Install Foreman PXE boot

Page content

Foreman is a complete lifecycle management tool for physical and virtual servers. We give system administrators the power to easily automate repetitive tasks, quickly deploy applications, and proactively manage servers, on-premise or in the cloud.

I hawe a VM with two virtual interface the enp0s3 for NAT and enp0s9 with an internal network.

Install DHCP server

yum install -y dhcp nano -y

echo "DHCPDARGS=enp0s9" >> /etc/sysconfig/dhcpd
cat > /etc/dhcp/dhcpd.conf << EOF
#DHCP configuration for PXE boot server
ddns-update-style interim;
ignore client-updates;
authoritative;
allow booting;
allow bootp;
allow unknown-clients;

# A slightly different configuration for an internal subnet.
subnet 192.168.100.0
netmask 255.255.255.0
{
range 192.168.100.101 192.168.100.200;
option domain-name-servers 192.168.100.100;
option routers 192.168.100.100;
default-lease-time 600;
max-lease-time 7200;
 
# PXE SERVER IP
next-server 192.168.100.100; #  PXE server ip
filename "pxelinux.0";
}
EOF
systemctl start dhcpd.service
systemctl enable dhcpd.service
systemctl status dhcpd.service

Install DNS server

yum -y install bind bind-utils

nano /etc/named.conf
options {
        ...
        // listen-on port 53 { 127.0.0.1; };
        // listen-on-v6 port 53 { ::1; };
        ...
        allow-query     { localhost; 192.168.100.0/24; };
        ...
        forwarders {
                8.8.8.8;
                8.8.4.4;
        };
};
include "/etc/named.my.zones";
touch /etc/named.my.zones
chown root:named /etc/named.my.zones

nano /etc/named.my.zones
zone "mydomain.intra" IN {
         type master;
         file "mydomain.intra.db";
         allow-update { none; };
};
nano /var/named/mydomain.intra.db
@   IN  SOA     primary.mydomain.intra. root.mydomain.intra. (
                                                1001    ;Serial
                                                3H      ;Refresh
                                                15M     ;Retry
                                                1W      ;Expire
                                                1D      ;Minimum TTL
                                                )

;Name Server Information
@      IN  NS      primary.mydomain.intra.

;IP address of Name Server
primary IN  A       192.168.100.100

;Mail exchanger
mydomain.intra. IN  MX 10   mail.mydomain.intra.

;A - Record HostName To IP Address
foreman IN  A       192.168.100.100
mail    IN  A       192.168.100.50
systemctl restart named
systemctl status named
systemctl enable named

Install vtftp

yum install vsftpd -y

nano /etc/vsftpd/vsftpd.conf 
anonymous_enable=YES
write_enable=NO

systemctl enable vsftpd
systemctl restart vsftpd
systemctl status vsftpd

cd /opt
wget http://ftp.bme.hu/centos/7/isos/x86_64/CentOS-7-x86_64-Minimal-1908.iso
wget http://ftp.bme.hu/centos/7/isos/x86_64/sha256sum.txt

sha256sum CentOS-7-x86_64-Minimal-1908.iso
cat sha256sum.txt

mount -o loop /opt/CentOS-7-x86_64-Minimal-1908.iso  /mnt

mkdir /var/ftp/pub/CentOS_7_x86_64
rsync -rv --progress /mnt/ /var/ftp/pub/CentOS_7_x86_64/
umount /mnt
restorecon -Rv /var/ftp/pub/

Install Foreman

yum -y install https://yum.puppet.com/puppet6-release-el-7.noarch.rpm
yum -y install http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum -y install https://yum.theforeman.org/releases/1.23/el7/x86_64/foreman-release.rpm
yum -y install foreman-installer

foreman-installer \
--foreman-initial-organization "mydomain" \
--foreman-initial-location "office" \
--enable-foreman-plugin-ansible \
--enable-foreman-proxy-plugin-ansible \
--enable-foreman-plugin-remote-execution \
--enable-foreman-proxy-plugin-remote-execution-ssh \
--enable-foreman-plugin-cockpit \
--enable-foreman-plugin-openscap

Configure hammer

nano ~/.hammer/cli.modules.d/foreman.yml
:foreman:
 :host: 'https://foreman.mydomain.intra/'
 :username: 'admin'
 :password: '**********'

hammer defaults add --param-name organization --param-value "mydomain"
hammer defaults add --param-name location --param-value "office"
hammer defaults list

Configurate PXEboot

sudo ss -lnup | grep 69
grep disa /etc/xinetd.d/tftp
ls -l /var/lib/tftpboot/

# create subnet
hammer subnet create \
--name PXEnet \
--network-type IPv4 \
--network 192.168.100.0 \
--mask 255.255.255.0 \
--dns-primary 192.168.100.100 \
--domains mydomain.intra \
--tftp-id 1 \
--httpboot-id 1 \
--ipam "Internal DB" \
--from 192.168.100.101 \
--to 192.168.100.200 \
--boot-mode Static

hammer medium create \
--name "CentOS7_DVD_FTP" \
--os-family "Redhat" \
--path "ftp://foreman.mydomain.intra/pub/CentOS_7_x86_64/"

Create a file hardened_ptable.txt with the content below.

<%#
kind: ptable
name: Kickstart hardened
oses:
- CentOS
- Fedora
- RedHat
%>

# System bootloader configuration
bootloader --location=mbr --boot-drive=sda --timeout=3
# Partition clearing information
clearpart --all --drives=sda
zerombr 

# Disk partitioning information
part /boot --fstype="xfs" --ondisk=sda --size=1024 --label=boot --fsoptions="rw,nodev,noexec,nosuid"

# 30GB physical volume
part pv.01  --fstype="lvmpv" --ondisk=sda --size=30720
volgroup vg_os pv.01

logvol /        --fstype="xfs"  --size=4096 --vgname=vg_os --name=lv_root
logvol /home    --fstype="xfs"  --size=512  --vgname=vg_os --name=lv_home --fsoptions="rw,nodev,nosuid"
logvol /tmp     --fstype="xfs"  --size=1024 --vgname=vg_os --name=lv_tmp  --fsoptions="rw,nodev,noexec,nosuid"
logvol /var     --fstype="xfs"  --size=6144 --vgname=vg_os --name=lv_var  --fsoptions="rw,nosuid"
logvol /var/log --fstype="xfs"  --size=512  --vgname=vg_os --name=lv_log  --fsoptions="rw,nodev,noexec,nosuid"
logvol swap     --fstype="swap" --size=2048 --vgname=vg_os --name=lv_swap --fsoptions="swap"
hammer partition-table create \
  --name "Kickstart hardened" \
  --os-family "Redhat" \
  --operatingsystems "CentOS 7.4.1708" \
  --file "hardened_ptable.txt"

hammer os create \
  --name "CentOS" \
  --major "7" \
  --minor "4.1708" \
  --family "Redhat" \
  --password-hash "SHA512" \
  --architectures "x86_64" \
  --media "CentOS7_DVD_FTP" \
  --partition-tables "Kickstart hardened"

hammer hostgroup create \
  --name "el7_group" \
  --description "Host group for CentOS 7 servers" \
  --lifecycle-environment "stable" \
  --content-view "el7_content" \
  --content-source-id "1" \
  --environment "homelab" \
  --puppet-proxy "foreman.mydomain.intra" \
  --puppet-ca-proxy "foreman.mydomain.intra" \
  --domain "mydomain.intra" \
  --subnet "PXEnet" \
  --architecture "x86_64" \
  --operatingsystem "CentOS 4.1708" \
  --medium "CentOS7_DVD_FTP" \
  --partition-table "Kickstart hardened" \
  --pxe-loader "PXELinux BIOS" \
  --root-pass "Password1"

hammer hostgroup set-parameter  \
  --name "selinux-mode" \
  --value "disabled" \
  --hostgroup "el7_group"

hammer hostgroup set-parameter  \
  --name "disable-firewall" \
  --value "true" \
  --hostgroup "el7_group"

hammer hostgroup set-parameter  \
  --name "bootloader-append" \
  --value "net.ifnames=0 biosdevname=0" \
  --hostgroup "el7_group"

hammer host create \
  --name "pxe-test" \
  --hostgroup "el7_group" \
  --interface "type=interface,mac=08:00:27:fb:ad:17,ip=192.168.100.110,managed=true,primary=true,provision=true"
ll /var/lib/tftpboot/pxelinux.cfg/
cat /var/lib/tftpboot/pxelinux.cfg/01-08-00-27-fb-ad-17
comments powered by Disqus