Installing Sentinel Runtime

Objectives

  • Setting up a Meridian Sentinel running on one of the following Operating Systems

  • Secure access with encrypted passwords to the Karaf shell

  • Sentinel can be configured with the Karaf Shell from the server via ssh admin@localhost -p 8301

  • Sentinel is running as user sentinel without root permissions

Requirements

  • Linux physical server or a virtual machine running a supported Linux operating system

  • Internet access to download the installation packages

  • Ensure DNS is configured, localhost and your servers host name is resolved properly

  • Meridian Core instance runs on latest stable release

  • Java installed OpenJDK 8, OpenJDK 11

  • System user with administrative permissions (sudo) to perform the installation tasks

Time synchronization is a critical part of operating a monitoring system. Ensure you have a functional time synchronization process running with your operating system. If you are not familiar with this topic, the knowledgebase article Ensure time synchronization for your OpenNMS components is a good starting point.

Installing the Sentinel package

  • CentOS/RHEL 8

  • CentOS/RHEL 7

Install OpenJDK 11 JRE runtime
sudo dnf -y install java-11-openjdk-headless
Add repository and import GPG key
cat << EOF | sudo tee /etc/yum.repos.d/opennms-meridian.repo
[meridian]
name=Meridian for Red Hat Enterprise Linux and CentOS
baseurl=https://REPO_USER:REPO_PASS@meridian.opennms.com/packages/2021/stable/rhel8(1)
gpgcheck=1
gpgkey=http://yum.opennms.org/OPENNMS-GPG-KEY
EOF

sudo rpm --import https://yum.opennms.org/OPENNMS-GPG-KEY
1 Replace the REPO_USER and REPO_PASS with your Meridian subscription credentials.
Installing the of Meridian Sentinel
sudo dnf -y install meridian-sentinel
Disable the OpenNMS Meridian repository after installation to prevent unwanted upgrades when upgrading other packages on the server. After upgrade, Meridian requires manual steps to upgrade configuration files or migrate database schemas to a new version. For this reason, it is recommended to exclude the Meridian packages from update except when you are planning on performing an upgrade.
Disable auto updates for Meridian Sentinel
sudo dnf config-manager --disable meridian
Verify directory structure with the tree command
sudo dnf -y install tree
tree /opt/sentinel -L 1
Directory structure after successful installation
/opt/sentinel
├── bin
├── COPYING
├── deploy
├── etc
├── lib
└── system
Enable Meridian Sentinel on system boot and start immediately
sudo systemctl enable --now sentinel
Install OpenJDK 11 JRE runtime
sudo yum -y install java-11-openjdk-headless
Add repository and import GPG key
cat << EOF | sudo tee /etc/yum.repos.d/opennms-meridian.repo
[meridian]
name=Meridian for Red Hat Enterprise Linux and CentOS
baseurl=https://REPO_USER:REPO_PASS@meridian.opennms.com/packages/2021/stable/rhel7(1)
gpgcheck=1
gpgkey=http://yum.opennms.org/OPENNMS-GPG-KEY
EOF

sudo rpm --import https://yum.opennms.org/OPENNMS-GPG-KEY
1 Replace the REPO_USER and REPO_PASS with your Meridian subscription credentials.
Installing the of Meridian Sentinel
sudo yum -y install meridian-sentinel
Disable the OpenNMS Meridian repository after installation to prevent unwanted upgrades when upgrading other packages on the server. After upgrade, Meridian requires manual steps to upgrade configuration files or migrate database schemas to a new version. For this reason, it is recommended to exclude the Meridian packages from update except when you are planning on performing an upgrade.
Disable auto updates for Meridian Sentinel
sudo yum -y install yum-utils
sudo yum-config-manager --disable meridian
Verify directory structure with the tree command
sudo yum -y install tree
tree /opt/sentinel -L 1
Directory structure after successful installation
/opt/sentinel
├── bin
├── COPYING
├── deploy
├── etc
├── lib
└── system
Enable Meridian Sentinel on system boot and start immediately
sudo systemctl enable --now sentinel

Secure Access to Karaf Shell

Change the default user/password admin/admin for the Karaf shell and encrypt it.

  • CentOS/RHEL 7/8

Enable password encryption
sudo vi /opt/sentinel/etc/org.apache.karaf.jaas.cfg
#
# Boolean enabling / disabling encrypted passwords
#
encryption.enabled = true(1)
#...
encryption.algorithm = SHA-512(2)
1 Enable password encryption from false to true
2 Set a secure encryption algorithm like SHA-512

As soon the file is saved, Karaf will immediately encrypt the password in users.properties.

Set a secure admin password for Karaf
sudo vi /opt/sentinel/etc/users.properties
# All users, groups, and roles entered in this file are available after Karaf startup
# and modifiable via the JAAS command group. These users reside in a JAAS domain
# with the name "karaf".
#
# OPENNMS: Change the admin user from 'karaf' to 'admin'
admin = {CRYPT}C7AD...{CRYPT},_g_:admingroup(1)
1 Replace the whole string {CRYPT}C7AD…​{CRYPT} with your new password in plaintext. As soon you save the file the password will be SHA-512 encrypted.
Set restrictive file permissions
sudo chmod 600 /opt/sentinel/etc/users.properties
Password or encryption algorithm changes happen immediately. It is not required to restart the Sentinel
By default the Karaf Shell is restricted to 127.0.0.1. If you want enable remote access, set sshHost=0.0.0.0 in org.apache.karaf.shell.cfg. The change is applied immediately and a Sentinel restart is not required. If you have a firewall running on your host, allow 8301/tcp to grant access to the Karaf Shell.