Title: Installing Red Hat Satellite Describe the issue: The problem occurs When following the install instructions on https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.0/html/Installation_Guide/chap-Red_Hat_Satellite_Installation.html#Installing_Red_Hat_Satellite If you follow the instruction in section 2.1 step 6 - running the following commands # iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \ && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner katello -j ACCEPT \ && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -j DROP # iptables-save > /etc/sysconfig/iptables prior to running katello-installer in section 3, katello-installer will fail as it is not able to communicate with elastic search, since the service-wait command in the script is not able to verify that elasticsearch is started since traffic to port 9200 is dropped for all except the foreman and katello users. Suggestions for improvement: Move step 6 of section 2.1 to a point AFTER section 2.3 and 2.4, but before section 3 Additional information: I am also concerned about how having these ports blocked may cause future upgrades to fail for the same reasons.
This was noted when installing Satellite 6.0.4
Also I ran into this problem when installing on RHEL 6.5, 6.6, and 7.0 before determining the source of the problem
Since this issue was entered in Red Hat Bugzilla, the release flag has been set to ? to ensure that it is properly evaluated for this release.
Hello Aaron, Thank you for the feedback! We're addressing this and publishing the solution this week. The changes would be to run the following firewall rules after running katello-installer: iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner foreman -j ACCEPT \ && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner katello -j ACCEPT \ && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -m owner --uid-owner root -j ACCEPT \ && iptables -A OUTPUT -o lo -p tcp -m tcp --dport 9200 -j DROP iptables-save > /etc/sysconfig/iptables The additional rule for root has been added to allow the installer to run. This is tagged as a duplicate of bug: https://bugzilla.redhat.com/show_bug.cgi?id=1161254 Cheers, Athene *** This bug has been marked as a duplicate of bug 1161254 ***