Chapter 1. Getting started using the RHEL web console

Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # yum install cockpit

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see Section 1.5, “Connecting to the web console from a remote machine”

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.
3. Click Log In.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi cockpit.conf

2. Add the following text:

   [basic]
   action = none

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s host name:

      https://<server.hostname.example.com>:<port-number>

      For example:

      https://example.com:9090

   2. With the server’s IP address:

      https://<server.IP_address>:<port-number>

      For example:

      https://192.0.2.2:9090

3. After the login interface opens, log in with your RHEL system credentials.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:PORT_NUMBER
   • Remotely with the server hostname: https://example.com:PORT_NUMBER

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. In the Configuration field of the Overview tab click Join Domain.
3. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
4. In the Domain administrator name field, enter the user name of the IdM administration account.
5. In the Domain administrator password, add a password.
6. Click Join.

Verification

1. If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.

2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

   $ id
   euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Procedure

1. Open the /etc/issue.cockpit file in a text editor of your preference:

   # vi /etc/issue.cockpit

2. Add the content you want to display as the banner to the file, for example:

   This is an example banner for the RHEL web console login page.

   You cannot include any macros in the file, but you can use line breaks and ASCII art.

3. Save the file.

4. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

5. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

6. Save the file.

7. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

2. Add the following text to the file:

   [Session]
   IdleTimeout=<X>

   Substitute <X> with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Pick an unoccupied port, for example, <4488/tcp>, and instruct SELinux to allow the cockpit service to bind to that port:

   # semanage port -a -t websm_port_t -p tcp <4488>

   Note that a port can be used only by one service at a time, and thus an attempt to use an already occupied port implies the ValueError: Port already defined error message.

2. Open the new port and close the former one in the firewall:

   # firewall-cmd --service cockpit --permanent --add-port=<4488>/tcp
   # firewall-cmd --service cockpit --permanent --remove-port=9090/tcp

3. Create an override file for the cockpit.socket service:

   # systemctl edit cockpit.socket

4. In the following editor screen, which opens an empty override.conf file located in the /etc/systemd/system/cockpit.socket.d/ directory, change the default port for the web console from 9090 to the previously picked number by adding the following lines:

   [Socket]
   ListenStream=
   ListenStream=<4488>

   Note that the first ListenStream= directive with an empty value is intentional. You can declare multiple ListenStream directives in a single socket unit and the empty value in the drop-in file resets the list and disables the default port 9090 from the original unit.

   Important

   Insert the previous code snippet between the lines starting with # Anything between here and # Lines below this. Otherwise, the system discards your changes.

5. Save the changes by pressing Ctrl+O and Enter. Exit the editor by pressing Ctrl+X.

6. Reload the changed configuration:

   # systemctl daemon-reload

7. Check that your configuration is working:

   # systemctl show cockpit.socket -p Listen
   Listen=[::]:4488 (Stream)

8. Restart cockpit.socket:

   # systemctl restart cockpit.socket