Installing RHEL 8 on Hetzner root servers

Hetzner is a very popular provider for so called root servers and VPS (Virtual private Servers) located in Germany with datacenters in Germany and Finnland. They are quite affordable and have good services as well.

The default installation image, sorry Hetzner, is crap (i.e. no logical volumes). The rescue system is not only a nice tool to recover from botched system configurations, it also comes with an image installer which allows users to install a custom system. The default selection is Arch, CentOS 7.6, some Debian and Ubuntu versions but no CentOS8 or even RHEL of any version.

Game over? No, you can create an own image, just put it on a web server and configure the installation accordingly.

Create your image

I just installed a VM from the ISO image that can be downloaded here.

Select the “Minimal” installation, register the machine at Red Hat with subscription-manager register, attach the RHEL OS with subscription-manager attach –auto and install tar and mdadm.

Caution! You need to put the image on a public available web space! Unregister your system and delete the SSH host keys!

subscription-manager unregister
subscription-manager clean
rm -rf /etc/ssh/ssh_host_*

An other important fact is that the Hetzner installer only knows about CentOS and only about version 7. On CentOS8 and RHEL8, the dracut binary is located elsewhere than on RHEL7, you need to create a Symlink.

[root@localhost /]# ln -s /usr/bin/dracut /sbin/dracut

For the same reason you need to name the tarball CentOS-<something>

The next step is to create the tarball. Important to know is that the tarball must not contain /dev, /proc and /sys folders.

[root@localhost /]# tar cJvf CentOS-80-el-x86_64-minimal.tar.xz --exclude=/dev/* --exclude=/proc/* --exclude=/sys/* --exclude=/CentOS-80-el-x86_64-minimal.tar.xz /

Copy the resulting tarball to a public web space:

[root@localhost /]# scp CentOS-80-el-x86_64-minimal.tar.xz

Yes, you can use my image if you like:

Reboot your server into the rescue mode

Point your browser to, select your server, click on “Rescue” on the server menue, select “64 bit” and click on “Activate Rescue System”. The root password will be shown which will be needed to log in to the system.

Configure the installer

Configuring the installer is straight forward. Create a file called config.txt with the following content:

DRIVE1 /dev/sda
DRIVE2 /dev/sdb
HOSTNAME localhost.localdomain
PART /boot ext2     1024M
PART lvm   rhel       all

LV rhel   root   /       xfs     20G
LV rhel   swap   swap    swap     16G
LV rhel   tmp    /tmp    xfs      1G
LV rhel   home   /home   xfs      4G
LV rhel   var   /var   xfs      4G
LV rhel   var_log   /var/log   xfs      4G
LV rhel   var_log_audit   /var/log/audit   xfs      4G


The partitioning is according to PCI-DSS. Note that the installer can not set the mount options needed by PCI-DSS (and a lot of other regularities).

Side note: The Hetzner installer refuses to install the image if /boot is of type xfs. You need to choose ext2,3 or ext4. I’m using ext2 as this is the most efficient file system, fsck on unclean shutdown for 1GByte takes just a few seconds, it does not matter.

Run the installer

Just run it and expect an error….

installimage -a -c config.txt

Hetzner Installer

The installer tries to install some packages which will, of course, fail as the system is not registered to RHSM yet.

[14:26:11] # Running some centos specific functions
[14:26:11] # chroot: chkconfig iptables off
[14:26:11] :   error reading information on service iptables: No such file or directory
[14:26:11] # chroot: chkconfig ip6tables off
[14:26:11] :   error reading information on service ip6tables: No such file or directory
[14:26:11] # chroot: chkconfig postfix off
[14:26:11] :   error reading information on service postfix: No such file or directory
[14:26:11] # Testing and setup of cpanel image
[14:26:11] # chroot: yum check-update
[14:26:12] :   Updating Subscription Management repositories.
[14:26:12] :   Unable to read consumer identity
[14:26:12] :   This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
[14:26:12] :   Error: There are no enabled repos.
[14:26:12] # chroot: yum -y install polkit
[14:26:12] :   Updating Subscription Management repositories.
[14:26:12] :   Unable to read consumer identity
[14:26:12] :   This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
[14:26:13] :   Error: There are no enabled repos.
[14:26:13] => FAILED
[14:26:13] :   report install.conf to rz-admin: 1281870
[14:26:13] :   report debug.txt to rz-admin: ok
[14:26:13] cleaning up

You can just ignore that error messages, it does not matter.


Reboot the system and log in with the root password provided for the rescue system when activating the rescue system at

Change the password (needless to say?)

Continue to configure the system according your needs.

Have fun ๐Ÿ™‚

Migrating from CentOS8 to RHEL8

There are various reasons why to migrate from CentOS to RHEL. Quicker access to bugfixes and new minor releases as well as having a fully commercially supported system. Unfortunately most providers do not have an option to install RHEL but CentOS instead.

There are different tutorial on the net how to migrate from RHEL to CentOS but almost no information about the other way round. It is quite simple and at the end of the day you have only Red Hat Packages installed.

In 2012 I wrote an article about Migrating from CentOS6 to RHEL6. Subsequently I’ve posted a similar article for RHEL 7: Migrating from CentOS7 to RHEL7. Now its time for an update.


Some of the procedures can be destructive for your system and/or your data. I’m not taking any responsibility for any damage casue. Take a full backup of your system before even thinking about trying this procedure!

Also an important to note is that such a procedure is not supported by Redhat.


There are only two things you need

  • A valid RHEL subscription obtained from Redhats online store
  • A RHEL8 ISO-Image which corresponds with your current CentOS minor release (or newer) which can be downloaded at Redhat downloads


Be sure you activated your subscription.

Mount the ISO image on your CentOS8 machine:

[root@centos8 ~]# mount /dev/cdrom /mnt -o loop

Go to /mnt/BaseOS/Packages and install the packages we need:

[root@centos8 Packages]# rpm -e subscription-manager-rhsm-certificates --nodeps
[root@centos8 Packages]# yum localinstall subscription-manager-1*
[root@centos8 Packages]# yum localinstall subscription-manager-rhsm-certificates-1*

(Re)Move your CentOS repos
To avoid conflicts between CentOS and Redhat Repositories you need to get rid of them. Remove them or just keep a copy.

[root@centos8 Packages]# mkdir /etc/yum.repos.d.centos
[root@centos8 Packages]# mv /etc/yum.repos.d/CentOS-* /etc/yum.repos.d.centos

Force-remove the centos-release and yum RPMs

[root@centos8 Packages]# rpm -e centos-release --nodeps
[root@centos8 Packages]# yum localinstall redhat-release-8*

Unmount the ISO
This is important, otherwise yum reinstall will fail!

[root@centos8 ~]# umount /mnt

Register your system

To get access to RHEL repositories, you need to register your system. The username “” must be replaced with your username. The ID is a randomly generated UUID.

[root@centos8 ~]# subscription-manager register
Registering to:
The system has been registered with ID: 8aa7ef30-e834-4889-9e07-c5e8ce31e681 
The registered system name is:
[root@centos8 ~]# 

Attach the system to a subscription

Usually it is just good enough to auto-attach the subscription needed.

[root@centos8 ~]# subscription-manager attach --auto
Installed Product Current Status:
Product Name: Red Hat Enterprise Linux for x86_64
Status:       Subscribed

[root@centos8 ~]#

Review enabled repositories

Sometimes you dont want to use all the repos provided. The simplest way is just to disable all and re-enable those you need.

[root@centos8 ~]# yum repolist
Updating Subscription Management repositories.
Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)                                                 3.0 MB/s | 9.3 MB     00:03    
Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)                                                    2.9 MB/s | 8.1 MB     00:02    
repo id                                              repo name                                                                     status
rhel-8-for-x86_64-appstream-rpms                     Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)                      6,031
rhel-8-for-x86_64-baseos-rpms                        Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)                         2,193
[root@centos8 ~]# 

Adjust with subscription manager repos –disable|enable as needed.

Changing the Distribution

Now we have all requirements met, lets reinstall the packages.

[root@centos8 ~]# yum -y reinstall "*" 


Now we need to manually clean up the CentOS specific packages that have not been reinstalled.

[root@centos8 ~]# rpm -qa --queryformat "%{NAME} %{VENDOR}\n" | grep -i centos | cut -d' ' -f1
[root@centos8 ~]# 

Most of this packages are not problematic to remove and reinstall. Unfortunately this is not the case with the glibc packages. Do not try to remove them with –nodeps, you system will stop working. The problem is that the CentOS delivered packages seems to be newer than that provided by RHEL. This can be solved by downgrading the packages.

That may be the same with other packages as well.

[root@centos8 ~]# yum downgrade glibc

At the end, there will be one package left: python3-gpg. Due to some dependencies it can only be reinstalled after the rest of the packages are reinstalled/downgraded.

[root@centos8 ~]# yum reinstall python3-gpg

Check if there are still RPMs of vendor “Centos” installed:

[root@centos7 ~]# rpm -qa --queryformat "%{NAME} %{VENDOR}\n" | grep -i centos | cut -d' ' -f1

This should return nothing, almost all is now RHEL8. The only traces left are the previously installed Kernels. They will get deleted over time when installing (updating) new Kernels.

In my case I just used CentOS8 “Server” installation. If you plan to go down this road, please clone the system first for testing before migrating the actual system.

Support by Redhat

Will the converted machine be supported after this procedure? Well, officially it is not supported, but if there are no traces of CentOS left on the machineโ€ฆ

As mentioned before, better install RHEL in the first place ๐Ÿ™‚

Renew Letsencrypt certificates for Red Hat Satellite 6 and Capsule

Letsencrypt certificates are only valid for just three months. The procedure to renew x509 certificates in Red Hat Satellite 6 is not so straight forward and its even more complex for Capsule servers.

In an earlier post I was writing about how to set up a Satellite 6 and a capsule using Letsencrypt certificates. This post is a follow up on that.

Be aware: You must follow this procedure before the certificate expires or the Satellite simply stops working, all clients will refuse to communicate with the Red Hat Satellite Server. This is a security feature, not a bug.

Obtain the Satellite certificate

This is straight forward, stop the httpd and just use certbot, you must use the -d parameter because for the capsule it will fail.

systemctl stop httpd && certbot renew -d

Install the renewed certificate into Satellite

You need to run the Satellite installer to make your certificate active:

satellite-installer --scenario satellite --certs-server-cert "/etc/letsencrypt/live/" --certs-server-key "/etc/letsencrypt/live/" --certs-server-ca-cert "/root/ca-cert.pem" --certs-update-server --certs-update-server-ca

Keep the output as you need the oauth key and secret for the capsule.

Obtain the new certifcate for the capsule

This step must be done on the Satellite, not on the Caspule.

The only way to obtain a cert for a server different than than the target is to make use of the DNS challenge.

certbot -d --manual --preferred-challenges dns certonly

It will ask you to create a DNS TXT entry as a challenge to ensure you are in control of the domain. When your DNS entry is ready, hit enter.

Create the tarball with the certifcates for the Capsule

capsule-certs-generate --foreman-proxy-fqdn --certs-tar  "~/$CAPSULE-certs.tar" --server-cert "/etc/letsencrypt/live/" --server-key "/etc/letsencrypt/live/" --server-ca-cert "/root/" --certs-update-server

The next step is to copy the tarball to your capsule:

scp /root/

Install the new certificate on the Capsule

This step must be done on the Capsule server

satellite-installer --scenario capsule\
                      --foreman-proxy-content-parent-fqdn           ""\
                      --foreman-proxy-register-in-foreman           "true"\
                      --foreman-proxy-foreman-base-url              ""\
                      --foreman-proxy-trusted-hosts                 ""\
                      --foreman-proxy-trusted-hosts                 ""\
                      --foreman-proxy-oauth-consumer-key            "The Key"\
                      --foreman-proxy-oauth-consumer-secret         "The Secret"\
                      --foreman-proxy-content-certs-tar             "/root/"\
                      --puppet-server-foreman-url                   ""

Feedback welcome…

Have fun ๐Ÿ™‚