Install Foreman PXE boot

Foreman is a complete lifecycle management tool for physical and virtual servers. We give system administrators the power to easily automate repetitive tasks, quickly deploy applications, and proactively manage servers, on-premise or in the cloud.

I hawe a VM with two virtual interface the enp0s3 for NAT and enp0s9 with an internal network.

Install DHCP server

yum install -y dhcp nano -y

echo "DHCPDARGS=enp0s9" >> /etc/sysconfig/dhcpd
cat > /etc/dhcp/dhcpd.conf << EOF
#DHCP configuration for PXE boot server
ddns-update-style interim;
ignore client-updates;
allow booting;
allow bootp;
allow unknown-clients;

# A slightly different configuration for an internal subnet.
option domain-name-servers;
option routers;
default-lease-time 600;
max-lease-time 7200;

next-server; #  PXE server ip
filename "pxelinux.0";
systemctl start dhcpd.service
systemctl enable dhcpd.service
systemctl status dhcpd.service

Install DNS server

yum -y install bind bind-utils

nano /etc/named.conf
options {
        // listen-on port 53 {; };
        // listen-on-v6 port 53 { ::1; };
        allow-query     { localhost;; };
        forwarders {
include "/etc/";
touch /etc/
chown root:named /etc/

nano /etc/
zone "devopstales.intra" IN {
         type master;
         file "devopstales.intra.db";
         allow-update { none; };
nano /var/named/devopstales.intra.db
@   IN  SOA     primary.devopstales.intra. root.mydomain.intra. (
                                                1001    ;Serial
                                                3H      ;Refresh
                                                15M     ;Retry
                                                1W      ;Expire
                                                1D      ;Minimum TTL

;Name Server Information
@      IN  NS      primary.devopstales.intra.

;IP address of Name Server
primary IN  A

;Mail exchanger
devopstales.intra. IN  MX 10   mail.mydomain.intra.

;A - Record HostName To IP Address
foreman IN  A
mail    IN  A
systemctl restart named
systemctl status named
systemctl enable named

Install vtftp

yum install vsftpd -y

nano /etc/vsftpd/vsftpd.conf

systemctl enable vsftpd
systemctl restart vsftpd
systemctl status vsftpd

cd /opt

sha256sum CentOS-7-x86_64-Minimal-1908.iso
cat sha256sum.txt

mount -o loop /opt/CentOS-7-x86_64-Minimal-1908.iso  /mnt

mkdir /var/ftp/pub/CentOS_7_x86_64
rsync -rv --progress /mnt/ /var/ftp/pub/CentOS_7_x86_64/
umount /mnt
restorecon -Rv /var/ftp/pub/

Install Foreman

yum -y install
yum -y install
yum -y install
yum -y install foreman-installer

foreman-installer \
--foreman-initial-organization "mydomain" \
--foreman-initial-location "office" \
--enable-foreman-plugin-ansible \
--enable-foreman-proxy-plugin-ansible \
--enable-foreman-plugin-remote-execution \
--enable-foreman-proxy-plugin-remote-execution-ssh \
--enable-foreman-plugin-cockpit \

Configure hammer

nano ~/.hammer/cli.modules.d/foreman.yml
 :host: 'https://foreman.devopstales.intra/'
 :username: 'admin'
 :password: '**********'

hammer defaults add --param-name organization --param-value "mydomain"
hammer defaults add --param-name location --param-value "office"
hammer defaults list

Configurate PXEboot

sudo ss -lnup | grep 69
grep disa /etc/xinetd.d/tftp
ls -l /var/lib/tftpboot/

# create subnet
hammer subnet create \
--name PXEnet \
--network-type IPv4 \
--network \
--mask \
--dns-primary \
--domains devopstales.intra \
--tftp-id 1 \
--httpboot-id 1 \
--ipam "Internal DB" \
--from \
--to \
--boot-mode Static

hammer medium create \
--name "CentOS7_DVD_FTP" \
--os-family "Redhat" \
--path "ftp://foreman.devopstales.intra/pub/CentOS_7_x86_64/"

Create a file hardened_ptable.txt with the content below.

kind: ptable
name: Kickstart hardened
- CentOS
- Fedora
- RedHat

# System bootloader configuration
bootloader --location=mbr --boot-drive=sda --timeout=3
# Partition clearing information
clearpart --all --drives=sda

# Disk partitioning information
part /boot --fstype="xfs" --ondisk=sda --size=1024 --label=boot --fsoptions="rw,nodev,noexec,nosuid"

# 30GB physical volume
part pv.01  --fstype="lvmpv" --ondisk=sda --size=30720
volgroup vg_os pv.01

logvol /        --fstype="xfs"  --size=4096 --vgname=vg_os --name=lv_root
logvol /home    --fstype="xfs"  --size=512  --vgname=vg_os --name=lv_home --fsoptions="rw,nodev,nosuid"
logvol /tmp     --fstype="xfs"  --size=1024 --vgname=vg_os --name=lv_tmp  --fsoptions="rw,nodev,noexec,nosuid"
logvol /var     --fstype="xfs"  --size=6144 --vgname=vg_os --name=lv_var  --fsoptions="rw,nosuid"
logvol /var/log --fstype="xfs"  --size=512  --vgname=vg_os --name=lv_log  --fsoptions="rw,nodev,noexec,nosuid"
logvol swap     --fstype="swap" --size=2048 --vgname=vg_os --name=lv_swap --fsoptions="swap"
hammer partition-table create \
  --name "Kickstart hardened" \
  --os-family "Redhat" \
  --operatingsystems "CentOS 7.4.1708" \
  --file "hardened_ptable.txt"

hammer os create \
  --name "CentOS" \
  --major "7" \
  --minor "4.1708" \
  --family "Redhat" \
  --password-hash "SHA512" \
  --architectures "x86_64" \
  --media "CentOS7_DVD_FTP" \
  --partition-tables "Kickstart hardened"

hammer hostgroup create \
  --name "el7_group" \
  --description "Host group for CentOS 7 servers" \
  --lifecycle-environment "stable" \
  --content-view "el7_content" \
  --content-source-id "1" \
  --environment "homelab" \
  --puppet-proxy "foreman.devopstales.intra" \
  --puppet-ca-proxy "foreman.devopstales.intra" \
  --domain "devopstales.intra" \
  --subnet "PXEnet" \
  --architecture "x86_64" \
  --operatingsystem "CentOS 4.1708" \
  --medium "CentOS7_DVD_FTP" \
  --partition-table "Kickstart hardened" \
  --pxe-loader "PXELinux BIOS" \
  --root-pass "Password1"

hammer hostgroup set-parameter  \
  --name "selinux-mode" \
  --value "disabled" \
  --hostgroup "el7_group"

hammer hostgroup set-parameter  \
  --name "disable-firewall" \
  --value "true" \
  --hostgroup "el7_group"

hammer hostgroup set-parameter  \
  --name "bootloader-append" \
  --value "net.ifnames=0 biosdevname=0" \
  --hostgroup "el7_group"

hammer host create \
  --name "pxe-test" \
  --hostgroup "el7_group" \
  --interface "type=interface,mac=08:00:27:fb:ad:17,ip=,managed=true,primary=true,provision=true"
ll /var/lib/tftpboot/pxelinux.cfg/
cat /var/lib/tftpboot/pxelinux.cfg/01-08-00-27-fb-ad-17