RHEL Subscriptions and dnf Basics

Introduction¶

On RHEL, a fresh install can't install packages until it's registered with a subscription and has repositories enabled. This trips up everyone coming from Debian or from CentOS. Here's the whole path, plus what each failure means.

Register and attach¶

# Register the system to your Red Hat account (or an activation key)
subscription-manager register --username [email protected]
# or, better for automation:
subscription-manager register --org 1234567 --activationkey rhel9-prod

# Attach a subscription (Simple Content Access orgs auto-attach; older ones need this)
subscription-manager attach --auto

# What's the state?
subscription-manager status
subscription-manager list --consumed

Modern Red Hat accounts use Simple Content Access (SCA) — no per-host entitlement math, registering is enough. If status says "Overall Status: Disabled" that's SCA and it's fine.

Enable repositories¶

# See what's available
subscription-manager repos --list | grep -E 'rhel-9|Repo ID' | head

# Enable the usual set for RHEL 9
subscription-manager repos \
  --enable rhel-9-for-x86_64-baseos-rpms \
  --enable rhel-9-for-x86_64-appstream-rpms

# CodeReady Builder (devel headers, needed by some EPEL packages)
subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms

EPEL (community extras) is separate:

dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

dnf basics¶

dnf replaced yum; yum is now a symlink to dnf. Everyday commands:

dnf check-update                 # what has updates
dnf install httpd
dnf update                       # everything (dnf upgrade is a synonym)
dnf remove httpd
dnf info httpd
dnf provides */htpasswd          # which package ships this file
dnf history                      # transaction log
dnf history undo 42              # roll back transaction 42
dnf repoquery --requires httpd   # dependency inspection without installing

dnf list installed, dnf search <term>, and dnf clean all (nuke cached metadata when a repo looks stale) round it out.

Module streams (AppStream)¶

Some packages come as modules with multiple versions ("streams"). You pick one stream per module:

dnf module list nodejs
dnf module install nodejs:20         # enable stream 20 and install the default profile
dnf module reset nodejs              # unlock — needed before switching streams
dnf module install nodejs:22

Trying to install nodejs without choosing a stream gets you the distro default. Switching later requires reset first or dnf refuses with a conflict.

Pinning a version¶

dnf install python3-dnf-plugin-versionlock
dnf versionlock add httpd            # freeze at the current version
dnf versionlock list
dnf versionlock delete httpd

Useful when a later minor version breaks something and you need dnf update to skip just that package.

Verification and troubleshooting¶

subscription-manager identity      # is this host registered? what's the UUID
dnf repolist                       # enabled repos and package counts
dnf repolist --all                 # includes disabled ones

• This system is not registered / Unable to find a suitable repository — not registered, or registered but no repos enabled. Run subscription-manager repos --enable ....
• Errors during downloading metadata ... 403 Forbidden — the subscription doesn't cover that repo (e.g. trying to enable a Satellite/High-Touch repo on a Developer subscription), or the system clock is wrong and the entitlement cert looks expired. Check date and subscription-manager list --consumed.
• Modular dependency problem — two module streams conflict, or a package needs a stream you haven't enabled. dnf module list and reset/enable the right one.
• Package X is already installed on dnf install X-2.0 — a versionlock, or the newer package isn't in an enabled repo. dnf --showduplicates list X.
• RHEL in a container / image build — use subscription-manager on the host and the entitlement is shared into the build (podman build does this automatically with /etc/pki/entitlement), or use UBI (Universal Base Image) repos which need no subscription.
• subscription-manager register hangs / TLS error — a proxy. Set it in /etc/rhsm/rhsm.conf (proxy_hostname, proxy_port), not just the shell env.
• Lost registration after a clone/template — the new VM has the same consumer UUID. subscription-manager clean then re-register.

Related tools and reading¶

• On-site: Linux commands reference.
• Related posts: SELinux without setenforce 0, The Linux boot process explained.