprise Server system. Refer to Chapter 11, Remote Installation for more information.
Hard Disk	SUSE Linux Enterprise Server installation can also be booted from the hard disk. To do this, copy the kernel (linux) and the installation system (initrd) from the directory /boot/ARCHITECTURE/ on the installation media to the hard disk and add an appropriate entry to the existing boot loader of a previous SUSE Linux Enterprise Server installation.

Tip: Booting from DVD on UEFI Machines

DVD1 can be used as a boot medium for machines equipped with UEFI (Unified Extensible Firmware Interface). Refer to your vendor's documentation for specific information. If booting fails, try to enable CSM (Compatibility Support Module) in your firmware.

Note: Add-on Product Installation Media

Media for add-on products (extensions or third-party products) cannot be used as stand-alone installation media. They can either be embedded as additional installation sources during the installation process (see Section 6.9, “Extension Selection”) or be installed from the running system using the YaST Add-on Products module (see Chapter 15, Installing Modules, Extensions, and Third Party Add-On Products for details).

6.2.2.1 The Boot Screen on Machines Equipped with Traditional BIOS #

  

The boot screen displays several options for the installation procedure. Boot from Hard Disk boots the installed system and is selected by default, because the CD is often left in the drive. Select one of the other options with the arrow keys and press Enter to boot it. The relevant options are:

Installation

The normal installation mode. All modern hardware functions are enabled. In case the installation fails, see F5Kernel for boot options that disable potentially problematic functions.

Upgrade

Perform a system upgrade. For more information refer to Chapter 20, Upgrading SUSE Linux Enterprise.

Rescue System

Starts a minimal Linux system without a graphical user interface. For more information, see Section 42.6.2, “Using the Rescue System”.

Check Installation Media

This option is only available when you install from media created from downloaded ISOs. In this case it is recommended to check the integrity of the installation medium. This option starts the installation system before automatically checking the media. In case the check was successful, the normal installation routine starts. If a corrupt media is detected, the installation routine aborts.

Warning: Failure of Media Check

If the media check fails, your medium is damaged. Do not continue the installation because installation may fail or you may lose your data. Replace the broken medium and restart the installation process.

Memory Test

Tests your system RAM using repeated read and write cycles. Terminate the test by rebooting. For more information, see Section 42.2.4, “Fails to Boot”.

Figure 6.1: The Boot Screen on Machines with a Traditional BIOS #

  

Use the function keys shown at the bottom of the screen to change the language, screen resolution, installation source or to add an additional driver from your hardware vendor:

F1Help

Get context-sensitive help for the active element of the boot screen. Use the arrow keys to navigate, Enter to follow a link, and Esc to leave the help screen.

F2Language

Select the display language and a corresponding keyboard layout for the installation. The default language is English (US).

F3Video Mode

Select various graphical display modes for the installation. By Default the video resolution is automatically determined using KMS (“Kernel Mode Setting”). If this setting does not work on your system, choose No KMS and, optionally, specify vga=ask on the boot command line to get prompted for the video resolution. Choose Text Mode if the graphical installation causes problems.

F4Source

Normally, the installation is performed from the inserted installation medium. Here, select other sources, like FTP or NFS servers. If the installation is deployed on a network with an SLP server, select an installation source available on the server with this option. Find information about setting up an installation server with SLP at Chapter 8, Setting Up the Server Holding the Installation Sources.

F5Kernel

If you encounter problems with the regular installation, this menu offers to disable a few potentially problematic functions. If your hardware does not support ACPI (advanced configuration and power interface) select No ACPI to install without ACPI support. No local APIC disables support for APIC (Advanced Programmable Interrupt Controllers) which may cause problems with some hardware. Safe Settings boots the system with the DMA mode (for CD/DVD-ROM drives) and power management functions disabled.

If you are not sure, try the following options first: Installation—ACPI Disabled or Installation—Safe Settings. Experts can also use the command line (Boot Options) to enter or change kernel parameters.

F6Driver

Press this key to notify the system that you have an optional driver update for SUSE Linux Enterprise Server. With File or URL, load drivers directly before the installation starts. If you select Yes, you are prompted to insert the update disk at the appropriate point in the installation process.

Tip: Getting Driver Update Disks

Driver updates for SUSE Linux Enterprise are provided at http://drivers.suse.com/. These drivers have been created via the SUSE SolidDriver Program.

6.2.2.2 The Boot Screen on Machines Equipped with UEFI #

  

UEFI (Unified Extensible Firmware Interface) is a new industry standard which replaces and extends the traditional BIOS. The latest UEFI implementations contain the “Secure Boot” extension, which prevents booting malicious code by only allowing signed boot loaders to be executed. See Chapter 12, UEFI (Unified Extensible Firmware Interface) for more information.

The boot manager GRUB 2, used to boot machines with a traditional BIOS, does not support UEFI, therefore GRUB 2 is replaced with GRUB 2 for EFI. If Secure Boot is enabled, YaST will automatically select GRUB 2 for EFI for installation. From an administrative and user perspective, both boot manager implementations behave the same and are called GRUB 2 in the following.

Tip: UEFI and Secure Boot are Supported by Default

The installation routine of SUSE Linux Enterprise Server automatically detects if the machine is equipped with UEFI. All installation sources also support Secure Boot. If an EFI system partition already exists on dual boot machines (from a Microsoft Windows 8 installation, for example), it will automatically be detected and used. Partition tables will be written as GPT on UEFI systems.

Warning: Using Non-Inbox Drivers with Secure Boot

There is no support for adding non-inbox drivers (that is, drivers that do not come with SLE) during installation with Secure Boot enabled. The signing key used for SolidDriver/PLDP is not trusted by default.

To solve this problem, it is necessary to either add the needed keys to the firmware database via firmware/system management tools before the installation or to use a bootable ISO that will enroll the needed keys in the MOK list at first boot. For more information, see Section 12.1, “Secure Boot”.

The boot screen displays several options for the installation procedure. Change the selected option with the arrow keys and press Enter to boot it. The relevant options are:

Installation

The normal installation mode.

Upgrade

Perform a system upgrade. For more information refer to Chapter 20, Upgrading SUSE Linux Enterprise.

Rescue System

Starts a minimal Linux system without a graphical user interface. For more information, see Section 42.6.2, “Using the Rescue System”.

Check Installation Media

This option is only available when you install from media created from downloaded ISOs. In this case it is recommended to check the integrity of the installation medium. This option starts the installation system before automatically checking the media. In case the check was successful, the normal installation routine starts. If a corrupt media is detected, the installation routine aborts.

Figure 6.2: The Boot Screen on Machines with UEFI #

  

GRUB 2 for EFI on SUSE Linux Enterprise Server does not support a boot prompt or function keys for adding boot parameters. By default, the installation will be started with American English and the boot media as the installation source. A DHCP lookup will be performed to configure the network. To change these defaults or to add additional boot parameters you need to edit the respective boot entry. Highlight it using the arrow keys and press E. See the on-screen help for editing hints (note that only an English keyboard is available now). The Installation entry will look similar to the following:

setparams 'Installation'

    set gfxpayload=keep
    echo 'Loading kernel ...'
    linuxefi /boot/x86_64/loader/linux splash=silent
    echo 'Loading initial ramdisk ...'
    initrdefi /boot/x86_64/loader/initrd

Add space-separated parameters to the end of the line starting with linuxefi. To boot the edited entry, press F10. If you access the machine via serial console, press Esc–0. A complete list of parameters is available at http://en.opensuse.org/Linuxrc. The most important ones are:

Table 6.2: Installation Sources #

  

CD/DVD (default)	install=cd:/
Hard disk	install=hd:/?device=sda/PATH_TO_ISO
SLP	install=slp:/
FTP	install=ftp://ftp.example.com/PATH_TO_ISO
HTTP	install=http://www.example.com/PATH_TO_ISO
NFS	install=nfs:/PATH_TO_ISO
SMB / CIFS	install=smb://PATH_TO_ISO

Table 6.3: Network Configuration #

  

DHCP (default)	netsetup=dhcp
Prompt for Parameters	netsetup=hostip,netmask,gateway,nameserver
Host IP address	hostip=192.168.2.100 hostip=192.168.2.100/24
Netmask	netmask=255.255.255.0
Gateway	gateway=192.168.5.1
Name Server	nameserver=192.168.1.116 nameserver=192.168.1.116,192.168.1.118
Domain Search Path	domain=example.com

Table 6.4: Miscellaneous #

  

Driver Updates: Prompt	dud=1
Driver Updates: URL	dud=ftp://ftp.example.com/PATH_TO_DRIVER dud=http://www.example.com/PATH_TO_DRIVER
Installation Language	Language=LANGUAGE Supported values for LANGUAGE are, among others, cs_CZ, de_DE, es_ES, fr_FR, ja_JP, pt_BR, pt_PT, ru_RU, zh_CN, and zh_TW.
Kernel: No ACPI	acpi=off
Kernel: No Local APIC	noapic
Video: Disable KMS	nomodeset
Video: Start Installer in Text Mode	Textmode=1

6.2.3 Boot Parameters for Advanced Setups #

  

To configure access to a local SMT or supportconfig server for the installation, you can specify boot parameters to set up these services during installation. The same applies if you need IPv6 support during the installation.

6.2.3.1 Providing Data to Access an SMT Server #

  

By default, updates for SUSE Linux Enterprise Server are delivered by the SUSE Customer Center. If your network provides a so called SMT server to provide a local update source, you need to equip the client with the server's URL. Client and server communicate solely via HTTPS protocol, therefore you also need to enter a path to the server's certificate if the certificate was not issued by a certificate authority.

Note: Non-Interactive Installation Only

Providing parameters for accessing an SMT server is only needed for non-interactive installations. During an interactive installation the data can be provided during the installation (see Section 6.8, “SUSE Customer Center Registration” for details).

regurl

URL of the SMT server. This URL has a fixed format https://FQN/center/regsvc/. FQN needs to be a fully qualified host name of the SMT server. Example:

regurl=https://smt.example.com/center/regsvc/

regcert

Location of the SMT server's certificate. Specify one of the following locations:

URL

Remote location (HTTP, HTTPS or FTP) from which the certificate can be downloaded. Example:

regcert=http://smt.example.com/smt-ca.crt

local path

Absolute path to the certificate on the local machine. Example:

regcert=/data/inst/smt/smt-ca.cert

Interactive

Use ask to open a pop-up menu during the installation where you can specify the path to the certificate. Do not use this option with AutoYaST. Example

regcert=ask

Deactivate certificate installation

Use done if the certificate will be installed by an add-on product, or if you are using a certificate issued by an official certificate authority. For example:

regcert=done

Warning: Beware of Typing Errors

Make sure the values you enter are correct. If regurl has not been specified correctly, the registration of the update source will fail. If a wrong value for regcert has been entered, you will be prompted for a local path to the certificate.

In case regcert is not specified, it will default to http://FQN/smt.crt with FQN being the name of the SMT server.

6.2.3.2 Configuring an Alternative Data Server for supportconfig #

  

The data that supportconfig (see Chapter 41, Gathering System Information for Support for more information) gathers is sent to the SUSE Customer Center by default. It is also possible to set up a local server to collect this data. If such a server is available on your network, you need to set the server's URL on the client. This information needs to be entered at the boot prompt.

supporturl.  URL of the server. The URL has the format http://FQN/Path/, where FQN is the fully qualified host name of the server and Path is the location on the server. For example:

supporturl=http://support.example.com/supportconfig/data/

6.2.3.3 Using IPv6 During the Installation #

  

By default you can only assign IPv4 network addresses to your machine. To enable IPv6 during installation, enter one of the following parameters at the boot prompt:

Accept IPv4 and IPv6

ipv6=1

Accept IPv6 only

ipv6only=1

6.2.3.4 Using a Proxy for the Installation #

  

In networks enforcing the usage of a proxy server for accessing remote web sites, registration during installation is only possible when configuring a proxy server.

On systems with traditional BIOS, press F4 on the boot screen and set the required parameters in the HTTP Proxy dialog.

On Systems with UEFI BIOS, provide the boot parameter proxy at the boot prompt:

1. On the boot screen, press E to edit the boot menu.

2. Append the proxy paramter to the linux line in the following format:

   proxy=https://proxy.example.com:PORT

   If the proxy server requires authentication, add the credentials as follows:

   proxy=https://USER:PASSWORD@proxy.example.com:PORT

   If the proxy server's SSL certificate cannot be verified, disable certificate checking with the sslcerts=0 boot parameter.

3. Press F10 to boot with the new proxy setting.

6.2.3.5 Enabling SELinux Support #

  

Enabling SELinux upon installation start-up enables you to configure it after the installation has been finished without having to reboot. Use the following parameters:

security=selinux selinux=1

6.2.3.6 Enabling the Installer Self-Update #

  

During installation and upgrade, YaST can update itself as described in Section 6.4, “Installer Self-Update” to solve potential bugs discovered after release. The self_update parameter can be used to modify the behavior of this feature.

To enable the installer self-update, set the parameter to 1:

self_update=1

To use a user-defined repository, specify a URL:

self_update=https://updates.example.com/

6.2.3.7 Using CPU Mitigations #

  

The boot parameter mitigations lets you control mitigation options for side-channel attacks on affected CPUs. Its possible values are:

auto.  Enables all mitigations required for your CPU model, but does not protect against cross-CPU thread attacks. This setting may impact performance to some degree, depending on the workload.

nosmt.  Provides the full set of available security mitigations. Enables all mitigations required for your CPU model. In addition, it disables Simultaneous Multithreading (SMT) to avoid side-channel attacks across multiple CPU threads. This setting may further impact performance, depending on the workload.

off.  Disables all mitigations. Side-channel attacks against your CPU are possible, depending on the CPU model. This setting has no impact on performance.

Each value comes with a set of specific parameters, depending on the CPU architecture, the kernel version, and on the vulnerabilities that need to be mitigated. Refer to the kernel documentation for details.

The interactive installation of SUSE Linux Enterprise Server split into several steps is listed below.

After starting the installation, SUSE Linux Enterprise Server loads and configures a minimal Linux system to run the installation procedure. To view the boot messages and copyright notices during this process, press Esc. On completion of this process, the YaST installation program starts and displays the graphical installer.

Tip: Installation Without a Mouse

If the installer does not detect your mouse correctly, use →| for navigation, arrow keys to scroll, and Enter to confirm a selection. Various buttons or selection fields contain a letter with an underscore. Use Alt–Letter to select a button or a selection directly instead of navigating there with →|.

During the installation and upgrade process, YaST is able to update itself to solve bugs in the installer that were discovered after the release. This functionality is enabled by default; to disable it, set the boot parameter self_update to 0. For more information, see Section 6.2.3.6, “Enabling the Installer Self-Update”.

Although this feature was designed to run without user intervention, it is worth knowing how it works. If you are not interested, you can jump directly to Section 6.5, “Language, Keyboard and License Agreement” and skip the rest of this section.

Tip: Language Selection

The installer self-update is executed before the language selection step. This means that progress and errors which happen during this process are displayed in English by default.

To use another language for this part of the installer, press F2 in the DVD boot menu and select the language from the list. Alternatively, use the language boot parameter (for example, language=de_DE).

6.4.1 Self-Update Process #

  

The process can be broken down into two different parts:

1. Determine the update repository location.

2. Download and apply the updates to the installation system.

6.4.1.1 Determining the Update Repository Location #

  

Installer Self-Updates are distributed as regular RPM packages via a dedicated repository, so the first step is to find out the repository URL.

Important: Installer Self-Update Repository Only

No matter which of the following options you use, only the installer self-update repository URL is expected, for example:

self_update=https://www.example.com/my_installer_updates/

Do not supply any other repository URL—for example the URL of the software update repository.

YaST will try the following sources of information:

1. The self_update boot parameter. (For more details, see Section 6.2.3.6, “Enabling the Installer Self-Update”.) If you specify a URL, it will take precedence over any other method.

2. The /general/self_update_url profile element in case you are using AutoYaST.

3. A registration server. YaST will query the registration server for the URL. The server to be used is determined in the following order:

   1. By evaluating the regurl boot parameter (Section 6.2.3.1, “Providing Data to Access an SMT Server”).

   2. By evaluating the /suse_register/reg_server profile element if you are using AutoYaST.

   3. By performing an SLP lookup. If an SLP server is found, YaST will ask you whether it should be used because there is no authentication involved and everybody on the local network could announce a registration server.

   4. By querying the SUSE Customer Center.

4. If none of the previous attempts worked, the fallback URL (defined in the installation media) will be used.

6.4.1.2 Downloading and Applying the Updates #

  

When the updates repository is determined, YaST will check whether an update is available. If so, all the updates will be downloaded and applied to the installation system.

Finally, YaST will be restarted to load the new version and the welcome screen will be shown. If no updates were available, the installation will continue without restarting YaST.

Note: Update Integrity

Update signatures will be checked to ensure integrity and authorship. If a signature is missing or invalid, you will be asked whether you want to apply the update.

6.4.3 Custom Self-Update Repositories #

  

YaST can use a user-defined repository instead of the official one by specifying a URL through the self_update boot option. However, the following points should be considered:

• Only HTTP/HTTPS and FTP repositories are supported.

• Only RPM-MD repositories are supported (required by SMT).

• Packages are not installed in the usual way: They are uncompressed only and no scripts are executed.

• No dependency checks are performed. Packages are installed in alphabetical order.

• Files from the packages override the files from the original installation media. This means that the update packages might not need to contain all files, only files that have changed. Unchanged files are omitted to save memory and download bandwidth.

Note: Only One Repository

Currently, it is not possible to use more than one repository as source for installer self-updates.

Start the installation of SUSE Linux Enterprise Server by choosing your language. Changing the language will automatically preselect a corresponding keyboard layout. Override this proposal by selecting a different keyboard layout from the drop-down box. The language selected here is also used to assume a time zone for the system clock. This setting can be modified later in the installed system as described in Chapter 18, Changing Language and Country Settings with YaST.

Read the license agreement that is displayed beneath the language and keyboard selection thoroughly. Use License Translations to access translations. If you agree to the terms, check I Agree to the License Terms and click Next to proceed with the installation. If you do not agree to the license agreement, you cannot install SUSE Linux Enterprise Server; click Abort to terminate the installation.

Figure 6.3: Language, Keyboard and License Agreement #

  

When installing on IBM IBM Z platforms, the language selection dialog is followed by a dialog to configure the attached hard disks. Select DASD, Fibre Channel Attached SCSI Disks (zFCP), or iSCSI for installation of SUSE Linux Enterprise Server. The DASD and zFCP configuration buttons are only available if the corresponding devices are attached. For instructions on how to configure iSCSI disks, refer to Section 14.3, “Configuring iSCSI Initiator”.

You can also Change the Network Configuration in this screen by launching the Network Settings dialog. Choose a network interface from the list and click Edit to change its settings. Use the tabs to configure DNS and routing. See Section 17.4, “Configuring a Network Connection with YaST” for more details.

Figure 6.4: Disk Activation #

  

6.6.1 Configuring DASD Disks #

  

After selecting Configure DASD Disks, an overview lists all available DASDs. To get a clearer picture of the available devices, use the text box located above the list to specify a range of channels to display. To filter the list according to such a range, select Filter.

Figure 6.5: IBM IBM Z: Selecting a DASD #

  

Specify the DASDs to use for the installation by selecting the corresponding entries in the list. Use Select All to select all DASDs currently displayed. Activate and make the selected DASDs available for the installation by selecting Perform Action › Activate. To format the DASDs, select Perform Action › Format. Alternatively, use the YaST partitioner later as described in Section 13.1, “Using the YaST Partitioner”.

After booting into the installation, the installation routine is set up. During this setup, an attempt to configure at least one network interface with DHCP is made. In case this attempt fails, the Network Settings dialog launches. Choose a network interface from the list and click Edit to change its settings. Use the tabs to configure DNS and routing. See Section 17.4, “Configuring a Network Connection with YaST” for more details. On IBM IBM Z this dialog does not start automatically. It can be started in the Disk Activation step.

In case DHCP was successfully configured during installation setup, you can also access this dialog by clicking Network Configuration at the SUSE Customer Center Registration step. It lets you change the automatically provided settings.

Note: Network Interface Configured via linuxrc

If at least one network interface is configured via linuxrc, automatic DHCP configuration is disabled and configuration from linuxrc is imported and used.

Figure 6.6: Network Settings #

  

Tip: Accessing Network Storage or Local RAID

To access a SAN or a local RAID during the installation, you can use the libstorage command line client for this purpose:

1. Switch to a console with Ctrl–Alt–F2.

2. Install the libstoragemgmt extension by running extend libstoragemgmt.

3. Now you have access to the lsmcli command. For more information, run lsmcli --help.

4. To return to the installer, press Alt–F7

Supported are Netapp Ontap, all SMI-S compatible SAN providers, and LSI MegaRAID.

To get technical support and product updates, you need to register and activate your product with the SUSE Customer Center. Registering SUSE Linux Enterprise Server now grants you immediate access to the update repository. This enables you to install the system with the latest updates and patches available. If you are offline or want to skip this step, select Skip Registration. You can register your system at any time later from the installed system.

Note: Network Configuration

After booting into the installation, the installation routine is set up. During this setup, an attempt to configure all network interfaces with DHCP is made. If DHCP is not available or you want to modify the network configuration, click Network Configuration in the upper right corner of the SUSE Customer Center Registration screen. The YaST module Network Settings opens. See Section 17.4, “Configuring a Network Connection with YaST” for details.

Figure 6.7: SUSE Customer Center Registration #

  

To register your system, provide the E-mail address associated with the SUSE account you or your organization uses to manage subscriptions. In case you do not have a SUSE account yet, go to the SUSE Customer Center home page (https://scc.suse.com/) to create one.

Enter the Registration Code you received with your copy of SUSE Linux Enterprise Server. YaST can also read registration codes from a USB storage device such as a flash disk. For details, see Section 6.8.1, “Loading Registration Codes from USB Storage”.

Proceed with Next to start the registration process. If one or more local registration servers are available on your network, you can choose one of them from a list. By default, SUSE Linux Enterprise Server is registered at the SUSE Customer Center. If your local registration server was not discovered automatically, choose Cancel, select Register System via local SMT Server and enter the URL of the server. Restart the registration by choosing Next again.

During the registration, the online update repositories will be added to your installation setup. When finished, you can choose whether to install the latest available package versions from the update repositories. This ensures that SUSE Linux Enterprise Server is installed with the latest security updates available. If you choose No, all packages will be installed from the installation media. Proceed with Next.

If the system was successfully registered during installation, YaST will disable repositories from local installation media such as CD/DVD or flash disks when the installation has been completed. This prevents problems if the installation source is no longer available and ensures that you always get the latest updates from the online repositories.

Tip: Release Notes

From this point on, the Release Notes can be viewed from any screen during the installation process by selecting Release Notes.

6.8.1 Loading Registration Codes from USB Storage #

  

To make the registration more convenient, you can also store your registration codes on a USB storage device such as a flash disk. YaST will automatically pre-fill the corresponding text box. This is particularly useful when testing the installation or if you need to register many systems or extensions.

Note: Limitations

Currently flash disks are only scanned during installation or upgrade, but not when registering a running system.

Create a file named regcodes.txt or regcodes.xml on the USB disk. If both are present, the XML takes precedence.

In that file, identify the product with the name returned by zypper search --type product and assign it a registration code as follows:

Example 6.1: regcodes.txt #

  

SLES    cc36aae1
SLED    309105d4

sle-we  5eedd26a
sle-live-patching 8c541494

Example 6.2: regcodes.xml #

  

<?xml version="1.0"?>
<profile xmlns="http://www.suse.com/1.0/yast2ns"
 xmlns:config="http://www.suse.com/1.0/configns">
  <suse_register>
    <addons config:type="list">
      <addon>
<name>SLES</name>
<reg_code>cc36aae1</reg_code>
      </addon>
      <addon>
<name>SLED</name>
<reg_code>309105d4</reg_code>
      </addon>
      <addon>
<name>sle-we</name>
<reg_code>5eedd26a</reg_code>
      </addon>
      <addon>
<name>sle-live-patching</name>
<reg_code>8c541494</reg_code>
      </addon>
    </addons>
  </suse_register>
</profile>

Note that SLES and SLED are not extensions, but listing them as add-ons allows for combining several base product registration codes in a single file. See Section 4.3.1, “Extensions” for details.

If you have successfully registered your system in the previous step, a list of available modules and extensions based on SUSE Linux Enterprise Server is shown. Otherwise this configuration step is skipped. It is also possible to add modules and extensions from the installed system, see Chapter 15, Installing Modules, Extensions, and Third Party Add-On Products for details.

The list contains free modules for SUSE Linux Enterprise Server, such as the SUSE Linux Enterprise SDK and extensions requiring a registration key that is liable for costs. Click an entry to see its description. Select a module or extension for installation by activating its check mark. This will add its repository from the SUSE Customer Center server to your installation—no additional installation sources are required. Furthermore the installation pattern for the module or extension is added to the default installation to ensure it gets installed automatically.

The amount of available extensions and modules depends on the registration server. A local registration server may only offer update repositories and no additional extensions.

Tip: Modules

Modules are fully supported parts of SUSE Linux Enterprise Server with a different life cycle. They have a clearly defined scope and are delivered via online channel only. Registering at the SUSE Customer Center is a prerequisite for being able to subscribe to these channels.

Tip: SUSE Linux Enterprise Desktop

As of SUSE Linux Enterprise 12, SUSE Linux Enterprise Desktop is not only available as a separate product, but also as a workstation extension for SUSE Linux Enterprise Server. If you register at the SUSE Customer Center, the SUSE Linux Enterprise Workstation Extension can be selected for installation. Note that installing it requires a valid registration key.

Figure 6.8: Extension Selection #

  

Proceed with Next to the Add-on Product dialog, where you can specify sources for additional add-on products not available on the registration server.

If you do not want to install add-ons, proceed with Next. Otherwise activate I would like to install an additional Add-on Product. Specify the Media Type by choosing from CD, DVD, Hard Disk, USB Mass Storage, a Local Directory or a Local ISO Image. If network access has been configured you can choose from additional remote sources such as HTTP, SLP, FTP, etc. Alternatively you may directly specify a URL. Check Download Repository Description Files to download the files describing the repository now. If deactivated, they will be downloaded after the installation starts. Proceed with Next and insert a CD or DVD if required.

Depending on the add-on's content, it may be necessary to accept additional license agreements. If you have chosen an add-on product requiring a registration key, you will be asked to enter it at the Extension and Module Registration Codes page. Proceed with Next.

Figure 6.9: Add-on Product #

  

Tip: “No Registration Key” Error

If you have chosen a product in the Extension Selection dialog for which you do not have a valid registration key, choose Back until you see the Extension Selection dialog. Deselect the module or extension and proceed with Next. Modules or extensions can also be installed at any time later from the running system as described in Chapter 15, Installing Modules, Extensions, and Third Party Add-On Products.

SUSE Linux Enterprise Server supports a broad range of features. To simplify the installation, YaST offers predefined use cases which adjust the system to be installed so it is tailored for the selected scenario. Currently this affects the package set and the suggested partitioning scheme.

Choose the System Role that meets your requirements best:

Figure 6.10: System Role Selection #

  

Define a partition setup for SUSE Linux Enterprise Server in this step. Depending on the system role, the installer creates a proposal for one of the disks available. All proposals contain a root partition formatted with Btrfs (with snapshots enabled) and a swap partition. If you have chosen the system role Default System in the previous step, a home partition formatted with XFS will be created, too. On hard disks smaller than 20 GB the proposal does not include a separate home partition. If one or more swap partitions have been detected on the available hard disks, these existing ones will be used (rather than proposing a new swap partition). You have several options to proceed:

Warning: IBM IBM Z: LVM Root File System

If you configure the system with a root file system on LVM or a software RAID array, you must place /boot on a separate, non-LVM or non-RAID partition, otherwise the system will fail to boot. The recommended size for such a partition is 500 MB and the recommended file system is Ext4.

Note: Supported Software RAID Volumes

Installing to and booting from existing software RAID volumes is supported for Disk Data Format (DDF) volumes and Intel Matrix Storage Manager (IMSM) volumes. IMSM is also known by the following names:

• Intel Rapid Storage Technology

• Intel Matrix Storage Technology

• Intel Application Accelerator / Intel Application Accelerator RAID Edition

Note: Mount Points for FCoE and iSCSI Devices

FCoE and iSCSI devices will appear asynchronously during the boot process. While the initrd guarantees that those devices are set up correctly for the root file system, there are no such guarantees for any other file systems or mount points like /usr. Hence any system mount points like /usr or /var are not supported. To use those devices, ensure correct synchronization of the respective services and devices.

Important: Handling of Windows Partitions in Proposals

In case the disk selected for the suggested partitioning proposal contains a large Windows FAT or NTFS partition, it will automatically be resized to make room for the SUSE Linux Enterprise Server installation. To avoid data loss it is strongly recommended to

• make sure the partition is not fragmented (run a defragmentation program from Windows prior to the SUSE Linux Enterprise Server installation)

• double-check the suggested size for the Windows partition is big enough

• back up your data prior to the SUSE Linux Enterprise Server installation

To adjust the proposed size of the Windows partition, use the Expert Partitioner.

Note: Suggested Partitioning on IBM POWER

The default partitioning setup on IBM POWER suggests to create a special PReP partition (type 41). When the system boots, the firmware looks for a PReP partition in order to load the OS bootloader. Some IBM POWER machines may have booting trouble if the PReP partition is not the first partition on the disk (e.g., /dev/sda1) and if the partition is not placed at the beginning of the disk. An already existing PReP partition is re-used by YaST when making the partitioning proposal. If a PReP partition does no exist yet, then YaST will propose to create a new one as the first partition on the disk. In case the PReP partition reused for the suggested partitioning is not the first partition placed at beginning of the disk, the partitioning setup will require to be manually adapted. Follow these steps in order to ensure the PReP partition is correctly created:

• Select the Expert Partitioner option.

• Delete all partitions from the disk you want to use for the installation.

• Add a new partition to the disk. When entering the partition size, make sure the Start Cylinder field is prefilled with a 0. That indicates the partition is going to be created at the beginning of the disk. In Custom Size enter 8MiB. It will complain because the partition is too small, but simply accept the minimum size it proposes. Note that the partition will be automatically resized later. In the next dialog, select PReP in the partition type selector.

• Add other partitions (e.g., for root and swap), and proceed with the installation.

Figure 6.11: Partitioning #

  

In this dialog, select your region and time zone. Both are preselected according to the installation language. To change the preselected values, either use the map or the drop-down boxes for Region and Time Zone. When using the map, point the cursor at the rough direction of your region and left-click to zoom. Now choose your country or region by left-clicking. Right-click to return to the world map.

To set up the clock, choose whether the Hardware Clock is Set to UTC. If you run another operating system on your machine, such as Microsoft Windows, it is likely your system uses local time instead. If you run Linux on your machine, set the hardware clock to UTC and have the switch from standard time to daylight saving time performed automatically.

Important: Set the Hardware Clock to UTC

The switch from standard time to daylight saving time (and vice versa) can only be performed automatically when the hardware clock (CMOS clock) is set to UTC. This also applies if you use automatic time synchronization with NTP, because automatic synchronization will only be performed if the time difference between the hardware and system clock is less than 15 minutes.

Since a wrong system time can cause serious problems (missed backups, dropped mail messages, mount failures on remote file systems, etc.), it is strongly recommended to always set the hardware clock to UTC.

Figure 6.12: Clock and Time Zone #

  

POWER, AMD/Intel If a network is already configured, you can configure time synchronization with an NTP server. Click Other Settings to either alter the NTP settings or to Manually set the time. See Chapter 26, Time Synchronization with NTP for more information on configuring the NTP service. When finished, click Accept to continue the installation.

POWER, AMD/Intel If running without NTP configured, consider setting SYSTOHC=no (sysconfig variable) to avoid saving unsynchronized time into the hardware clock.

Note: Time Cannot Be Changed on IBM IBM Z

Since the operating system is not allowed to change time and date directly, the Other Settings option is not available on IBM IBM Z.

Create a local user in this step. After entering the first name and last name, either accept the proposal or specify a new User name that will be used to log in. Only use lowercase letters (a-z), digits (0-9) and the characters . (dot), - (hyphen) and _ (underscore). Special characters, umlauts and accented characters are not allowed.

Finally, enter a password for the user. Re-enter it for confirmation (to ensure that you did not type something else by mistake). To provide effective security, a password should be at least six characters long and consist of uppercase and lowercase letters, number and special characters (7-bit ASCII). Umlauts or accented characters are not allowed. Passwords you enter are checked for weakness. When entering a password that is easy to guess (such as a dictionary word or a name) you will see a warning. It is a good security practice to use strong passwords.

Important: User Name and Password

Remember both your user name and the password because they are needed each time you log in to the system.

If you install SUSE Linux Enterprise Server on a machine with one or more existing Linux installations, YaST allows you to import user data such as user names and passwords. Select Import User Data from a Previous Installation and then Choose Users for import.

If you do not want to configure any local users (for example when setting up a client on a network with centralized user authentication), skip this step by choosing Next and confirming the warning. Network user authentication can be configured at any time later in the installed system; refer to Chapter 17, Managing Users with YaST for instructions.

Figure 6.13: Create New User #

  

Two additional options are available:

If you have not chosen Use this Password for System Administrator in the previous step, you will be prompted to enter a password for the system administrator root. Otherwise, this configuration step is skipped.

Figure 6.14: Password for the System Administrator root #

  

Enter the password for the system administrator root. For verification purposes, the password for root must be entered twice. Do not forget the password as it cannot be retrieved later.

Tip: Passwords and Keyboard Layout

It is recommended to only use US ASCII characters. In case of a system error or when you need to start your system in rescue mode, the keyboard may not be localized.

To change the root password later in the installed system, run YaST and start Security and Users › User and Group Management.

Important: The root User

root is the name of the system administrator or superuser. Its user ID (uid) is 0. Unlike regular users, root account has unlimited privileges.

Do not forget the root password

Only root has the privileges to change the system configuration, install programs, manage users and set up new hardware. To carry out such tasks, the root password is required. Do not forget the password as it cannot be retrieved later.

Do not use the root user for daily work

Logging in as root for daily work is rather risky: Commands from root are usually executed without additional confirmation, so a single mistake can lead to an irretrievable loss of system files. Only use the root account for system administration, maintenance and repair.

Do not rename the root user account

YaST will always name the system administrator root. While it is technically possible to rename the root account, certain applications, scripts or third-party products may rely on the existence of a user called root. While such a configuration always targets individual environments, necessary adjustments could be overwritten by vendor updates, so this becomes an ongoing task, not a one-time setting. This is especially true in very complex setups involving third-party applications, where it needs to be verified with every involved vendor whether a rename of the root account is supported.

As the implications for renaming the root account cannot be foreseen, SUSE does not support renaming the root account.

Usually, the idea behind renaming the root account is to hide it or make it unpredictable. However, /etc/passwd requires 644 permissions for regular users, so any user of the system can retrieve the login name for the user ID 0. For better ways to secure the root account, refer to Section 2.30, “Restricting root Logins” and Section 2.30.3, “Restricting SSH Logins”.

On the last step before the real installation takes place, you can alter installation settings suggested by the installer. To modify the suggestions, click the respective headline. After having made changes to a particular setting, you are always returned to the Installation Settings window, which is updated accordingly.

Figure 6.15: Installation Settings #

  

6.15.1 Software #

  

SUSE Linux Enterprise Server contains several software patterns for various application purposes. Click Software to open the Software Selection and System Tasks screen where you can modify the pattern selection according to your needs. Select a pattern from the list and see a description in the right-hand part of the window. Each pattern contains several software packages needed for specific functions (for example Web and LAMP server or a print server). For a more detailed selection based on software packages to install, select Details to switch to the YaST Software Manager.

You can also install additional software packages or remove software packages from your system at any later time with the YaST Software Manager. For more information, refer to Chapter 14, Installing or Removing Software.

Figure 6.16: Software Selection and System Tasks #

  

Note: Graphical Desktop

By default SUSE Linux Enterprise Server is installed with X Window and the GNOME desktop environment. If you do not need X Window, deselect the two respective patterns in the Software Selection and System Tasks screen. As an alternative to GNOME, the light-weight window manager IceWM can be installed. Select Details from the Software Selection and System Tasks screen and search for icewm.

Tip: IBM IBM Z: Hardware Cryptography Support

The hardware cryptography stack is not installed by default. To install it, select System z HW crypto support in the Software Selection and System Tasks screen.

Tip: Adding Secondary Languages

The language you selected with the first step of the installation will be used as the primary (default) language for the system. You can add secondary languages from within the Software dialog by choosing Details › View › Languages.

6.15.2 Booting #

  

The installer proposes a boot configuration for your system. Other operating systems found on your computer, such as Microsoft Windows or other Linux installations, will automatically be detected and added to the boot loader. However, SUSE Linux Enterprise Server will be booted by default. Normally, you can leave these settings unchanged. If you need a custom setup, modify the proposal according to your needs. For information, see Section 13.3, “Configuring the Boot Loader with YaST”.

Important: Software RAID 1

Booting a configuration where /boot resides on a software RAID 1 device is supported, but it requires to install the boot loader into the MBR (Boot Loader Location › Boot from Master Boot Record). Having /boot on software RAID devices with a level other than RAID 1 is not supported. Also see Chapter 8, Configuring Software RAID for the Root Partition.

6.15.3 Security #

  

The CPU Mitigations refer to kernel boot command line parameters for software mitigations that have been deployed to prevent CPU side-channel attacks. Click the highlighted entry to choose a different option. For details, see CPU Mitigations.

By default SuSEfirewall2 is enabled on all configured network interfaces. To globally disable the firewall for this computer, click Disable (not recommended).

Note: Firewall Settings

If the firewall is activated, all interfaces are configured to be in the “External Zone”, where all ports are closed by default, ensuring maximum security. The only port you can open during the installation is port 22 (SSH), to allow remote access. All other services requiring network access (such as FTP, Samba, Web server, etc.) will only work after having adjusted the firewall settings. Refer to Chapter 16, Masquerading and Firewalls for more information.

To enable remote access via the secure shell (SSH), make sure the SSH service is enabled and the SSH port is open.

Tip: Existing SSH Host Keys

If you install SUSE Linux Enterprise Server on a machine with existing Linux installations, the installation routine imports an SSH host key. It chooses the host key with the most recent access time by default. See also Section 6.15.7, “Import SSH Host Keys and Configuration”.

If you are performing a remote administration over VNC, you can also specify whether the machine should be accessible via VNC after the installation. Note that enabling VNC also requires you to set the Default systemd Target to graphical.

6.15.7 Import SSH Host Keys and Configuration #

  

If an existing Linux installation on your computer was detected, YaST will import the most recent SSH host key found in /etc/ssh by default, optionally including other files in the directory as well. This makes it possible to reuse the SSH identity of the existing installation, avoiding the REMOTE HOST IDENTIFICATION HAS CHANGED warning on the first connection. Note that this item is not shown in the installation summary if YaST has not discovered any other installations.

Figure 6.17: Import SSH Host Keys and Configuration #

  

I would like to import SSH keys from a previous install:

Select this option if you want to import the SSH host key and optionally the configuration of an installed system. You can select the installation to import from in the option list below.

Import SSH Configuration

Enable this to copy other files in /etc/ssh to the installed system in addition to the host keys.

After configuring all installation settings, click Install in the Installation Settings window to start the installation. Some software may require a license confirmation. If your software selection includes such software, license confirmation dialogs are displayed. Click Accept to install the software package. When not agreeing to the license, click I Disagree and the software package will not be installed. In the dialog that follows, confirm with Install again.

The installation usually takes between 15 and 30 minutes, depending on the system performance and the selected software scope. After having prepared the hard disk and having saved and restored the user settings, the software installation starts. During this procedure a slide show introduces the features of SUSE Linux Enterprise Server. Choose Details to switch to the installation log or Release Notes to read important up-to-date information that was not available when the manuals were printed.

After the software installation has completed, the system reboots into the new installation where you can log in. To customize the system configuration or to install additional software packages, start YaST.

Note: One-Stage Installation

Starting with SUSE Linux Enterprise Server 12 the system installation and basic configuration including the network setup is done in a single stage. After having rebooted into the installed system, you can log in and start using the system. To fine-tune the setup, to configure services or to install additional software, start YaST.