How to install or update packages in Red Hat Satellite 6?

Environment

• Red Hat Satellite 6
  • Optionally also Red Hat Capsule 6

Issue

• Unable to update and install packages in Red Hat Satellite 6.  The dnf update and dnf install commands fail with this error:

  WARNING: Excluding 11567 updates due to foreman-protector. 
  Use foreman-maintain packages install/update <package> 
  to safely install packages without restrictions.
  

• Is the dnf update or dnf install command blocked on Red Hat Satellite 6?

Resolution

Commands dnf update and dnf install are blocked by the foreman-protector feature.  This protects the Satellite software from updates or installs that break the Satellite services.

The below procedure is applicable to both Satellite (with foreman-protector enabled by default) and Capsule (where foreman-protector is disabled by default, but can be enabled manually).

• The following commands can be executed to perform package installs or updates on the Red Hat Satellite server:

  # satellite-maintain packages install package_name
  

  or:

  # satellite-maintain packages update package_name
  

  (Where "package_name" is a package name like "virt-who".)

• Please note, every time you run the above command to update or install packages, it calls satellite-installer to make sure that there is no package that could affect the Satellite software.

In order to fully update the server such as dnf update would do, run the command without specifying a package:

# satellite-maintain packages update

Older Satellite Versions

There is a different process on older Satellite versions which are past their end of life.

• One must unlock packages, do the update, lock the packages and run the satellite-installer command, manually.

  # satellite-maintain packages unlock
  
  # yum update
  
  # satellite-maintain packages lock
  

• And then:

  • For Satellite 6.8 and below:

    # satellite-installer --upgrade
    

  ...or for Satellite 6.9 and above:

    ```
    # satellite-installer
    ```
  

The above process can also be used to downgrade packages by using yum downgrade instead of yum update.  Note:  Downgrading or manual updating of packages on the Red Hat Satellite base OS is not recommended, as it may interfere with packages required by Red Hat Satellite and could lead to system inconsistency or service disruption.

A full backup or snapshot of the Red Hat Satellite server should be taken before performing such changes, as the Red Hat Satellite application may be affected.

Root Cause

• Previously, when using dnf to update or install packages on the Satellite base operating system, that command might also update the packages related to Red Hat Satellite.  This could result in system inconsistency.
• Satellite 6.6 introduced the foreman-protector dnf plugin.  This prevents users from installing and updating packages with dnf outside the knowledge of the Satellite software.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.