RHSM.CONF(5)

📦
version 1.30.16 · 3 versions
, in centos-stream 10

🎀 rhsm.conf — the config file for the subscription-manager tooling (that's RHSM.CONF(5) bestie, section 5, iykyk) 🎀

✨ NAME ✨

rhsm.conf — the configuration file for all the subscription-manager tooling, like, literally the control panel for the whole squad 💅

🌸 DESCRIPTION 🌸

Okay so rhsm.conf is the configuration file for a bunch of subscription manager tooling. The whole friend group, fr fr:

  • subscription-manager
  • subscription-manager-gui
  • rhsmcertd
  • virt-who

The format of this file is a simple INI-like structure — keys and values living inside sections. Very demure, very mindful 🎀

Heads up bestie: duplicated keys inside a section? Not allowed 🙅‍♀️ and only the last occurrence of each key is actually used. Duplicated section names? Also not allowed. The config file does not do polyamory 💀

🦋 [SERVER] OPTIONS 🦋

  • hostname — the hostname of the subscription service being used. The default is the Red Hat Customer Portal, which is subscription.rhsm.redhat.com. This default should not be retrofitted to previously installed versions — it should be incorporated as the default going forward. So like, no time-traveling defaults, okay? ⭐
  • prefix — the server prefix where the subscription service is registered.
  • port — the port the subscription service is listening on.
  • insecure — this flag enables or disables entitlement server certification verification using the certificate authorities that are installed in /etc/rhsm/ca. Yes she's named "insecure", no she's not having a crisis ~~maybe a little~~
  • server_timeout — set this to a non-blank value to override the HTTP timeout in seconds. The default is 180 seconds (3 minutes). Three whole minutes, the patience of a saint 😭
  • proxy_hostname — set this to a non-blank value if subscription-manager should use a proxy to access the subscription service. This sets the host for the proxy. It overrides hostname from the HTTP_PROXY and HTTPS_PROXY environment variables. 👑 Important: this value should not contain the scheme to be used with the proxy (e.g. http or https) — for that you use the proxy_scheme option, okay?? Don't mix them up 🙈
  • proxy_scheme — this only sets the scheme for the proxy when writing out the proxy to repo definitions. Set this to a non-blank value if you want to specify the scheme used by your package manager for subscription-manager managed repos. It defaults to "http".
Note: subscription-manager tooling does not use this option for connecting to the proxy, and HTTPS is always used. She's decorative, she's a vibe, she does not do the connecting 💅
  • proxy_port — set this to a non-blank value if subscription-manager should use a proxy to access the subscription service. This sets the port for the proxy. It overrides port from the HTTP_PROXY and HTTPS_PROXY environment variables.
Please note that setting this to any value other than 3128 (depending on your SELinux configuration) will require an update to that policy 😳

To add a local policy:

# semanage port -a -t squid_port_t -p tcp <port number>

To change the system back to look at the 3128 port, just remove the policy:

# semanage port -d -t squid_port_t -p tcp <port number>
  • proxy_username — set this to a non-blank value if subscription-manager should use an authenticated proxy to access the subscription service. This sets the username for the proxy. It overrides username from the HTTP_PROXY and HTTPS_PROXY environment variables. 🔥
  • proxy_password — set this to a non-blank value if subscription-manager should use an authenticated proxy to access the subscription service. This sets the password for the proxy. It overrides password from the HTTP_PROXY and HTTPS_PROXY environment variables.
  • no_proxy — set this to a non-blank value if subscription-manager should not use a proxy for specific hosts. Format is a comma-separated list of hostname suffixes, optionally with port. '*' is a special value that means do not use a proxy for any host. It overrides the NO_PROXY environment variable. The "leave me alone" list basically 🫶

💖 [RHSM] OPTIONS 💖

  • baseurl — this setting is the prefix for all content which is managed by the subscription service. It should be the hostname for the Red Hat CDN, the local Satellite or Capsule depending on your deployment. The prefix depends on the service type.

For the Red Hat CDN, the full baseurl is https://cdn.redhat.com .

For Satellite 6, the baseurl is https://HOSTNAME/pulp/repos , so for a hostname of sat6.example.com the full baseurl would be, for example: https://sat6.example.com/pulp/repos .

  • repomd_gpg_url — the URL of the GPG key that was used to sign this repository's metadata. The specified GPG key will be used in addition to any GPG keys defined by the entitlement. Double the keys, double the trust ✨
  • ca_cert_dir — the location for the certificates which are used to communicate with the server and to pull down content.
  • repo_ca_cert — the certificate to use for server side authentication during content downloads.
  • productCertDir — the directory where product certificates should be stored.
  • entitlementCertDir — the directory where entitlement certificates should be stored.
  • consumerCertDir — the directory where the consumer's identity certificate is stored.
  • manage_repos — set this to 1 if subscription manager should manage a yum repos file. If set, it will manage the file /etc/yum.repos.d/redhat.repo. If set to 0 then the subscription is only used for tracking purposes, not content. The /etc/yum.repos.d/redhat.repo file will either be purged or deleted. So like, she's either in charge of the repo file or she's not, there is no "kind of" 💀
  • full_refresh_on_yum — set to 1 if /etc/yum.repos.d/redhat.repo should be updated with every server command. This will make yum less efficient, but it can ensure that the most recent data is brought down from the subscription service. Speed vs. freshness, the eternal struggle 😭
  • report_package_profile — set to 1 if rhsmcertd should report the system's current package profile to the subscription service. This report helps the subscription service provide better errata notifications. If supported by the entitlement server, enabled repos, enabled modules, and packages present will be reported. This configuration also governs package profile reporting when the "dnf uploadprofile" command is executed. She snitches (affectionate) about your packages 🫶
  • package_profile_on_trans — set to 1 if the dnf/yum subscription-manager plugin should report the system's current package profile to the subscription service on execution of dnf/yum transactions (for example on package install). This report helps the subscription service provide better errata notifications. If supported by the entitlement server, enabled repos, enabled modules, and packages present will be reported.
Bestie pls note: the report_package_profile option needs to also be set to 1 for this option to have any effect. Teamwork makes the dream work 🌈
  • pluginDir — the directory to search for subscription manager plug-ins.
  • pluginConfDir — the directory to search for plug-in configuration files.
  • auto_enable_yum_plugins — when this option is enabled, then yum/dnf plugins subscription-manager and product-id are enabled every-time subscription-manager or subscription-manager-gui is executed. Every time! She doesn't skip a beat 👑
  • inotify — inotify is used for monitoring changes in directories with certificates. Currently only the /etc/pki/consumer directory is monitored by the rhsm.service. When this directory is mounted using a network file system without inotify notification support (e.g. NFS), then disabling inotify is strongly recommended. When inotify is disabled, periodical directory polling is used instead. NFS + inotify = toxic situationship, hard pass 🙅‍♀️
  • progress_messages — set to 0 to disable progress reporting. When subscription-manager waits while fetching certificates or updating user information, it writes temporary informational messages to the standard output. This feature may not be desired in some situations, and changing this option prevents those messages from being displayed. Silence is golden, lowkey 🌙
  • certificate_algorithms — controls which cryptographic algorithms are requested for consumer and entitlement certificates during registration.

When set to current, subscription-manager queries the system's OpenSSL library for available public key and signature algorithms and sends them to the server, allowing the server to issue certificates using post-quantum cryptography (PQC) or other modern algorithms supported by both the client and the server.

When set to legacy, no algorithm preferences are sent and the server issues traditional RSA-signed certificates.

The default is legacy.

Caution: before setting this configuration to current, it is important to verify that the system's crypto policy supports post-quantum cryptography. The update-crypto-policies utility can be used to show and set a new policy. If the crypto policy applied to your system does not support post-quantum cryptography, then do not configure certificate_algorithms to current. Fr fr, check first bestie, don't just vibe-check your crypto 🔥

🎀 [RHSMCERTD] OPTIONS 🎀

These are the settings for rhsmcertd, the little background daemon that keeps checking on your certs. She's lowkey the hardest worker in the group chat, ngl.

  • certCheckInterval — the number of minutes between runs of the rhsmcertd daemon. That's it, that's the whole vibe. ⏰
  • splay — 1 to enable splay, 0 to disable splay. Bestie, if this is enabled, the feature delays the initial cert check by an amount between 0 seconds and the interval given for the action being delayed. So like, for example, if the certCheckInterval were set to 3 minutes, the initial cert check would begin somewhere between 2 minutes after start up (that's the minimum delay) and 5 minutes after start up. Why would you want this? It's genuinely useful to reduce peak load on the Satellite or entitlement service used by a large number of machines. It's giving "staggered arrival so the server doesn't get jumped" energy. 🦋
  • disable — set to 1 to disable rhsmcertd operation entirely. Like, she's off duty, don't @ her. 💀
  • auto_registration — set to 1 to enable automatic registration. Heads up though: automatic registration can only work on virtual machines running in the public cloud. Currently three public cloud providers are supported: AWS, Azure and Google Cloud. In order for rhsmcertd to perform automatic registration, please link your "Cloud ID" from your cloud provider to your "RHSM Organization ID" using https://cloud.redhat.com. Matchmaker matchmaker, fr fr. 🫶
  • auto_registration_interval — when auto_registration=1 and rhsmcertd is started, the auto_registration_interval is a maximum time delay to wait before attempting to register the system automatically. When splay=1, the attempt to register happens at a random point in time within the auto_registration_interval. When splay=0, the attempt to register happens immediately following the start of rhsmcertd. The format for this value is either HH:MM:SS or an integer number of minutes (default is 1). ✨
  • auto_registration_identity_interval — okay so when auto_registration=1 and the attempt to register within the auto_registration_interval results in an anonymous registration (that's where a temporary entitlement is granted without an identity certificate), then the auto_registration_identity_interval is used as a maximum time delay to wait following the anonymous registration before attempting to get a proper identity certificate (and subsequently a non-temporary entitlement certificate) from the entitlement server. When splay=1, the actual time delay to wait before getting the identity certificate is random within the auto_registration_identity_interval. When splay=0, the attempt to get an identity certificate happens immediately following the anonymous registration. The format for this value is either HH:MM:SS or an integer number of minutes (default is 10). It's giving "glow-up from temporary to official" and honestly? Iconic. 👑

🌈 [LOGGING] OPTIONS 🌈

  • default_log_level — the default log level for all loggers in subscription-manager, python-rhsm, and rhsmcertd. Note (and this part matters, bestie): other keys in this section will override this value for the specified logger. So this is the baseline vibe, and individual loggers can absolutely do their own thing. 🍓
  • MODULE_NAME[.SUBMODULE ...] = [log_level] — logging can be configured on a module-level basis via entries of the format above, where:
    • module_name is subscription_manager, rhsm, or rhsm-app.
    • submodule can be optionally specified to further override the logging level down to a specific file.
    • log_level is the log level to set the specified logger (one of: DEBUG, INFO, WARNING, ERROR, or CRITICAL).

Customising your own log levels per-module? That's main character energy right there. 🧚

💖 AUTHOR 💖

Bryan Kearney <bkearney@redhat.com> — shoutout to the icon who wrote this down for us. 🌸

👀 SEE ALSO 👀

Go read those too, iykyk. 📚

⭐ RESOURCES ⭐

Main web site: http://www.candlepinproject.org/ — click it, it's free. 🔥

🎀 COPYING 🎀

Copyright (c) 2010-2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt. Please respect the license, no cap — it's literally the law of the land (well, the law of the license). 💅

Okay that's the whole page, bestie, you made it to the end 🫶 This one's sourced from rhsm.conf, with a date field of - (yes really, that's all it says), and it goes out under the title RHSM.CONF(5). Mwah, go configure something beautiful 💜

📦 where this page comes from