Chapter 5. Managing remote systems in the web console

Procedure

1. Open the web console login page.
2. Specify the username on the remote host in the User name field.
3. Click Other options to reveal the Connect to text field.

4. Specify the remote host you want to connect to using SSH in the Connect to text field. If you do not specify any port, the web console attempts to connect to port 22 on the specified remote host.

   
5. Click Log in.

Procedure

1. In your terminal, open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

2. Add the following text:

   [WebService]
   AllowMultiHost=yes

   Warning

   The host switcher is deprecated and disabled by default. Due to web technology limitations, this feature cannot be secure. Do not enable the host switcher if you connect to untrusted hosts because all connected systems can make arbitrary changes to the rest of the connected. As a more secure alternative, you can either use the web console login page with the secure limit of one host in a web browser session or the Cockpit Client Flatpak.

3. Save the file.

4. Restart the web console to ensure the changes take effect.

   # systemctl try-restart cockpit

5. In the RHEL web console, click <username>@<hostname> in the top left corner of the Overview page.

   

6. In the drop-down menu, click Add new host.
7. In the Add new host dialog box, specify the host you want to add.

8. Optional: Add the username for the account you want to connect to.

   You can use any user account of the remote system. However, if you use the credentials of a user account without administration privileges, you cannot perform administration tasks.

   If you use the same credentials as on your local system, the web console authenticates remote systems automatically every time you log in.

   Important

   The web console does not save passwords used to log in to remote systems.

9. Optional: Click the Color field to change the color of the system.
10. Click Add.

Procedure

1. Log in to the RHEL 10 web console.

2. In the RHEL web console, click <username>@<hostname> in the top left corner of the Overview page.

   
3. In the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add. If you connect to the host for the first time, you must click Trust and add new host in the following dialog box.

5. The password dialog box differs depending on the existence of an SSH key file on the host:

   1. If you already have the SSH key for the host, select the Authorize SSH key option.
   2. If you do not have the SSH key, select the Create a new SSH key and authorize it option. The web console creates the key.
6. Add and confirm a password for the SSH key.
7. Click Log in.

Verification

1. Log out.
2. Log back in.
3. Click Log in in the Not connected to host screen.
4. Select SSH key as your authentication option.
5. Enter your key password.
6. Click Log in.

Procedure

1. In the Terminal page, verify that the web console has created a Service for User to Proxy (S4U2proxy) Kerberos ticket in the user session:

   $ klist
   …
   Valid starting     Expires            Service principal
   05/20/25 09:19:06 05/21/25 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
   …

2. Create a list of the target hosts that the delegation rule can access:

   1. Create a service delegation target:

      $ ipa servicedelegationtarget-add cockpit-target

   2. Add the target host to the delegation target:

      $ ipa servicedelegationtarget-add-member cockpit-target \
        --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM

3. Allow cockpit sessions to access the target host list by creating a service delegation rule and adding the HTTP service Kerberos principal to it:

   1. Create a service delegation rule:

      $ ipa servicedelegationrule-add cockpit-delegation

   2. Add the web console client to the delegation rule:

      $ ipa servicedelegationrule-add-member cockpit-delegation \
        --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM

   3. Add the delegation target to the delegation rule:

      $ ipa servicedelegationrule-add-target cockpit-delegation \
        --servicedelegationtargets=cockpit-target

4. Enable Kerberos authentication on the remote.idm.example.com host:

   1. Connect through SSH to remote.idm.example.com as root.
   2. Add the GSSAPIAuthentication yes line to the /etc/ssh/sshd_config file.

5. Restart the sshd service on remote.idm.example.com so that the changes take effect immediately:

   $ systemctl try-restart sshd.service

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create secret.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      ipaadmin_password: <admin_password>

   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. In the Terminal page, verify that the web console has created a Service for User to Proxy (S4U2proxy) Kerberos ticket in the user session:

   $ klist
   …
   Valid starting     Expires            Service principal
   05/20/25 09:19:06 05/21/25 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
   …

4. Create a web-console-smart-card-ssh.yml playbook with the following content:

   1. Create a task that ensures the presence of a delegation target:

      ---
      - name: Playbook to create a constrained delegation target
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        - name: Ensure servicedelegationtarget web-console-delegation-target is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target

   2. Add a task that adds the target host to the delegation target:

        - name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target
            principal: host/remote.idm.example.com@IDM.EXAMPLE.COM
            action: member

   3. Add a task that ensures the presence of a delegation rule:

        - name: Ensure servicedelegationrule delegation-rule is present
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule

   4. Add a task that ensures that the Kerberos principal of the web console client service is a member of the constrained delegation rule:

        - name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            principal: HTTP/myhost.idm.example.com
            action: member

   5. Add a task that ensures that the constrained delegation rule is associated with the web-console-delegation-target delegation target:

        - name: Ensure a constrained delegation rule is associated with a specific delegation target
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            target: web-console-delegation-target
            action: member

   6. Add a task that enable Kerberos authentication on remote.idm.example.com:

        - name: Enable Kerberos authentication
          hosts: remote.idm.example.com
          vars:
            sshd_config:
              GSSAPIAuthentication: true
          roles:
            - role: rhel-system-roles.sshd

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml