Managing systems using the RHEL 9 web console

Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # dnf install cockpit

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see Section 1.5, “Connecting to the web console from a remote machine”

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.
3. Click Log In.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi cockpit.conf

2. Add the following text:

   [basic]
   action = none

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s host name:

      https://<server.hostname.example.com>:<port-number>

      For example:

      https://example.com:9090

   2. With the server’s IP address:

      https://<server.IP_address>:<port-number>

      For example:

      https://192.0.2.2:9090

3. After the login interface opens, log in with your RHEL system credentials.

Procedure

1. Open the disallowed-users file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/disallowed-users

2. Edit the file and remove the line for the root user:

   # List of users which are not allowed to login to Cockpit root
    

3. Save the changes and quit the editor.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:PORT_NUMBER
   • Remotely with the server hostname: https://example.com:PORT_NUMBER

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Open the /etc/issue.cockpit file in a text editor of your preference:

   # vi /etc/issue.cockpit

2. Add the content you want to display as the banner to the file, for example:

   This is an example banner for the RHEL web console login page.

   You cannot include any macros in the file, but you can use line breaks and ASCII art.

3. Save the file.

4. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

5. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

6. Save the file.

7. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

2. Add the following text to the file:

   [Session]
   IdleTimeout=<X>

   Substitute <X> with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Pick an unoccupied port, for example, <4488/tcp>, and instruct SELinux to allow the cockpit service to bind to that port:

   # semanage port -a -t websm_port_t -p tcp <4488>

   Note that a port can be used only by one service at a time, and thus an attempt to use an already occupied port implies the ValueError: Port already defined error message.

2. Open the new port and close the former one in the firewall:

   # firewall-cmd --service cockpit --permanent --add-port=<4488>/tcp
   # firewall-cmd --service cockpit --permanent --remove-port=9090/tcp

3. Create an override file for the cockpit.socket service:

   # systemctl edit cockpit.socket

4. In the following editor screen, which opens an empty override.conf file located in the /etc/systemd/system/cockpit.socket.d/ directory, change the default port for the web console from 9090 to the previously picked number by adding the following lines:

   [Socket]
   ListenStream=
   ListenStream=<4488>

   Note that the first ListenStream= directive with an empty value is intentional. You can declare multiple ListenStream directives in a single socket unit and the empty value in the drop-in file resets the list and disables the default port 9090 from the original unit.

   Important

   Insert the previous code snippet between the lines starting with # Anything between here and # Lines below this. Otherwise, the system discards your changes.

5. Save the changes by pressing Ctrl+O and Enter. Exit the editor by pressing Ctrl+X.

6. Reload the changed configuration:

   # systemctl daemon-reload

7. Check that your configuration is working:

   # systemctl show cockpit.socket -p Listen
   Listen=[::]:4488 (Stream)

8. Restart cockpit.socket:

   # systemctl restart cockpit.socket

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Manage the RHEL web console
     hosts: managed-node-01.example.com
     tasks:
       - name: Install RHEL web console
         ansible.builtin.include_role:
           name: rhel-system-roles.cockpit
         vars:
           cockpit_packages: default
           cockpit_port: 9050
           cockpit_manage_selinux: true
           cockpit_manage_firewall: true
           cockpit_certificates:
             - name: /etc/cockpit/ws-certs.d/01-certificate
               dns: ['localhost', 'www.example.com']
               ca: ipa

   The settings specified in the example playbook include the following:

   cockpit_manage_selinux: true

   Allow using the selinux system role to configure SELinux for setting up the correct port permissions on the websm_port_t SELinux type.

   cockpit_manage_firewall: true

   Allow the cockpit system role to use the firewalld system role for adding ports.

   cockpit_certificates: <YAML_dictionary>

   By default, the RHEL web console uses a self-signed certificate. Alternatively, you can add the cockpit_certificates variable to the playbook and configure the role to request certificates from an IdM certificate authority (CA) or to use an existing certificate and private key that is available on the managed node.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.cockpit/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Override manifest settings in the <systemd>.override.json file in a text editor of your choice, for example:

   1. To edit for all users, enter:

      # vi /etc/cockpit/<systemd>.override.json

   2. To edit for a single user, enter:

      # vi ~/.config/cockpit/<systemd>.override.json

2. Edit the required file with the following details:

   {
     "menu": {
     "services": null,
     "logs": {
         "order": -1
     }
    }
   }

   • The null value hides the services tab
   • The -1 value moves the logs tab to the first place.

3. Restart the cockpit service:

   # systemctl restart cockpit.service

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Software Updates.

   The list of available updates refreshes automatically after 24 hours. To trigger a refresh, click the Check for Updates button.

3. Apply updates. You can watch the update log while the update is running.

   1. To install all available updates, click the Install all updates button.
   2. If you have security updates available, you can install them separately by clicking the Install Security Updates button.
   3. If you have kpatch updates available, you can install them separately by clicking the Install kpatch updates button.

4. Optional: You can turn on the Reboot after completion switch for an automatic restart of your system.

   If you perform this step, you can skip the remaining steps of this procedure.

5. After the system applies updates, you get a recommendation to restart your system. Restart the system if the update included a new kernel or system services that you do not want to restart individually.

6. Click Ignore to cancel the restart, or Restart Now to proceed with restarting your system.

   After the system restart, log in to the web console and go to the Software Updates page to verify that the update is successful.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Software Updates.
3. In the Settings table, click the Edit button.
4. Pick one of the types of automatic updates. You can select from Security updates only, or All updates.
5. To modify the day of the automatic update, click on the every day drop-down menu and select a specific day.
6. To modify the time of the automatic update, click into the 6:00 field and select or type a specific time.
7. If you want to disable automatic software updates, select the No updates type.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Software Updates.
3. Apply an update of your system.
4. After a successful update, click Reboot system…​, Restart services…​, or Ignore

5. If you decide to ignore, you can return to the restart or reboot menu by doing one of the following:

   1. Rebooting:

      1. Click the Reboot system button in the Status field of the Software Updates page.
      2. (Optional) Write a message to the logged in users.
      3. Select a delay from the Delay drop-down menu.
      4. Click Reboot.

   2. Restarting services:

      1. Click the Restart services…​ button in the Status field of the Software Updates page.

         You will see a list of all the services that require a restart.

      2. Click Restart services.

         Depending on your choice, the system will reboot or your services will restart.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Software Updates.

3. Check the status of your kernel patching settings.

   1. If the patching is not installed, click Install.

      

   2. To enable kernel patching, click Enable.

      

   3. Check the check box for applying kernel patches.

   4. Select whether you want to apply patches for current and future kernels or the current kernel only. If you decide to subscribe to applying patches for future kernels, the system also applies patches for the upcoming kernel releases.

      

   5. Click Apply.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the Health filed in the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to page with your subscription information.

   

3. In the Overview field, click Register.

4. In the Register system dialog box, select Account to register by using your account credentials.

   

5. Enter your username.
6. Enter your password.

7. Optionally, enter your organization’s name or ID.

   If your account belongs to more than one organization on the Red Hat Customer Portal, you must add the organization name or organization ID. To get the org ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Insights, clear the Insights check box.
8. Click Register.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the Health field on the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to the page with your subscription information.

   .

3. In the Overview filed, click Register.

4. In the Register system dialog box, select Activation key to register using an activation key.

   

5. Enter your key or keys.

6. Enter your organization’s name or ID.

   To get the organization ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Insights, clear the Insights check box.
7. Click Register.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the RHEL 9 web console, click your <username>@<hostname> in the top left corner of the Overview page.

   

3. From the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add.

5. (Optional) Add the user name for the account to which you want to connect.

   You can use any user account of the remote system. However, if you use the credentials of a user account without administration privileges, you cannot perform administration tasks.

   If you use the same credentials as on your local system, the web console authenticates remote systems automatically every time you log in. Note that using the same credentials on more systems weakens the security.

6. (Optional) Click the Color field to change the color of the system.
7. Click Add.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the RHEL 9 web console, click your <username>@<hostname> in the top left corner of the Overview page.

   

3. From the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add.

5. Add the user name for the account to which you want to connect.

   You can use any user account of the remote system. However, if you use a user account without administration privileges, you cannot perform administration tasks.

6. (Optional) Click the Color field to change the color of the system.

7. Click Add.

   A new dialog window appears asking for a password.

8. Enter the user account password.

9. Check Authorize SSH key if you already have an SSH key.

   

10. Check Create a new SSH key and authorize it if you do not have an SSH key. The web console creates the key.

    

    1. Add a password for the SSH key.
    2. Confirm the password.
11. Click Log in.

Verification

1. Log out.
2. Log back in.
3. Click Log in in the Not connected to host screen.

4. Select SSH key as your authentication option.

   
5. Enter your key password.
6. Click Log in.

Procedure

1. Create a list of the target hosts that can be accessed by the delegation rule:

   1. Create a service delegation target:

      $ ipa servicedelegationtarget-add cockpit-target

   2. Add the target host to the delegation target:

      $ ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM

2. Allow cockpit sessions to access the target host list by creating a service delegation rule and adding the HTTP service Kerberos principal to it:

   1. Create a service delegation rule:

      $ ipa servicedelegationrule-add cockpit-delegation

   2. Add the web console client to the delegation rule:

      $ ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM

   3. Add the delegation target to the delegation rule:

      $ ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

3. Enable Kerberos authentication on the remote.idm.example.com host:

   1. SSH to remote.idm.example.com as root.
   2. Open the /etc/ssh/sshd_config file for editing.
   3. Enable GSSAPIAuthentication by uncommenting the GSSAPIAuthentication no line and replacing it with GSSAPIAuthentication yes.

4. Restart the SSH service on remote.idm.example.com so that the above changes take effect immediately:

   $ systemctl try-restart sshd.service

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create a web-console-smart-card-ssh.yml playbook with the following content:

   1. Create a task that ensures the presence of a delegation target:

      ---
      - name: Playbook to create a constrained delegation target
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        - name: Ensure servicedelegationtarget web-console-delegation-target is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target

   2. Add a task that adds the target host to the delegation target:

        - name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target
            principal: host/remote.idm.example.com@IDM.EXAMPLE.COM
            action: member

   3. Add a task that ensures the presence of a delegation rule:

        - name: Ensure servicedelegationrule delegation-rule is present
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule

   4. Add a task that ensures that the Kerberos principal of the web console client service is a member of the constrained delegation rule:

        - name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            principal: HTTP/myhost.idm.example.com
            action: member

   5. Add a task that ensures that the constrained delegation rule is associated with the web-console-delegation-target delegation target:

        - name: Ensure a constrained delegation rule is associated with a specific delegation target
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            target: web-console-delegation-target
            action: member

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml

5. Enable Kerberos authentication on remote.idm.example.com:

   1. SSH to remote.idm.example.com as root.
   2. Open the /etc/ssh/sshd_config file for editing.
   3. Enable GSSAPIAuthentication by uncommenting the GSSAPIAuthentication no line and replacing it with GSSAPIAuthentication yes.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the Configuration field of the Overview tab click Join Domain.
3. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
4. In the Domain administrator name field, enter the user name of the IdM administration account.
5. In the Domain administrator password, add a password.
6. Click Join.

Verification

1. If the RHEL 9 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.

2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

   $ id
   euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Procedure

1. Install the opensc and gnutls-utils packages:

   # dnf -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \ --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set a label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \ --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \ --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key and storing your certificate in the next step. Specifying your own value for --id is recommended as otherwise a more complicated value is calculated by the tool.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \ --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. Optional: Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key or certificate, specify the same ID as the ID of the private key or certificate.

7. Optional: Certain smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

4. Optional: Disable password based authentication in cockpit.conf with:

   [Basic]
   action = none

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

Procedure

1. Set up constraint delegation rules to list which hosts the ticket can access.

   Example 8.1. Setting up constraint delegation rules

   The web console session runs host host.example.com and should be trusted to access its own host with sudo. Additionally, we are adding second trusted host - remote.example.com.

   • Create the following delegation:

     • Run the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target
       # ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/host.example.com@EXAMPLE.COM \ --principals=host/remote.example.com@EXAMPLE.COM

     • To allow the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation
       # ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/host.example.com@EXAMPLE.COM
       # ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

3. To apply the changes, restart the system:

   # systemctl daemon-reload
   # systemctl stop cockpit