Chapter 2. Install prerequisites for Red Hat Discovery
Discovery requires specific hardware, software, and environment configurations. You must install Discovery on a dedicated system that does not run any other workloads.
Discovery is a containerized solution that can be deployed on any RHEL or OpenShift Container Platform platform. The following documentation is written for Discovery installed on a dedicated RHEL system. No warranty or support is offered for installation on a nondedicated system.
- Install the following requirements for hardware, software, and the environment in which you are going to install and use Discovery.
2.1. Hardware prerequisites
The system on which you install Red Hat Discovery must meet or exceed these hardware requirements:
- CPU: 2 core minimum, with a recommended 4 cores
- RAM: 2 GB minimum, with a recommended 4 GB
- Disk Storage: 30 GB
Red Hat Discovery uses rootless Podman, which, by default, stores containers in the following filepath: ${HOME}/.local/share/containers. Ensure that the partition that contains this directory has at least 30 GB of storage. If Podman is configured to use a non-standard directory for container storage, ensure that the configured directory has 30 GB of storage.
2.2. Software prerequisites
The system on which you install Red Hat Discovery must meet these software requirements:
- Operating system: The latest version of Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, or Red Hat Enterprise Linux 10, installed as a clean install and specifically not upgraded from Red Hat Enterprise Linux 7 or any previous version.
The system must have
cgroups v2enabled and active. You can verify by running the following read-only command as a regular, not-root user. If it outputscgroup2fs, thencgroups v2is enabled.stat -fc %T /sys/fs/cgroupThe system must have a supported version of Podman installed, and its filesystem must have
d_typeenabled to support Podman container storage. You can verify thatd_typeis enabled by running the following read-only command as a regular, not-root user. If it outputstrue, then Podman is installed withd_typeenabled.LANG=C LC_ALL=C podman info | awk -F': ' '/Supports d_type/ {print $2}'
Installing and running Discovery requires a supported version of Red Hat Enterprise Linux with the Podman container tool. The Podman package is included with Red Hat Enterprise Linux 8 and later, so you are not required to obtain the Podman package separately. You need sudo privileges to install Podman if it is not yet installed, and you need Podman version 4.9.4 or later to successfully install Discovery.
The Discovery documentation is written for the most recent version of the Red Hat Discovery RPMs and container images installed on your system. No warranty or support is offered by Red Hat if the version of Discovery used is obsolete.
2.3. Other environment prerequisites
Review environment requirements for both the Red Hat Discovery server system and the systems in your IT infrastructure that you plan to scan.
In your network:
- If you want to use Discovery to scan a network that contains multiple air-gapped environments, you must install a Discovery server for each of those air-gapped environments.
On the system where Red Hat Discovery is installed and running:
- The system onto which Red Hat Discovery will be installed and run must be dedicated to Discovery work only and must not be used for either development or production work.
-
Do not run any
discoveryctlcommands as therootuser or by usingsudoorsu. Doing so will result in a broken installation. Podman is installed on the system during the installation process if it is not already present.
- For a disconnected installation, Podman will be installed on both the connected system and disconnected system if it is not already present.
The system must have an internet connection to access Red Hat subscription management services and Red Hat content.
- For a disconnected installation, the connected system on which you are downloading the containers must meet this requirement.
A Red Hat subscription must include access to the Discovery repository for the Red Hat Enterprise Linux version and system architecture. As part of the installation process, enable this repository on the system using
subscription-managerand install binary packages from it usingdnf.For a disconnected installation, the disconnected system must be able to install packages from a local package source that includes the Discovery repository.
Setting up and maintaining a local package source in a disconnected environment is outside the scope of Red Hat Discovery documentation. Ensure that the required repositories are accessible on the disconnected system. Common approaches include using Satellite to synchronize repositories to the disconnected environment or using a local package mirror configured with the required repositories.
The system must have access to the Red Hat Ecosystem Catalog with your Red Hat Customer Portal credentials.
For a disconnected installation, the connected system on which you are downloading the containers must meet this requirement.
NoteIf you cannot use the Red Hat Ecosystem Catalog to download Red Hat content, join the Red Hat Developer program to create a Red Hat Customer Portal account, obtain a Red Hat Developer subscription, and gain access to Red Hat content. For more information, see the Red Hat Developer website.
On the systems in your network where Discovery runs scans:
The following requirements apply to the systems that Discovery scans, not to the system where Discovery is installed and running.
- Any network sources that are targeted for scanning must be running the SSH protocol.
-
A user account that is used as a credential for a scan requires the
bashshell. The shell cannot be the/sbin/nologinshell or the/bin/falseshell. - A user account that is used as a credential for a network scan must have adequate permissions to run commands and read certain files on those systems. For example, some commands that run during a scan require privilege elevation to gather the complete set of facts for the scan. The Using Red Hat Discovery guide has additional information about the creation of credentials for network scans and the privileges that must be associated with those credentials to enable a more complete scan of network assets.
-
Discovery network scans will use program paths as defined in the target system’s
PATHvariable.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}