Managing systems in the RHEL web console

Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # dnf install cockpit

   Copy to Clipboard Toggle word wrap

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

   Copy to Clipboard Toggle word wrap

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Copy to Clipboard Toggle word wrap
   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see the Connecting to the web console from a remote machine section.

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.

3. Click Log In.

   After successful authentication, the RHEL web console interface opens.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi cockpit.conf

   Copy to Clipboard Toggle word wrap

2. Add the following text:

   [basic]
   action = none

   Copy to Clipboard Toggle word wrap
3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s hostname:

      https://<server.hostname.example.com>:<port-number>

      Copy to Clipboard Toggle word wrap

      For example:

      https://example.com:9090

      Copy to Clipboard Toggle word wrap

   2. With the server’s IP address:

      https://<server.IP_address>:<port-number>

      Copy to Clipboard Toggle word wrap

      For example:

      https://192.0.2.2:9090

      Copy to Clipboard Toggle word wrap
3. After the login interface opens, log in with your RHEL system credentials.

Procedure

1. Open the disallowed-users file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/disallowed-users

   Copy to Clipboard Toggle word wrap

2. Edit the file and remove the line for the root user:

   # List of users which are not allowed to login to Cockpit root
    

   Copy to Clipboard Toggle word wrap
3. Save the changes and quit the editor.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:9090
   • Remotely with the server hostname: https://example.com:9090

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:9090

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that displays in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Open the /etc/issue.cockpit file in a text editor of your preference:

   # vi /etc/issue.cockpit

   Copy to Clipboard Toggle word wrap

2. Add the content you want to display as the banner to the file, for example:

   This is an example banner for the RHEL web console login page.

   Copy to Clipboard Toggle word wrap

   You cannot include any macros in the file, but you can use line breaks and ASCII art.

3. Save the file.

4. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to Clipboard Toggle word wrap

5. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to Clipboard Toggle word wrap

2. Add the following text to the file:

   [Session]
   IdleTimeout=<X>

   Copy to Clipboard Toggle word wrap

   Substitute <X> with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Pick an unoccupied port, for example, <4488/tcp>, and instruct SELinux to allow the cockpit service to bind to that port:

   # semanage port -a -t websm_port_t -p tcp <4488>

   Copy to Clipboard Toggle word wrap

   Note that a port can be used only by one service at a time, and thus an attempt to use an already occupied port implies the ValueError: Port already defined error message.

2. Open the new port and close the former one in the firewall:

   # firewall-cmd --service cockpit --permanent --add-port=<4488>/tcp
   # firewall-cmd --service cockpit --permanent --remove-port=9090/tcp

   Copy to Clipboard Toggle word wrap

3. Create an override file for the cockpit.socket service:

   # systemctl edit cockpit.socket

   Copy to Clipboard Toggle word wrap

4. In the following editor screen, which opens an empty override.conf file located in the /etc/systemd/system/cockpit.socket.d/ directory, change the default port for the web console from 9090 to the previously picked number by adding the following lines:

   [Socket]
   ListenStream=
   ListenStream=<4488>

   Copy to Clipboard Toggle word wrap

   Note that the first ListenStream= directive with an empty value is intentional. You can declare multiple ListenStream directives in a single socket unit and the empty value in the drop-in file resets the list and disables the default port 9090 from the original unit.

   Important

   Insert the previous code snippet between the lines starting with # Anything between here and # Lines below this. Otherwise, the system discards your changes.

5. Save the changes, and exit the editor.

6. Reload the changed configuration:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

7. Check that your configuration is working:

   # systemctl show cockpit.socket -p Listen
   Listen=[::]:4488 (Stream)

   Copy to Clipboard Toggle word wrap

8. Restart cockpit.socket:

   # systemctl restart cockpit.socket

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Manage the RHEL web console
     hosts: managed-node-01.example.com
     tasks:
       - name: Install RHEL web console
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.cockpit
         vars:
           cockpit_packages: default
           cockpit_port: 9090
           cockpit_manage_selinux: true
           cockpit_manage_firewall: true
           cockpit_certificates:
             - name: /etc/cockpit/ws-certs.d/01-certificate
               dns: ['localhost', 'www.example.com']
               ca: ipa

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   cockpit_manage_selinux: true

   Allow using the selinux system role to configure SELinux for setting up the correct port permissions on the websm_port_t SELinux type.

   cockpit_manage_firewall: true

   Allow the cockpit system role to use the firewalld system role for adding ports.

   cockpit_certificates: <YAML_dictionary>

   By default, the RHEL web console uses a self-signed certificate. Alternatively, you can add the cockpit_certificates variable to the playbook and configure the role to request certificates from an IdM certificate authority (CA) or to use an existing certificate and private key that is available on the managed node.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.cockpit/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

1. In the web console, click Applications and use the Install button in the list of available and already-installed applications.

   

2. In the terminal, use the dnf install command:

   # dnf install <add-on>

   Copy to Clipboard Toggle word wrap

   In the previous command, replace <add-on> by a package name from the list of available add-on applications for the RHEL web console.

Procedure

1. Override manifest settings in the <systemd>.override.json file in a text editor of your choice, for example:

   1. To edit for all users, enter:

      # vi /etc/cockpit/<systemd>.override.json

      Copy to Clipboard Toggle word wrap

   2. To edit for a single user, enter:

      # vi ~/.config/cockpit/<systemd>.override.json

      Copy to Clipboard Toggle word wrap

2. Edit the required file with the following details:

   {
     "menu": {
     "services": null,
     "logs": {
         "order": -1
     }
    }
   }

   Copy to Clipboard Toggle word wrap
   • The null value hides the services tab
   • The -1 value moves the logs tab to the first place.

3. Restart the cockpit service:

   # systemctl restart cockpit.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.

2. In the Health filed in the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to page with your subscription information.

   

3. In the Overview field, click Register.
4. In the Register system dialog box, select Account to register by using your account credentials.
5. Enter your username.
6. Enter your password.

7. Optional: Enter your organization’s name or ID.

   If your account belongs to more than one organization on the Red Hat Customer Portal, you must add the organization name or organization ID. To get the org ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Lightspeed, clear the Insights checkbox.
8. Click Register.

Procedure

1. Log in to the RHEL 10 web console.

2. In the Health field on the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to the page with your subscription information.

   .

3. In the Overview filed, click Register.
4. In the Register system dialog box, select Activation key to register using an activation key.
5. Enter your key or keys.

6. Enter your organization’s name or ID.

   To get the organization ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Lightspeed, clear the Insights checkbox.
7. Click Register.

Procedure

1. Open the web console login page.
2. Specify the username on the remote host in the User name field.
3. Click Other options to reveal the Connect to text field.

4. Specify the remote host you want to connect to using SSH in the Connect to text field. If you do not specify any port, the web console attempts to connect to port 22 on the specified remote host.

   
5. Click Log in.

Procedure

1. In your terminal, open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

2. Add the following text:

   [WebService]
   AllowMultiHost=yes

   Copy to Clipboard Toggle word wrap
   Warning

   The host switcher is deprecated and disabled by default. Due to web technology limitations, this feature cannot be secure. Do not enable the host switcher if you connect to untrusted hosts because all connected systems can make arbitrary changes to the rest of the connected. As a more secure alternative, you can either use the web console login page with the secure limit of one host in a web browser session or the Cockpit Client Flatpak.

3. Save the file.

4. Restart the web console to ensure the changes take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

5. In the RHEL web console, click <username>@<hostname> in the top left corner of the Overview page.

   

6. In the drop-down menu, click Add new host.
7. In the Add new host dialog box, specify the host you want to add.

8. Optional: Add the username for the account you want to connect to.

   You can use any user account of the remote system. However, if you use the credentials of a user account without administration privileges, you cannot perform administration tasks.

   If you use the same credentials as on your local system, the web console authenticates remote systems automatically every time you log in.

   Important

   The web console does not save passwords used to log in to remote systems.

9. Optional: Click the Color field to change the color of the system.
10. Click Add.

Procedure

1. Log in to the RHEL 10 web console.

2. In the RHEL web console, click <username>@<hostname> in the top left corner of the Overview page.

   
3. In the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add. If you connect to the host for the first time, you must click Trust and add new host in the following dialog box.

5. The password dialog box differs depending on the existence of an SSH key file on the host:

   1. If you already have the SSH key for the host, select the Authorize SSH key option.
   2. If you do not have the SSH key, select the Create a new SSH key and authorize it option. The web console creates the key.
6. Add and confirm a password for the SSH key.
7. Click Log in.

Verification

1. Log out.
2. Log back in.
3. Click Log in in the Not connected to host screen.
4. Select SSH key as your authentication option.
5. Enter your key password.
6. Click Log in.

Procedure

1. In the Terminal page, verify that the web console has created a Service for User to Proxy (S4U2proxy) Kerberos ticket in the user session:

   $ klist
   …
   Valid starting     Expires            Service principal
   05/20/25 09:19:06 05/21/25 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
   …

   Copy to Clipboard Toggle word wrap

2. Create a list of the target hosts that the delegation rule can access:

   1. Create a service delegation target:

      $ ipa servicedelegationtarget-add cockpit-target

      Copy to Clipboard Toggle word wrap

   2. Add the target host to the delegation target:

      $ ipa servicedelegationtarget-add-member cockpit-target \
        --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

3. Allow cockpit sessions to access the target host list by creating a service delegation rule and adding the HTTP service Kerberos principal to it:

   1. Create a service delegation rule:

      $ ipa servicedelegationrule-add cockpit-delegation

      Copy to Clipboard Toggle word wrap

   2. Add the web console client to the delegation rule:

      $ ipa servicedelegationrule-add-member cockpit-delegation \
        --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

   3. Add the delegation target to the delegation rule:

      $ ipa servicedelegationrule-add-target cockpit-delegation \
        --servicedelegationtargets=cockpit-target

      Copy to Clipboard Toggle word wrap

4. Enable Kerberos authentication on the remote.idm.example.com host:

   1. Connect through SSH to remote.idm.example.com as root.
   2. Add the GSSAPIAuthentication yes line to the /etc/ssh/sshd_config file.

5. Restart the sshd service on remote.idm.example.com so that the changes take effect immediately:

   $ systemctl try-restart sshd.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create secret.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

      Copy to Clipboard Toggle word wrap

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      ipaadmin_password: <admin_password>

      Copy to Clipboard Toggle word wrap
   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. In the Terminal page, verify that the web console has created a Service for User to Proxy (S4U2proxy) Kerberos ticket in the user session:

   $ klist
   …
   Valid starting     Expires            Service principal
   05/20/25 09:19:06 05/21/25 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
   …

   Copy to Clipboard Toggle word wrap

4. Create a web-console-smart-card-ssh.yml playbook with the following content:

   1. Create a task that ensures the presence of a delegation target:

      ---
      - name: Playbook to create a constrained delegation target
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        - name: Ensure servicedelegationtarget web-console-delegation-target is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target

      Copy to Clipboard Toggle word wrap

   2. Add a task that adds the target host to the delegation target:

        - name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target
            principal: host/remote.idm.example.com@IDM.EXAMPLE.COM
            action: member

      Copy to Clipboard Toggle word wrap

   3. Add a task that ensures the presence of a delegation rule:

        - name: Ensure servicedelegationrule delegation-rule is present
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule

      Copy to Clipboard Toggle word wrap

   4. Add a task that ensures that the Kerberos principal of the web console client service is a member of the constrained delegation rule:

        - name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            principal: HTTP/myhost.idm.example.com
            action: member

      Copy to Clipboard Toggle word wrap

   5. Add a task that ensures that the constrained delegation rule is associated with the web-console-delegation-target delegation target:

        - name: Ensure a constrained delegation rule is associated with a specific delegation target
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            target: web-console-delegation-target
            action: member

      Copy to Clipboard Toggle word wrap

   6. Add a task that enable Kerberos authentication on remote.idm.example.com:

        - name: Enable Kerberos authentication
          hosts: remote.idm.example.com
          vars:
            sshd_config:
              GSSAPIAuthentication: true
          roles:
            - role: rhel-system-roles.sshd

      Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.
2. In the Configuration field of the Overview tab click Join Domain.
3. In the Join a Domain dialog box, enter the hostname of the IdM server in the Domain Address field.
4. In the Domain administrator name field, enter the username of the IdM administration account.
5. In the Domain administrator password, add a password.
6. Click Join.

Verification

1. If the RHEL 10 web console does not display an error, the system joined to the IdM domain and you can see the domain name in the System screen.

2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

   $ id

   Copy to Clipboard Toggle word wrap

   euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.
2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

   Copy to Clipboard Toggle word wrap

4. Optional: Disable password-based authentication in cockpit.conf with:

   [Basic]
   action = none

   Copy to Clipboard Toggle word wrap

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

   You are now connected and the web console displays its content.

Procedure

1. Set up constraint delegation rules to list which hosts the ticket can access.

   • Create the following example delegation:

     • Enter the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target

       Copy to Clipboard Toggle word wrap

       # ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/host.example.com@EXAMPLE.COM \ --principals=host/remote.example.com@EXAMPLE.COM

       Copy to Clipboard Toggle word wrap

     • To enable the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation

       Copy to Clipboard Toggle word wrap

       # ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/host.example.com@EXAMPLE.COM

       Copy to Clipboard Toggle word wrap

       # ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

       Copy to Clipboard Toggle word wrap

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

         Copy to Clipboard Toggle word wrap

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

         Copy to Clipboard Toggle word wrap

   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

      Warning

      The delegated S4U ticket is not forwarded to remote SSH hosts when connecting to them from the web console. Authenticating to sudo on a remote host with your ticket will not work.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.
4. Alternatively: Try to connect to a different host with SSH.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

   Copy to Clipboard Toggle word wrap

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

   Copy to Clipboard Toggle word wrap

3. To apply the changes, restart the system:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

   # systemctl stop cockpit

   Copy to Clipboard Toggle word wrap