Description of problem: If someone changes the permissions on /etc/foreman-proxy/ssl_ca.pem, running satellite-installer won't fix the permissions. Wrong permissions there may lead to fails on the installer execution and leaving services on unstable state Version-Release number of selected component (if applicable): satellite-installer-6.10.0.7-1.el7sat.noarch How reproducible: Steps to Reproduce: 1. Change permission on file /etc/foreman-proxy/ssl_ca.pem (from 644 to 600). This breaks foreman-proxy operations. ~~~ chmod 600 /etc/foreman-proxy/ssl_ca.pem ~~~ 2. run satellite-installer and check the permissions at the end of the execution 3. Actual results: Permissions on the file /etc/foreman-proxy/ssl_ca.pem are not ensured. Expected results: Installer would ensure necessary permissions for the daemons to work properly. Additional info: I'm using the file /etc/foreman-proxy/ssl_ca.pem because that's the default file, on Satellite, used by the option "--foreman-proxy-ssl-ca". What actually needs enforcing, are the permissions on the file indicated on this configuration option.
This will be fixed as part of the Satellite 6.11 release. The reference code is here https://github.com/theforeman/puppet-certs/blob/15.1.0/manifests/foreman_proxy.pp#L110-L117 which has changed a bit since 6.10.0.
[root@dhcp-3-220 foreman-proxy]# ll | grep ssl_ca.pem -r--r-----. 1 root foreman-proxy 2533 May 5 00:13 foreman_ssl_ca.pem -rw-------. 1 root foreman-proxy 2533 May 5 00:13 ssl_ca.pem [root@dhcp-3-220 foreman-proxy]# satellite-installer --scenario satellite 2022-05-05 04:09:26 [NOTICE] [root] Loading installer configuration. This will take some time. 2022-05-05 04:09:32 [NOTICE] [root] Running installer with log based terminal output at level NOTICE. 2022-05-05 04:09:32 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions. Package versions are locked. Continuing with unlock. 2022-05-05 04:09:47 [NOTICE] [configure] Starting system configuration. 2022-05-05 04:10:01 [NOTICE] [configure] 250 configuration steps out of 1662 steps complete. 2022-05-05 04:10:11 [NOTICE] [configure] 500 configuration steps out of 2511 steps complete. 2022-05-05 04:10:11 [NOTICE] [configure] 750 configuration steps out of 2511 steps complete. 2022-05-05 04:10:12 [NOTICE] [configure] 1000 configuration steps out of 2511 steps complete. 2022-05-05 04:10:12 [NOTICE] [configure] 1250 configuration steps out of 2511 steps complete. 2022-05-05 04:10:17 [NOTICE] [configure] 1500 configuration steps out of 2513 steps complete. 2022-05-05 04:10:24 [NOTICE] [configure] 1750 configuration steps out of 2516 steps complete. 2022-05-05 04:10:25 [NOTICE] [configure] 2000 configuration steps out of 2522 steps complete. 2022-05-05 04:10:27 [NOTICE] [configure] 2250 configuration steps out of 2522 steps complete. 2022-05-05 04:11:34 [NOTICE] [configure] 2500 configuration steps out of 2522 steps complete. 2022-05-05 04:11:50 [NOTICE] [configure] System configuration has finished. Success! * Satellite is running at * To install an additional Capsule on separate machine continue by running: capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" --certs-tar "/root/$CAPSULE-certs.tar" * Capsule is running at The full log is at /var/log/foreman-installer/satellite.log Package versions are being locked. [root@dhcp-3-220 foreman-proxy]# ll | grep ssl_ca.pem -r--r-----. 1 root foreman-proxy 2533 May 5 00:13 foreman_ssl_ca.pem -r--r-----. 1 root foreman-proxy 2533 May 5 00:13 ssl_ca.pem Verified on the Satellite 6.11 and Snap 18.5. Permissin are now resetting after installer run.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Satellite 6.11 Release), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:5498