Bug 1153604

Document URL: 
https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.0/html/Installation_Guide/chap-Red_Hat_Satellite_Installation.html#Installing_Red_Hat_Satellite

Section Number and Name: 
2.1. Installing Red Hat Satellite


Describe the issue: 
 Run the following commands to configure the firewall to limit elasticsearch to foreman and katello users and make these rules persistent during reboots:

# iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \
&& iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner katello -j ACCEPT \
&& iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -j DROP
# iptables-save > /etc/sysconfig/iptables

Example: the iptables
rules for port 9200 could not possibly work in the original version,
since they were applied before the katellote packages were installed and
therefore before "foreman" and "katello" user accounts existed. The
latest revision moved the step to apply those rules to after the package
install, but they still don't (can't?) work--they only allow packets to
pass if coming from processes owned by "foreman" or "katello" users, but
the process actually listening on port 9200 is owned by
"elasticsearch"--so all of its outbound packets will be dropped.Â
Support has an open case on that one, and has reproduced it.



Needs documentation changes based on developer changes.