Chapter 5. Configuring smart card authentication with the web console for centrally managed users

Procedure

1. Log in to the RHEL 10 web console.
2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

   Copy to Clipboard Toggle word wrap

4. Optional: Disable password-based authentication in cockpit.conf with:

   [Basic]
   action = none

   Copy to Clipboard Toggle word wrap

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

   You are now connected and the web console displays its content.

Procedure

1. Set up constraint delegation rules to list which hosts the ticket can access.

   • Create the following example delegation:

     • Enter the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target

       Copy to Clipboard Toggle word wrap

       # ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/host.example.com@EXAMPLE.COM \ --principals=host/remote.example.com@EXAMPLE.COM

       Copy to Clipboard Toggle word wrap

     • To enable the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation

       Copy to Clipboard Toggle word wrap

       # ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/host.example.com@EXAMPLE.COM

       Copy to Clipboard Toggle word wrap

       # ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

       Copy to Clipboard Toggle word wrap

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

         Copy to Clipboard Toggle word wrap

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

         Copy to Clipboard Toggle word wrap

   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

      Warning

      The delegated S4U ticket is not forwarded to remote SSH hosts when connecting to them from the web console. Authenticating to sudo on a remote host with your ticket will not work.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.
4. Alternatively: Try to connect to a different host with SSH.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

   Copy to Clipboard Toggle word wrap

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

   Copy to Clipboard Toggle word wrap

3. To apply the changes, restart the system:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

   # systemctl stop cockpit

   Copy to Clipboard Toggle word wrap