SUSE Manager is a solution for organizations that require absolute control over maintenance and package deployment on their servers. It lets you manage large sets of Linux systems and keep them up to date, with automated software management, asset management, and system provisioning. SUSE Manager allows you to maintain a high level of security while effectively managing system life-cycle requirements.

SUSE Manager uses Salt to provide event-driven configuration and management control. The Salt-master orchestrates thousands of Salt-minions (SUSE Manager Clients) using remote execution.

SUSE Manager is fully compatible with Red Hat Satellite Server and offers seamless management of both SUSE Linux Enterprise and Red Hat Enterprise Linux client systems.

SUSE Manager can be integrated with your network infrastructure in multiple ways. This book will guide you through an initial proof-of-concept setup, using these steps:

The book also contains a section about getting started with Salt.

Before you begin your installation, ensure you have fulfilled these prerequisites:

This section contains more information on each of these prerequisites.

Note

SUSE Manager 3.2 is based on SLES 12 SP4 as the host operating system.

1.2.4 Network Requirements #

This section details the networking and port requirements for SUSE Manager.

Fully Qualified Domain Name (FQDN)

The SUSE Manager server must resolve its FQDN correctly or cookies will not work properly on the WebUI. For more information about configuring the hostname and DNS, see SUSE Linux Enterprise Server Documentation - Configuring Host Name and DNS

Hostname and IP Address

To ensure that the SUSE Manager domain name can be resolved by its clients, both server and client machines must be connected to a working DNS server. For more information about setting up a DNS server, see SUSE Linux Enterprise Server Documentation - The Domain Name System

Using a Proxy When Installing from SUSE Linux Enterprise Media

If you are on an internal network and do not have access to SUSE Customer Center, you can set up and use a proxy during installation. For more information about configuring a proxy for access to SUSE Customer Center during a SUSE Linux Enterprise installation, see SUSE Linux Enterprise Server Documentation - Using a Proxy During Installation

Important: Naming Your Server

The hostname of SUSE Manager must not contain uppercase letters as this may cause jabberd to fail. Choose the hostname of your SUSE Manager server carefully. Although changing the server name is possible, it is a complex process and unsupported.

In a production environment, SUSE Manager server and its clients should always use a firewall. This table gives an overview of required ports, to be used when you are setting up your firewall rules.

Table 1.3: Required Server Ports #

Port	Protocol	Description
22	TCP	SSH
67	UDP	DHCP
69	UDP	TFTP, used to support PXE services
80	TCP	HTTP, used in some bootstrap cases
123	UDP	NTP time service
443	TCP	HTTPS, used for Web UI, client, Proxy server, and API traffic
4505	TCP	Salt, used by the Salt-master to accept communication requests from minions
4506	TCP	Salt, used by the Salt-master to accept communication requests from minions
5222	TCP	XMPP client, used for communications with the osad daemon on traditional client systems
5269	TCP	XMPP server, used for pushing actions to SUSE Manager Proxy

For more information on disconnected setup and port configuration, see:

• Book “Best Practices”, Chapter 2 “Managing Your Subscriptions”, Section 2.2 “Disconnected Setup with RMT or SMT (DMZ)”

• Book “Advanced Topics”, , Section A.1 “SUSE Manager Server”

1.2.5 Supported Client Systems #

Supported operating systems for traditional and Salt clients are listed in this table.

Table 1.4: Supported Client Systems #

Operating Systems	Architecture	Traditional Clients	Salt Clients
SUSE Linux Enterprise 11 SP4	x86, x86_64, Itanium, IBM POWER, z Systems	Supported	Supported
SUSE Linux Enterprise 12 SP3, 12 SP4	x86_64, IBM POWER (IBM Power PC), z Systems, ARM	Supported	Supported
SUSE Linux Enterprise 15	x86_64, IBM POWER (IBM Power PC), z Systems, ARM	Supported	Supported
Latest minor release Red Hat Enterprise Linux Server 6	x86, x86_64	Supported	Supported
Latest minor release Red Hat Enterprise Linux Server 7	x86_64	Supported	Supported
Open Enterprise Server 2015, 2015 SP1, 2018	x86_64	Supported	Supported

Note: Supported Versions and SP Levels

Client operating system versions and SP levels must be under general support (normal or LTSS) to be supported with SUSE Manager. For details on supported product versions, see https://www.suse.com/lifecycle.

This chapter provides the required (KVM) settings for installation of SUSE Linux Enterprise Just Enough Operating System (JeOS) 12 as the base for SUSE Manager. A kernel virtual machine (KVM) combined with Virtual Machine Manager (virt-manager) will be used as a sandbox for your first installation.

Tip: SUSEVirtualization Guide

For more information on virtualization, see: SUSE Linux Enterprise Virtualization Guide

Enter the following settings when creating a new virtual machine using virt-manager. In the following table replace version with the actual product version string.

Tip: SUSE Virtualization Guide

For more information on virtualization, see: SUSE Linux Enterprise Virtualization Guide

Create three additional virtual disks required for the SUSE Manager storage partitions.

Proceed through the basic JeOS installation prompts until you reach the command line.

Tip: Root Password

During the basic installation prompts you are asked to enter the root password. Select a strong password and then in the next message box Confirm root Password.

For proceeding with SUSE Manager setup, see SUSE Manager Setup.

Enter the following settings when creating a new virtual machine using virt-manager (replace version with the actual version string):

This section covers SUSE Manager setup. You will perform the following procedures:

Warning: Third Party Software

SUSE Manager is an extension of SUSE Linux Enterprise Server and compatible with the software shipped with SUSE Linux Enterprise Server.

SUSE Manager is a complex system, and therefore installing third party is not allowed. Installing monitoring software provided by a third party vendor is allowed only if you do not exchange basic libraries such as SSL, cryptographic software, and similar tools. In case of emergency, SUSE reserves the right to ask to remove any third party software (and associated configuration changes) and then to reproduce the problem on a clean system.

This section will guide you through SUSE Manager setup procedures.

In the next section you will create the administrator’s account and synchronize with SUSE Customer Center.

4.2.1 Creating the Main Administration Account #

This section will walk you through creating your organizations main administration account for SUSE Manager.

Warning: Admin and User Accounts

The main administration account is the highest authority account within SUSE Manager and therefore account access information should be stored in a secure location.

For security it is recommended that the main administrator creates low level admin accounts designated for administration of organizations and individual groups.

Procedure: Setup the Main Administration Account #

1. In the browser, enter the address provided after completing setup and open the SUSE Manager Web UI.

2. Add your organization name to the Create Organization › Organization Name field.

3. Add your username and password to the Create Organization › Desired Login and Create Organization › Desired Password fields.

4. Fill in the Account Information fields including an email for system notifications.

5. Select Create Organization to finish creating your administration account.

   

You should now be presented with the SUSE Manager Front Page. In the next section you will prepare the server for connecting the first client.

4.2.2 Syncing Products from SUSE Customer Center #

SUSE Customer Center (SCC) maintains a collection of repositories which contain packages, software and updates for all supported enterprise client systems. These repositories are organized into channels each of which provide software specific to a distribution, release and architecture. After synchronizing with SCC clients may receive updates, and be organized into groups and assigned to specific product software channels.

This section covers synchronizing with SCC from the Web UI and adding your first client channel.

Procedure: Synchronizing with SUSE Customer Center #

1. From the SUSE Manager Web UI start page select Admin › Setup Wizard.

2. From the Main Menu › Admin › Setup Wizard page select the SUSE Products tab. Wait a moment for the products list to populate. If you previously registered with SUSE Customer Center a list of products will populate the table. This table lists architecture, channels, and status information. For more information, see: Book “Reference Manual”, Chapter 17 “Admin”, Section 17.1 “Main Menu › Admin › Setup Wizard”

   

3. Since Your SUSE Linux Enterprise client is based on x86_64 architecture scroll down the page and select the check box for this channel now.

   • Add channels to SUSE Manager by selecting the check box to the left of each channel. Click the arrow symbol to the left of the description to unfold a product and list available modules.

   • Start product synchronization by clicking the Add Products button.

After adding the channel SUSE Manager will schedule the channel to be copied. This can take a long time as SUSE Manager will copy channel software sources from the SUSE repositories located at SUSE Customer Center to local /var/spacewalk/ directory of your server.

Tip: PostgreSQL and Transparant Huge Pages

In some environments, Transparent Huge Pages provided by the kernel may slow down PostgreSQL workloads significantly.

To disable Transparant Huge Pages set the transparent_hugepage kernel parameter to never. This has to be changed in /etc/default/grub and added to the line GRUB_CMDLINE_LINUX_DEFAULT, for example:

GRUB_CMDLINE_LINUX_DEFAULT="resume=/dev/sda1 splash=silent quiet showopts elevator=noop transparent_hugepage=never"

To write the new configuration run grub2-mkconfig -o /boot/grub2/grub.cfg. To update the grub2 during boot run grub2-install /dev/sda.

Monitor channel synchronization process in real-time by viewing channel log files located in the directory /var/log/rhn/reposync:

tailf /var/log/rhn/reposync/<CHANNEL_NAME>.log

After the channel sync process has completed proceed to: Chapter 5, Registering Clients

For SUSE Manager 3 and later, you can choose to use either traditional or Salt client management framework, or a mixture of both, depending on your environment and requirements.

Activation keys are used with both traditional and Salt clients to ensure that your clients have the correct software entitlements, are connecting to the appropriate channels, and are subscribed to the relevant groups. Each activation key is bound to an organization, which you can set when you create the key.

This section contains information on how to create activation keys for both traditional and Salt clients, and provides some best practices for working with activation keys.

When you create activation keys, keep these best practices in mind:

In this section you will create a tools repository on the SUSE Manager Server for providing client tools. The client tools repository contains packages for installing Salt on minions as well as required packages for registering traditional clients during the bootstrapping procedure. These packages will be installed from the newly generated repository during the registration process. In the following procedure you will create the SUSE Linux Enterprise tools repository.

Important: Creating a Tools Repository when an SCC Channel has not been Synced

Before following the procedure to create the tools repository make sure the SUSE vendor channel you will be using with your client has been completely synced. You can check this by running tail -f /var/log/rhn/reposync/<CHANNEL_NAME>.log as root. In the following example replace version with the actual version string:

# tail -f /var/log/rhn/reposync/sles`version`-pool-x86_64.log

Once completed you should see the following output in your terminal:

2017/12/12 15:20:32 +02:00 Importing packages started.
2017/12/12 15:22:02 +02:00 1.07 %
...
2017/12/12 15:34:25 +02:00 86.01 %
2017/12/12 15:35:49 +02:00 Importing packages finished.
2017/12/12 15:35:49 +02:00 Linking packages to channel.
...
2017/12/12 15:35:59 +02:00 Sync completed.

This repository is suitable for both Server and Desktop of SUSE Linux Enterprise.

Note: Support for SUSE Linux Enterprise 15 Products

If you have mirrored more than one SUSE Linux Enterprise 15 Product (for example, SLES, {slda}, and SLES for SAP Application), you can specify the one you are actually interested in. First check what is avaiable:

mgr-create-bootstrap-repo -c SLE-15-x86_64 --with-custom-channel
Multiple options for parent channel found. Please use option
--with-parent-channel <label> and choose one of:
- sle-product-sles15-pool-x86_64
- sle-product-sles_sap15-pool-x86_64
- sle-product-sled15-pool-x86_64

Then specify it with --with-parent-channel:

mgr-create-bootstrap-repo -c SLE-15-x86_64 --with-parent-channel sle-product-sled15-pool-x86_64

There are currently three methods for registering Salt minions. This section describes the first method and uses a bootstrap repository. The second method uses the bootstrap script, and is mostly similar to the procedure described in Section 5.4, “Registering Traditional Clients”-the difference is enabling Bootstrap using Salt and the activation key option Configuration File Deployment that applies highstate automatically. The third method uses the Web UI, and is described in Book “Reference Manual”, Chapter 7 “Systems”, Section 7.6 “Bootstrapping (Salt)”.

You can also use these methods to change existing traditional clients into Salt minions.

The rest of this section assumes you have created a SUSE Manager tools repository. You can review creating a tools repository in Section 5.3, “Creating the SUSE Manager Tools Repository”.

When you have fully synchronized a base channel from the Web UI for clients to obtain software packages from (for example: SLES12-SP4-Pool_for_x86_64) perform the following procedure to register a Salt minion.

Your newly registered minion should now show up within the Web UI under Salt › Keys. Accept the pending key to begin management.

This section introduces you to the new Salt features added in SUSE Manager 3. This chapter assumes you have completed all previous Getting Started sections. At a minimum have the following setup:

If you find yourself stuck at any point refer to the SaltStack Get Started tutorial located at https://docs.saltstack.com/en/getstarted/fundamentals/index.html.

Note

This guide does not attempt to cover all that Salt has to offer. This guide is a primer for using Salt with SUSE Manager. For comprehensive Salt documentation, see https://docs.saltstack.com/en/latest/contents.html.

The current version of Salt in SUSE Manager is 2018.3.0.

The following list provides several useful Salt commands.

The following screen describes Salt file structures and their locations used by the SUSE Manager Server. These files are listed in /etc/salt/master.d/susemanager.conf:

# Configure different file roots

file_roots:
  base:
    - /usr/share/susemanager/salt    #Should not be touched by a user
    - /srv/susemanager/salt          #Should not be touched by a user
    - /srv/salt                      #Your custom states go here

# Configure different pillar roots

pillar_roots:
  base:
    - /usr/share/susemanager/pillar  #Should not be touched by a user
    - /srv/pillar                    #Custom pillars go here

# Extension modules path

extension_modules: /usr/share/susemanager/modules

# Master top configuration

master_tops:
  mgr_master_tops: True

The following tips should be kept in mind when working with /etc/salt/master.d/susemanager.conf.

The following section provides guidance on installing and using SUSE provided Salt formulas.

By default, SUSE Manager assumes that the download endpoint to use is the FQDN of the SUSE Manager server, or the SUSE Manager Proxy. However, there are some cases where you might like to use a different FQDN as the download endpoint. The most common example is if you need to use load balancing, caching proxies, or in environments with complicated networking requirements.

To change the package download endpoint, you can manually adjust three salt pillars: * pkg_download_point_protocol, defaults to https. * pkg_download_point_host, defaults to the FQDN of the SUSE Manager Server (or Proxy, if in use). * pkg_download_point_port, defaults to 443.

If you do not adjust these pillars directly, SUSE Manager will fall back to the default values.

{% if grains['fqdn'] == 'minion1.example.com' %}
    pkg_download_point: example1.com
{% elif grains['fqdn'] == 'minion2.example.com' %}
    pkg_download_point: example2.com
{% else %}
    pkg_download_point: example.com
{% endif %}

In older versions, SUSE Manager used a tool called Salt mine to check minion availability. The Salt mine would cause minions to contact the server every hour, which created significant load. With the introduction of a more efficient mechanism in SUSE Manager 3.2, the Salt mine is no longer required. Instead, the SUSE Manager server uses Taskomatic to ping only the minions that appear to have been offline for twelve hours or more, with all minions being contacted at least once in every twenty four hour period by default. You can adjust this by changing the web.system_checkin_threshold parameter in rhn.conf. The value is expressed in days, and the default value is 1.

Newly registered Salt minions will have the Salt mine disabled by default. If the Salt mine is running on your system, you can reduce load by disabling it. This is especially effective if you have a large number of minions.

Disable the Salt mine by running this command on the server:

salt '*' state.sls util.mgr_mine_config_clean_up

This will restart the minions and generate some Salt events to be processed by the server. If you have a large number of minions, handling these events could create excessive load. To avoid this, you can execute the command in batch mode with this command:

salt --batch-size 50 '*' state.sls util.mgr_mine_config_clean_up

You will need to wait for this command to finish executing. Do not end the process with Ctrl–C.