How to Setup Local Yum Repositories in CentOS 7

This post is part of an enterprise VDI deployment series using open-source components. Previously, we set up a DHCP Server and a TFTP Server.

In this guide, we will establish local Yum repositories. These repositories will serve as a local, high-speed mirror for software packages used to install and security-harden CentOS 7 thin clients over PXE network booting.

We will deploy this repository manager on the same CentOS 7 VM we used for the DHCP and TFTP services, taking advantage of the storage partition scheme (Disk 2) mounted at /var/www/ which we carved out in the initial system design.

---

1. Installing & Securing the Web Server

We will use the Apache HTTP Server to serve the Yum repository files to our thin clients over HTTP.

Install Apache HTTPD

yum install httpd -y

Apache Security Hardening

To protect the web server from basic information leakage attacks, disable HTTP TRACE requests:

echo 'TraceEnable off' >> /etc/httpd/conf/httpd.conf

Enable and Start the Apache Service

systemctl enable httpd.service && systemctl start httpd.service

Open Firewall Ports

Allow standard web traffic in the host firewall:

firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --reload && firewall-cmd --list-all

---

2. Enabling Upstream Repositories

To sync the repository packages locally, install the required synchronization and metadata utilities:

yum install yum-utils createrepo -y

We need to enable the respective repositories on this server so reposync can fetch packages from them.

EPEL Repository

Enable the Extra Packages for Enterprise Linux repo:

yum install epel-release -y

NUX Desktop Repository

Enable the NUX Dextop repository (required for desktop/VDI applications like rdesktop and VLC):

wget http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm
rpm -ivh nux-dextop-release-0-5.el7.nux.noarch.rpm

Microsoft Teams Repository

Create the repository config file /etc/yum.repos.d/teams.repo for Microsoft Teams:

cat > /etc/yum.repos.d/teams.repo << "EOF"
[teams]
name=teams
baseurl=https://packages.microsoft.com/yumrepos/ms-teams
enabled=1
gpgcheck=0
gpgkey=https://packages.microsoft.com/keys/microsoft.asc
EOF

TeamViewer Repository

Create the TeamViewer repository configuration file to support remote administration:

cat > /etc/yum.repos.d/teamviewer.repo << "EOF"
[teamviewer]
name=TeamViewer - $basearch
baseurl=http://linux.teamviewer.com/yum/stable/main/binary-$basearch/
gpgkey=http://linux.teamviewer.com/pubkey/TeamViewer2017.asc
gpgcheck=0
enabled=1
type=rpm-md
failovermethod=priority
EOF

---

3. Creating the Repository Directories

We will structure the local directories in Apache's web root directory to match the directory tree of upstream repositories. This keeps thin-client repository configurations as standard and simple as possible.

Run the following to build the required paths inside the LVM Disk 2 partition:

mkdir -p /var/www/html/download/nux/dextop/el7/x86_64/
mkdir -p /var/www/html/repos/centos/7/{os/x86_64,updates/x86_64,extras/x86_64}
mkdir -p /var/www/html/repos/centos/7/os/x86_64/LiveOS/
mkdir -p /var/www/html/repos/centos/7/os/x86_64/isolinux/
mkdir -p /var/www/html/pub/epel/7/x86_64/
mkdir -p /var/www/html/yumrepos/ms-teams/
mkdir -p /var/www/html/yum/stable/main/binary-x86_64/

---

4. Synchronizing & Creating Local Repositories

Now we sync package data from the upstream servers and generate the XML repository metadata.

Sync Nux Desktop Repo

reposync --plugins --repoid=nux-dextop --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/download/nux/dextop/el7/x86_64/ && createrepo --verbose --update /var/www/html/download/nux/dextop/el7/x86_64/

Sync CentOS Base (OS) Repo

reposync --gpgcheck --plugins --repoid=base --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/repos/centos/7/os/x86_64/ && createrepo --verbose --update /var/www/html/repos/centos/7/os/x86_64/ -g comps.xml

Sync CentOS Updates Repo

reposync --gpgcheck --plugins --repoid=updates --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/repos/centos/7/updates/x86_64/ && createrepo --verbose --update /var/www/html/repos/centos/7/updates/x86_64/

Sync CentOS Extras Repo

reposync --gpgcheck --plugins --repoid=extras --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/repos/centos/7/extras/x86_64/ && createrepo --update /var/www/html/repos/centos/7/extras/x86_64/

Sync EPEL Repo

reposync --gpgcheck --plugins --repoid=epel --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/pub/epel/7/x86_64/ && createrepo --verbose --update /var/www/html/pub/epel/7/x86_64/

Sync MS Teams Repo

reposync --plugins --repoid=teams --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/yumrepos/ms-teams/ && createrepo --verbose --update /var/www/html/yumrepos/ms-teams/

Sync TeamViewer Repo

reposync --plugins --repoid=teamviewer --newest-only --delete --downloadcomps --download-metadata --arch=x86_64 --norepopath --download_path=/var/www/html/yum/stable/main/binary-x86_64/ && createrepo --verbose --update /var/www/html/yum/stable/main/binary-x86_64/

---

What's Next?

Now that your local package repositories are fully synchronizing, your PXE setup has all the core files it needs!

In the next article, we will put everything together: we will configure the network PXE boot settings in BIOS, create the custom PXE menu, and execute a fully unattended operating system installation on our thin clients from start to finish.