Managing systems using the RHEL 9 web console

Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # dnf install cockpit

   Copy to Clipboard Toggle word wrap

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

   Copy to Clipboard Toggle word wrap

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Copy to Clipboard Toggle word wrap
   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see Section 1.5, “Connecting to the web console from a remote machine”

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.
3. Click Log In.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi cockpit.conf

   Copy to Clipboard Toggle word wrap

2. Add the following text:

   [basic]
   action = none

   Copy to Clipboard Toggle word wrap
3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s host name:

      https://<server.hostname.example.com>:<port-number>

      Copy to Clipboard Toggle word wrap

      For example:

      https://example.com:9090

      Copy to Clipboard Toggle word wrap

   2. With the server’s IP address:

      https://<server.IP_address>:<port-number>

      Copy to Clipboard Toggle word wrap

      For example:

      https://192.0.2.2:9090

      Copy to Clipboard Toggle word wrap
3. After the login interface opens, log in with your RHEL system credentials.

Procedure

1. Open the disallowed-users file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/disallowed-users

   Copy to Clipboard Toggle word wrap

2. Edit the file and remove the line for the root user:

   # List of users which are not allowed to login to Cockpit root
    

   Copy to Clipboard Toggle word wrap
3. Save the changes and quit the editor.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:PORT_NUMBER
   • Remotely with the server hostname: https://example.com:PORT_NUMBER

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Open the /etc/issue.cockpit file in a text editor of your preference:

   # vi /etc/issue.cockpit

   Copy to Clipboard Toggle word wrap

2. Add the content you want to display as the banner to the file, for example:

   This is an example banner for the RHEL web console login page.

   Copy to Clipboard Toggle word wrap

   You cannot include any macros in the file, but you can use line breaks and ASCII art.

3. Save the file.

4. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to Clipboard Toggle word wrap

5. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to Clipboard Toggle word wrap

2. Add the following text to the file:

   [Session]
   IdleTimeout=<X>

   Copy to Clipboard Toggle word wrap

   Substitute <X> with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Pick an unoccupied port, for example, <4488/tcp>, and instruct SELinux to allow the cockpit service to bind to that port:

   # semanage port -a -t websm_port_t -p tcp <4488>

   Copy to Clipboard Toggle word wrap

   Note that a port can be used only by one service at a time, and thus an attempt to use an already occupied port implies the ValueError: Port already defined error message.

2. Open the new port and close the former one in the firewall:

   # firewall-cmd --service cockpit --permanent --add-port=<4488>/tcp
   # firewall-cmd --service cockpit --permanent --remove-port=9090/tcp

   Copy to Clipboard Toggle word wrap

3. Create an override file for the cockpit.socket service:

   # systemctl edit cockpit.socket

   Copy to Clipboard Toggle word wrap

4. In the following editor screen, which opens an empty override.conf file located in the /etc/systemd/system/cockpit.socket.d/ directory, change the default port for the web console from 9090 to the previously picked number by adding the following lines:

   [Socket]
   ListenStream=
   ListenStream=<4488>

   Copy to Clipboard Toggle word wrap

   Note that the first ListenStream= directive with an empty value is intentional. You can declare multiple ListenStream directives in a single socket unit and the empty value in the drop-in file resets the list and disables the default port 9090 from the original unit.

   Important

   Insert the previous code snippet between the lines starting with # Anything between here and # Lines below this. Otherwise, the system discards your changes.

5. Save the changes by pressing Ctrl+O and Enter. Exit the editor by pressing Ctrl+X.

6. Reload the changed configuration:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

7. Check that your configuration is working:

   # systemctl show cockpit.socket -p Listen
   Listen=[::]:4488 (Stream)

   Copy to Clipboard Toggle word wrap

8. Restart cockpit.socket:

   # systemctl restart cockpit.socket

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Manage the RHEL web console
     hosts: managed-node-01.example.com
     tasks:
       - name: Install RHEL web console
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.cockpit
         vars:
           cockpit_packages: default
           cockpit_manage_selinux: true
           cockpit_manage_firewall: true
           cockpit_certificates:
             - name: /etc/cockpit/ws-certs.d/01-certificate
               dns: ['localhost', 'www.example.com']
               ca: ipa

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   cockpit_manage_selinux: true

   Allow using the selinux system role to configure SELinux for setting up the correct port permissions on the websm_port_t SELinux type.

   cockpit_manage_firewall: true

   Allow the cockpit system role to use the firewalld system role for adding ports.

   cockpit_certificates: <YAML_dictionary>

   By default, the RHEL web console uses a self-signed certificate. Alternatively, you can add the cockpit_certificates variable to the playbook and configure the role to request certificates from an IdM certificate authority (CA) or to use an existing certificate and private key that is available on the managed node.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.cockpit/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Override manifest settings in the <systemd>.override.json file in a text editor of your choice, for example:

   1. To edit for all users, enter:

      # vi /etc/cockpit/<systemd>.override.json

      Copy to Clipboard Toggle word wrap

   2. To edit for a single user, enter:

      # vi ~/.config/cockpit/<systemd>.override.json

      Copy to Clipboard Toggle word wrap

2. Edit the required file with the following details:

   {
     "menu": {
     "services": null,
     "logs": {
         "order": -1
     }
    }
   }

   Copy to Clipboard Toggle word wrap
   • The null value hides the services tab
   • The -1 value moves the logs tab to the first place.

3. Restart the cockpit service:

   # systemctl restart cockpit.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the Health field on the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to page with your subscription information.
3. In the Overview field, click Register.

4. In the Register system dialog, select the registration method.

   Optional: Enter your organization’s name or ID. If your account belongs to more than one organization on the Red Hat Customer Portal, you must add the organization name or ID. To get the organization ID, check with your Technical Account Manager at Red Hat.

5. If you do not want to connect your system to Red Hat Red Hat Lightspeed, clear the Insights checkbox.
6. Click Register.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the Health field on the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to the page with your subscription information.

   

   View larger image

   

   .

3. In the Overview field, click Register.
4. In the Register system dialog box, select Activation key to register using an activation key.
5. Enter your key or keys.

6. Enter your organization’s name or ID.

   To get the organization ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Lightspeed, clear the Insights checkbox.
7. Click Register.

Procedure

1. Open the web console login page.
2. Enter the username on the remote host in the User name field.
3. Click Other options to reveal the Connect to text field.

4. Specify the remote host you want to connect to using SSH in the Connect to text field. If you do not specify any port, the web console attempts to connect to port 22 on the specified remote host.

   

   View larger image

   
5. Click Log in.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the RHEL web console, click <username>@<hostname> in the upper-left corner of the Overview page.

   

   View larger image

   
3. In the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add.

5. Optional: Add the username for the account you want to connect to.

   You can use any user account of the remote system. However, if you use the credentials of a user account without administration privileges, you cannot perform administration tasks.

   If you use the same credentials as on your local system, the web console authenticates remote systems automatically every time you log in.

   Important

   The web console does not save passwords used to log in to remote systems.

6. Optional: Click the Color field to change the color of the system.
7. Click Add.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the RHEL web console, click <username>@<hostname> in the top left corner of the Overview page.

   

   View larger image

   
3. In the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add. If you connect to the host for the first time, you must click Trust and add new host in the following dialog box.

5. The password dialog box differs depending on the existence of an SSH key file on the host:

   1. If you already have the SSH key for the host, select the Authorize SSH key option.
   2. If you do not have the SSH key, select the Create a new SSH key and authorize it option. The web console creates the key.
6. Add and confirm a password for the SSH key.
7. Click Log in.

Verification

1. Log out.
2. Log back in.
3. Click Log in in the Not connected to host screen.
4. Select SSH key as your authentication option.
5. Enter your key password.
6. Click Log in.

Procedure

1. In the Terminal page, verify that the web console has created a Service for User to Proxy (S4U2proxy) Kerberos ticket in the user session:

   $ klist
   …
   Valid starting     Expires            Service principal
   05/20/25 09:19:06 05/21/25 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
   …

   Copy to Clipboard Toggle word wrap

2. Create a list of the target hosts that the delegation rule can access:

   1. Create a service delegation target:

      $ ipa servicedelegationtarget-add cockpit-target

      Copy to Clipboard Toggle word wrap

   2. Add the target host to the delegation target:

      $ ipa servicedelegationtarget-add-member cockpit-target \
        --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

3. Allow cockpit sessions to access the target host list by creating a service delegation rule and adding the HTTP service Kerberos principal to it:

   1. Create a service delegation rule:

      $ ipa servicedelegationrule-add cockpit-delegation

      Copy to Clipboard Toggle word wrap

   2. Add the web console client to the delegation rule:

      $ ipa servicedelegationrule-add-member cockpit-delegation \
        --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM

      Copy to Clipboard Toggle word wrap

   3. Add the delegation target to the delegation rule:

      $ ipa servicedelegationrule-add-target cockpit-delegation \
        --servicedelegationtargets=cockpit-target

      Copy to Clipboard Toggle word wrap

4. Enable Kerberos authentication on the remote.idm.example.com host:

   1. Connect through SSH to remote.idm.example.com as root.
   2. Add the GSSAPIAuthentication yes setting to the /etc/ssh/sshd_config file.

5. Restart the sshd service on remote.idm.example.com so that the changes take effect immediately:

   $ systemctl try-restart sshd.service

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Terminal page, verify that the web console has created a Service for User to Proxy (S4U2proxy) Kerberos ticket in the user session:

   $ klist
   …
   Valid starting     Expires            Service principal
   05/20/25 09:19:06 05/21/25 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
   …

   Copy to Clipboard Toggle word wrap

2. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

3. Create a web-console-smart-card-ssh.yml playbook with the following content:

   1. Create a task that ensures the presence of a delegation target:

      ---
      - name: Playbook to create a constrained delegation target
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        - name: Ensure servicedelegationtarget web-console-delegation-target is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target

      Copy to Clipboard Toggle word wrap

   2. Add a task that adds the target host to the delegation target:

        - name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target
            principal: host/remote.idm.example.com@IDM.EXAMPLE.COM
            action: member

      Copy to Clipboard Toggle word wrap

   3. Add a task that ensures the presence of a delegation rule:

        - name: Ensure servicedelegationrule delegation-rule is present
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule

      Copy to Clipboard Toggle word wrap

   4. Add a task that ensures that the Kerberos principal of the web console client service is a member of the constrained delegation rule:

        - name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            principal: HTTP/myhost.idm.example.com
            action: member

      Copy to Clipboard Toggle word wrap

   5. Add a task that ensures that the constrained delegation rule is associated with the web-console-delegation-target delegation target:

        - name: Ensure a constrained delegation rule is associated with a specific delegation target
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            target: web-console-delegation-target
            action: member

      Copy to Clipboard Toggle word wrap
4. Save the file.

5. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml

   Copy to Clipboard Toggle word wrap

6. Enable Kerberos authentication on remote.idm.example.com:

   1. Connect through SSH to remote.idm.example.com as root.
   2. Add the GSSAPIAuthentication yes setting to the /etc/ssh/sshd_config file.

7. Restart the sshd service on remote.idm.example.com so that the changes take effect immediately:

   $ systemctl try-restart sshd.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the Configuration field of the Overview tab click Join Domain.
3. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
4. In the Domain administrator name field, enter the user name of the IdM administration account.
5. In the Domain administrator password, add a password.
6. Click Join.

Verification

1. If the RHEL 9 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.

2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

   $ id
   euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

   Copy to Clipboard Toggle word wrap

Procedure

1. Obtain your Kerberos ticket-granting ticket:

   $ kinit idmuser@IDM.EXAMPLE.COM
   Password for idmuser@IDM.EXAMPLE.COM:

   Copy to Clipboard Toggle word wrap

2. Enter the fully qualified name of the host on which the web console service is running into your browser:

   https://<dns_name>:9090

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a symlink:

   # ln -s /var/lib/ipa/gssproxy/http.keytab /etc/cockpit/krb5.keytab

   Copy to Clipboard Toggle word wrap

2. Set a certificate file Bash variable:

   # CERT_FILE=/etc/cockpit/ws-certs.d/50-certmonger.crt

   Copy to Clipboard Toggle word wrap

3. Set a certificate key Bash variable:

   # KEY_FILE=/etc/cockpit/ws-certs.d/50-certmonger.key

   Copy to Clipboard Toggle word wrap

4. Generate a certificate-key pair:

   # ipa-getcert request -f ${CERT_FILE} -k ${KEY_FILE} -D $(hostname --fqdn)

   Copy to Clipboard Toggle word wrap

Procedure

1. Install the opensc and gnutls-utils packages:

   # dnf -y install opensc gnutls-utils

   Copy to Clipboard Toggle word wrap

2. Start the pcscd service.

   # systemctl start pcscd

   Copy to Clipboard Toggle word wrap

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   Copy to Clipboard Toggle word wrap

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \
       --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   Copy to Clipboard Toggle word wrap

   The pcks15-init tool creates a new slot on the smart card.

3. Set a label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \
       --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   Copy to Clipboard Toggle word wrap

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \
       --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Copy to Clipboard Toggle word wrap
   Note

   The value you specify for --id must be the same when storing your private key and storing your certificate in the next step. Specifying your own value for --id is recommended as otherwise a more complicated value is calculated by the tool.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \
       --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

   Copy to Clipboard Toggle word wrap

6. Optional: Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key \
       --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Copy to Clipboard Toggle word wrap
   Note

   If the public key corresponds to a private key or certificate, specify the same ID as the ID of the private key or certificate.

7. Optional: Certain smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   Copy to Clipboard Toggle word wrap

   At this stage, your smart card contains the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

   Copy to Clipboard Toggle word wrap

4. Optional: Disable password based authentication in cockpit.conf with:

   [Basic]
   action = none

   Copy to Clipboard Toggle word wrap

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

Procedure

1. Set up constraint delegation rules to list which hosts the ticket can access.

   Example 7.1. Setting up constraint delegation rules

   The web console session runs host host.example.com and should be trusted to access its own host with sudo. Additionally, we are adding second trusted host - remote.example.com.

   • Create the following delegation:

     • Run the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target
       # ipa servicedelegationtarget-add-member cockpit-target \
          --principals=host/host.example.com@EXAMPLE.COM \
          --principals=host/remote.example.com@EXAMPLE.COM

       Copy to Clipboard Toggle word wrap

     • To allow the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation
       # ipa servicedelegationrule-add-member cockpit-delegation \
         --principals=HTTP/host.example.com@EXAMPLE.COM
       # ipa servicedelegationrule-add-target cockpit-delegation \
         --servicedelegationtargets=cockpit-target

       Copy to Clipboard Toggle word wrap

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

         Copy to Clipboard Toggle word wrap

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

         Copy to Clipboard Toggle word wrap
   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

   Copy to Clipboard Toggle word wrap

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

   Copy to Clipboard Toggle word wrap

3. To apply the changes, restart the system:

   # systemctl daemon-reload
   # systemctl stop cockpit

   Copy to Clipboard Toggle word wrap