## Chapter 6. Manually Scripting the Configuration¶

Note that this chapter provides an alternative to using Bootstrap to generate the bootstrap script. With these instructions, you should be able to create your own bootstrap script from scratch.

All of the initial techniques have shared a common theme: the deployment of necessary files in a centralized location to be retrieved and installed using simple, scriptable commands run on each client. In this chapter, we explore putting all of these pieces together to create a single script that can be invoked by any system in your organization.

When we combine all of the commands from the previous chapters in the most sensible order on a SLES11 SP1 system, we get the following script:

    # First, install the latest client RPMs to the system.

    zypper ar http://susemgr.example.com/pub/repositories/susemanager-client-setup susemanager-client-setup
    zypper in spacewalk-check spacewalk-client-setup spacewalk-client-tools rhncfg-actions rhncfg-client rhncfg-management zypp-plugin-spacewalk

    # Second, reconfigure the clients to talk to the correct server.

    perl -p -i -e 's/s/www\.rhns\.redhat\.com/susemgr\.example\.com/g' \
            /etc/sysconfig/rhn/rhn_register \
            /etc/sysconfig/rhn/up2date

    # Third, install the SSL client certificate for your company's
    # SUSE Manager Server or Proxy Server.
    rpm -Uvh http://susemgr.example.com/pub/rhn-org-trusted-ssl-cert-*.noarch.rpm

    # Fourth, reconfigure the clients to use the new SSL certificate.
    perl -p -i -e 's/^sslCA/#sslCA/g;' \
            /etc/sysconfig/rhn/up2date /etc/sysconfig/rhn/rhn_register
    echo "sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT" \
            >> /etc/sysconfig/rhn/up2date
    echo "sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT" \
            >> /etc/sysconfig/rhn/rhn_register

    # Fifth, install the SSL certificate in /etc/ssl/certs:
    -->
    test -e "/etc/ssl/certs/RHN-ORG-TRUSTED-SSL-CERT.pem" || {
      ln -s "/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT" "/etc/ssl/certs/RHN-ORG-TRUSTED-SSL-CERT.pem"
      /usr/bin/c_rehash /etc/ssl/certs/
    }

    # Sixth, download the GPG key needed to validate custom packages.
    wget -O - -q http://susemgr.example.com/pub/YOUR-RPM-GPG-KEY

    # Seventh, import that GPG key to your GPG keyring.
    rpm --import /path/to/YOUR-RPM-GPG-KEY

Remember, the sixth step is documented here as it pertains to systems running SLE11-SP1 or newer.

This script comprises a clean and repeatable process that should fully configure any potential SUSE Manager client in preparation for registration to an SUSE Manager Server. Remember, key values, such as the URL of your SUSE Manager Server, its public directory, and your actual GPG key must be inserted into the placeholders listed within the script. Also, depending on your environment, additional modifications may be required. Although this script may work nearly verbatim, it should be used as a guide.

Like its components, this script may be centrally located. By placing this script in the `/pub/` directory of the server, running wget -O- on it, and piping the output to a shell session, one may run the entire bootstrap process with a single command from each client:

    wget -O - http://susemgr.example.com/pub/bootstrap_script | bash

Running a shell script directly from input piped in over a Web connection obviously has some inherent security risks. Therefore, it is vital to ensure the security of the source server in this instance.

This one-line command may then be invoked across all of the systems on a network. If the administrator has SSH access to all of the systems in question, it would be a simple task to iterate over a list of these systems and run the command remotely on all of them. This script would also be a perfect addition to the %post section of an existing AutoYaST script.