Chapter 5. Configuring smart card authentication with the web console for centrally managed users

Procedure

1. Log in to the RHEL 10 web console.
2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

   Copy to Clipboard Toggle word wrap

4. Optional: Disable password-based authentication in cockpit.conf with:

   [Basic]
   action = none

   Copy to Clipboard Toggle word wrap

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the RHEL 10 web console.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

Procedure

1. Set up constraint delegation rules to list which hosts the ticket can access.

   Example 5.1. Setting up constraint delegation rules

   The web console session runs host host.example.com and should be trusted to access its own host with sudo. Additionally, we are adding second trusted host - remote.example.com.

   • Create the following delegation:

     • Run the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target
       # ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/host.example.com@EXAMPLE.COM \ --principals=host/remote.example.com@EXAMPLE.COM

       Copy to Clipboard Toggle word wrap

     • To allow the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation
       # ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/host.example.com@EXAMPLE.COM
       # ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

       Copy to Clipboard Toggle word wrap

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

         Copy to Clipboard Toggle word wrap

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

         Copy to Clipboard Toggle word wrap
   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

   Copy to Clipboard Toggle word wrap

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

   Copy to Clipboard Toggle word wrap

3. To apply the changes, restart the system:

   # systemctl daemon-reload
   # systemctl stop cockpit

   Copy to Clipboard Toggle word wrap