Automating RHEL Kickstart Installations over PXE

Deploying operating systems manually across large fleets of enterprise physical servers or virtual machines is highly inefficient. When building staging environments or scaling bare-metal infrastructure, automating the OS installation workflow is essential.

Kickstart provides a declarative method to fully automate Red Hat Enterprise Linux (RHEL) installations. By pairing a Kickstart manifest file with a PXE (Preboot Execution Environment) boot network and a local package repository, servers can boot over the network and install the OS entirely unattended.

In this guide, I will share a structural enterprise Kickstart manifest template used to automate RHEL 7 installations, configuring local repository mirrors, automated disk partitioning, root password hashing, and system security baselines.

Prerequisites

You will need a functional PXE boot server configured with TFTP and DHCP services, alongside a local web server hosting RHEL installation media.

---

Step 1: Structuring the Kickstart Manifest (ks.cfg)

Below is a production-tested Kickstart configuration manifest. It directs the Anaconda installer to pull packages from a local repository mirror (north-dc1-repo1.induslevel.com), format disks with LVM, enforce secure password hashing policies, and install a minimal operating system baseline.

Create the file /var/www/html/ks.cfg on your local web server:

# /var/www/html/ks.cfg
# System authorization information
auth --enableshadow --passalgo=sha512

# Define local network repository URL
url --url="http://north-dc1-repo1.induslevel.com/content/dist/rhel/server/7/7.4/x86_64/os/"
repo --name=epel-release --baseurl=http://north-dc1-repo1.induslevel.com/pub/epel/7/x86_64/

# Enforce graphical install mode
graphical

# System language and keyboard layout
lang en_US.UTF-8
keyboard --vckeymap=us --xlayouts='us'

# System timezone
timezone America/New_York --isUtc

# Network configuration (DHCP allocation)
network --bootproto=dhcp --device=ens192 --ipv6=auto --activate
network --hostname=localhost.localdomain

# Root password (hashed with SHA-512)
rootpw --iscrypted $6$NxNU5sg5TvpkMllG$XXg6Xzq38k8JCAK0zPykL3fpAbwbdG80I2ab7D5pQUGtfTIRZzgj7Fo4A7PvSXi000ySn0d12Qco1LDjSXZ4G1

# System security and firewall baseline
selinux --disabled
firewall --enabled --port=22:tcp
eula --agreed
firstboot --disable

# Enable chronyd time synchronization service
services --enabled="chronyd"

# Package selection (Minimal OS baseline)
%packages
@^minimal
@core
chrony
kexec-tools
%end

# Enable kernel crash dumping (Kdump)
%addon com_redhat_kdump --enable --reserve-mb='auto'
%end

# Enforce strict password complexity policies in Anaconda
%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end

---

Step 2: Advanced Automated Disk Partitioning Cheatsheet

Depending on your workload requirements, you can customize the Kickstart manifest to automate complex LVM or RAID disk partitioning schemes.

Enterprise LVM Partitioning Scheme

To format /dev/sda with a dedicated boot partition and an LVM volume group containing root, swap, /tmp, /var, and /var/log/audit, append this block to your manifest:

# Partition clearing information
bootloader --location=mbr --append="crashkernel=auto" --boot-drive=sda
zerombr
clearpart --all --initlabel

# Disk partitioning information
part /boot --fstype="xfs" --ondisk=sda --size=1024
part pv.252 --fstype="lvmpv" --ondisk=sda --size=91135
volgroup rhel --pesize=4096 pv.252

# Logical volumes
logvol /               --fstype="xfs"  --size=26624 --name=root            --vgname=rhel
logvol swap            --fstype="swap" --size=8188  --name=swap            --vgname=rhel
logvol /tmp            --fstype="xfs"  --size=10240 --name=tmp             --vgname=rhel
logvol /var            --fstype="xfs"  --size=15360 --name=var             --vgname=rhel
logvol /var/log        --fstype="xfs"  --size=20480 --name=var_log         --vgname=rhel
logvol /var/log/audit  --fstype="xfs"  --size=10240 --name=var_log_audit   --vgname=rhel

---

Step 3: Configuring PXE Boot Menu (pxelinux.cfg/default)

To direct PXE booting clients to pull this Kickstart configuration file unattended during boot, append the ks= parameter to your TFTP server's boot menu configuration file (/var/lib/tftpboot/pxelinux.cfg/default).

# /var/lib/tftpboot/pxelinux.cfg/default
DEFAULT rhel7-unattended
PROMPT 0
TIMEOUT 50
MENU TITLE PXE Network Boot Menu

LABEL rhel7-unattended
    MENU LABEL Install RHEL 7 (Unattended Kickstart)
    KERNEL rhel7/vmlinuz
    APPEND initrd=rhel7/initrd.img inst.ks=http://north-dc1-repo1.induslevel.com/ks.cfg devfs=nomount

References

• Red Hat Kickstart Syntax Reference