Suscríbase a nuestro blog

We released Red Hat Satellite 6.12 last month. The release includes several new features designed to help you manage your Red Hat Enterprise Linux (RHEL) environment more effectively, including remote execution pull mode. In this blog entry, I’ll write about the differences between remote execution pull mode and push mode and provide a step-by-step guide on configuring it.

What is remote execution?

Remote execution (or REX) enables you to run shell scripts, Ansible tasks, and Ansible Playbooks on remote hosts managed by Satellite. Brian Smith wrote an extensive introduction to remote execution in Satellite. The official Satellite 6.12 documentation also describes remote execution in great depth.

REX jobs are dispatched to hosts by the Capsule server (or Capsule service running on a Satellite server) using the Secure Shell (SSH) service. Port 22 must be open on hosts to enable REX.  

What is remote execution pull mode?

Remote execution pull mode uses Message Queuing Telemetry Transport (MQTT) to publish jobs on Capsule servers (or Capsule service running on a Satellite server). Managed hosts subscribe to the MQTT broker to receive REX job notifications.

Here’s how REX Pull mode works:

  1. A managed host receives MQTT notification that there is a new REX job.
  2. The managed host downloads the job “payload” via HTTPS from the Capsule server.  
  3. The job “payload” is run on the host. As the job executes, the progress of the job is reported back to the Capsule server.

Here are the configuration considerations:

  • Port 1883 (MQTT) must be opened on the Capsule server to allow incoming traffic, and the host must be allowed to connect to the Capsule server on port 443 (HTTPS) to enable REX pull mode.
  • Capsule servers (and Capsule services) must be configured to support either REX push mode or REX pull mode. You cannot configure a Capsule to support both REX modes.
  • For existing hosts running the katello agent, you can migrate to REX pull mode by installing the katello-pull-transport-migrate package. Documentation is provided at the bottom of this post. The katello agent has been deprecated as of Satellite 6.7.

For customers with security policies that forbid the opening of port 22, REX pull mode provides some respite. Satellite 6.12 provides the first iteration of the implementation of REX pull mode. Expect to see additional features in Satellite 6.13.

When do I use Red Hat Ansible Automation Platform?

REX and the capability of running Ansible tasks and playbooks within Satellite are intended to automate the configuration of hosts. For example, after provisioning several hosts, one might apply a firewall system role (from the RHEL System Roles Collection) to configure the hosts’ firewall or install Microsoft SQL Server.

Ansible Automation Platform should be considered when configuration and Day 2 operations require automation, such as the following:

  • Orchestration of fleets of VMs across the open hybrid cloud
  • Managing the configuration of networking devices across data centers
  • Enabling application deployment to integrate load balancer changes and CMDB configuration
  • Enabling developers to provision their storage objects in an automated fashion when needed
  • Embedding the automated configuration of external services into the CI/CD pipeline
  • Integrating firewalls with intrusion detection systems into streamlined security remediation workflows
  • Managing the life cycle of existing applications and infrastructure, updating applications and hardware in streamlined processes

Go here for more information on Ansible Automation Platform.

Configuring remote execution pull mode


My environment consists of the following:

  • Red Hat Satellite 6.12 Satellite server running on RHEL 8.7
  • Red Hat Satellite 6.12 Capsule server running on RHEL 8.7

REX pull mode will be configured on the Capsule server.

Satellite Capsule configuration

On the Capsule server, enable pull-based transport.

satellite-installer --foreman-proxy-plugin-remote-execution-script-mode pull-mqtt

Open port 1883 to allow MQTT through the firewall.

firewall-cmd --add-port="1883/tcp"
firewall-cmd --runtime-to-permanent

Here’s a list of all the ports you should have open.

Satellite REX pull mode: screenshot of a terminal window displaying a list of the ports that should be open.

Finally, configure your Satellite server so that hosts registered to this Capsule server will continue to receive remote execution jobs from it. 

In Satellite, click on “Administer” and “Settings”.

Satellite REX pull mode: screenshot of the Administer > Settings menu with Settings highlighted with a red box

Click on the “Content” tab.

Satellite REX pull mode: screenshot of the Satellite Settings UI with the Content tab highlighted with a red box

Finally, set the attribute “Prefer registered through Capsule for remote execution” to Yes.

Screenshot of the UI with Yes highlighted with a red box

Capsule content

At this point, the new Capsule server may or may not have any content. In this example, the capsule has no content and needs to be synchronized. 

First, check that a lifecycle environment has been assigned to the Capsule. Click on Infrastructure and then the edit button of the Capsule server.

Screenshot showing the Edit button for the Capsule server highlighted with a red box

Click on the Lifecycle Environments tab.

Screenshot with the Lifecycle Environments tab highlighted with a red box

Select the desired Lifecycle Environment and click on Submit.

Screenshot showing the blue Submit button

Click on Infrastructure and then the name of the Capsule server. Click on Synchronize and select Optimized Sync.

Screenshot showing Optimized Sync selected and highlighted with a red box

Host registration

Let’s register a new host. In my Satellite server, I associated the desired Content Views and Activation Keys with a Host group to streamline the registration process.

Screenshot showing the Satellite Host Group options

In the Register Host menu, I will select my host group and the new capsule server configured with remote execution pull mode.

Screenshot showing one Capsule server selected in a drop down menu

Clicking the Generate button generates the registration command.

Screenshot showing a dark blue Generate button and the curl command it created

SSH into your new host and run the registration command. Here’s the resulting output.

Screenshot of a large terminal window with three sections highlighted, showing Running registration, Installing packages, and Installing Insights client
  1. Shows the registration of the new host.
  2. Shows the REX Pull agent, yggdrasild being installed. 
  3. The insights client is installed (since I like having Red Hat Insights analyze my hosts for vulnerabilities and being able to remediate them with a button click).

Checking operation

REX pull mode is now configured. You can check that it is working by the following methods:

  1. Check the yggdrasild service is running with systemctl status yggdrasild.
Screenshot of a terminal window showing that the yggdrasild service is running
  1. Run netstat to check port 1883 is connected. 
Screenshot of a slice of a terminal window showing that port 1883 is connected

Let’s test it out by installing a package.

Screenshot of a Satellite window where a package has been installed


Remote execution pull mode provides a different method of transport for remote execution jobs run by Satellite. Customers unable to open port 22 between hosts and Satellite infrastructure servers can now use alternative ports (MQTT - 1883, HTTPS - 443). For more information, please see the official documentation below.

Official documentation

Sobre el autor

As a Senior Principal Technical Marketing Manager in the Red Hat Enterprise Linux business unit, Matthew Yee is here to help everyone understand what our products do. He joined Red Hat in 2021 and is based in Vancouver, Canada.

Read full bio

Navegar por canal

automation icon


Las últimas novedades en la automatización de la TI para los equipos, la tecnología y los entornos

AI icon

Inteligencia artificial

Descubra las actualizaciones en las plataformas que permiten a los clientes ejecutar cargas de trabajo de inteligecia artificial en cualquier lugar

open hybrid cloud icon

Nube híbrida abierta

Vea como construimos un futuro flexible con la nube híbrida

security icon


Vea las últimas novedades sobre cómo reducimos los riesgos en entornos y tecnologías

edge icon

Edge computing

Conozca las actualizaciones en las plataformas que simplifican las operaciones en el edge

Infrastructure icon


Vea las últimas novedades sobre la plataforma Linux empresarial líder en el mundo

application development icon


Conozca nuestras soluciones para abordar los desafíos más complejos de las aplicaciones

Original series icon

Programas originales

Vea historias divertidas de creadores y líderes en tecnología empresarial