Chapter 1. Getting started with the RHEL web console

Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # dnf install cockpit

   Copy to Clipboard Toggle word wrap

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

   Copy to Clipboard Toggle word wrap

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Copy to Clipboard Toggle word wrap
   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see the Connecting to the web console from a remote machine section.

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.

3. Click Log In.

   After successful authentication, the RHEL web console interface opens.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi cockpit.conf

   Copy to Clipboard Toggle word wrap

2. Add the following text:

   [basic]
   action = none

   Copy to Clipboard Toggle word wrap
3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s hostname:

      https://<server.hostname.example.com>:<port-number>

      Copy to Clipboard Toggle word wrap

      For example:

      https://example.com:9090

      Copy to Clipboard Toggle word wrap

   2. With the server’s IP address:

      https://<server.IP_address>:<port-number>

      Copy to Clipboard Toggle word wrap

      For example:

      https://192.0.2.2:9090

      Copy to Clipboard Toggle word wrap
3. After the login interface opens, log in with your RHEL system credentials.

Procedure

1. Open the disallowed-users file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/disallowed-users

   Copy to Clipboard Toggle word wrap

2. Edit the file and remove the line for the root user:

   # List of users which are not allowed to login to Cockpit root
    

   Copy to Clipboard Toggle word wrap
3. Save the changes and quit the editor.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:9090
   • Remotely with the server hostname: https://example.com:9090

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:9090

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that displays in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Open the /etc/issue.cockpit file in a text editor of your preference:

   # vi /etc/issue.cockpit

   Copy to Clipboard Toggle word wrap

2. Add the content you want to display as the banner to the file, for example:

   This is an example banner for the RHEL web console login page.

   Copy to Clipboard Toggle word wrap

   You cannot include any macros in the file, but you can use line breaks and ASCII art.

3. Save the file.

4. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to Clipboard Toggle word wrap

5. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to Clipboard Toggle word wrap

2. Add the following text to the file:

   [Session]
   IdleTimeout=<X>

   Copy to Clipboard Toggle word wrap

   Substitute <X> with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Pick an unoccupied port, for example, <4488/tcp>, and instruct SELinux to allow the cockpit service to bind to that port:

   # semanage port -a -t websm_port_t -p tcp <4488>

   Copy to Clipboard Toggle word wrap

   Note that a port can be used only by one service at a time, and thus an attempt to use an already occupied port implies the ValueError: Port already defined error message.

2. Open the new port and close the former one in the firewall:

   # firewall-cmd --service cockpit --permanent --add-port=<4488>/tcp
   # firewall-cmd --service cockpit --permanent --remove-port=9090/tcp

   Copy to Clipboard Toggle word wrap

3. Create an override file for the cockpit.socket service:

   # systemctl edit cockpit.socket

   Copy to Clipboard Toggle word wrap

4. In the following editor screen, which opens an empty override.conf file located in the /etc/systemd/system/cockpit.socket.d/ directory, change the default port for the web console from 9090 to the previously picked number by adding the following lines:

   [Socket]
   ListenStream=
   ListenStream=<4488>

   Copy to Clipboard Toggle word wrap

   Note that the first ListenStream= directive with an empty value is intentional. You can declare multiple ListenStream directives in a single socket unit and the empty value in the drop-in file resets the list and disables the default port 9090 from the original unit.

   Important

   Insert the previous code snippet between the lines starting with # Anything between here and # Lines below this. Otherwise, the system discards your changes.

5. Save the changes, and exit the editor.

6. Reload the changed configuration:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

7. Check that your configuration is working:

   # systemctl show cockpit.socket -p Listen
   Listen=[::]:4488 (Stream)

   Copy to Clipboard Toggle word wrap

8. Restart cockpit.socket:

   # systemctl restart cockpit.socket

   Copy to Clipboard Toggle word wrap