Chapter 1. Getting started using the RHEL web console

Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # dnf install cockpit

   Copy to clipboard

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

   Copy to clipboard

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

   Copy to clipboard

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Copy to clipboard
   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see Section 1.5, “Connecting to the web console from a remote machine”

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.
3. Click Log In.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi cockpit.conf

   Copy to clipboard

2. Add the following text:

   [basic]
   action = none

   Copy to clipboard
3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to clipboard

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s host name:

      https://<server.hostname.example.com>:<port-number>

      Copy to clipboard

      For example:

      https://example.com:9090

      Copy to clipboard

   2. With the server’s IP address:

      https://<server.IP_address>:<port-number>

      Copy to clipboard

      For example:

      https://192.0.2.2:9090

      Copy to clipboard
3. After the login interface opens, log in with your RHEL system credentials.

Procedure

1. Open the disallowed-users file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/disallowed-users

   Copy to clipboard

2. Edit the file and remove the line for the root user:

   # List of users which are not allowed to login to Cockpit root
    

   Copy to clipboard
3. Save the changes and quit the editor.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:PORT_NUMBER
   • Remotely with the server hostname: https://example.com:PORT_NUMBER

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Open the /etc/issue.cockpit file in a text editor of your preference:

   # vi /etc/issue.cockpit

   Copy to clipboard

2. Add the content you want to display as the banner to the file, for example:

   This is an example banner for the RHEL web console login page.

   Copy to clipboard

   You cannot include any macros in the file, but you can use line breaks and ASCII art.

3. Save the file.

4. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to clipboard

5. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

   Copy to clipboard
6. Save the file.

7. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to clipboard

Procedure

1. Open the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference, for example:

   # vi /etc/cockpit/cockpit.conf

   Copy to clipboard

2. Add the following text to the file:

   [Session]
   IdleTimeout=<X>

   Copy to clipboard

   Substitute <X> with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

   Copy to clipboard

Procedure

1. Pick an unoccupied port, for example, <4488/tcp>, and instruct SELinux to allow the cockpit service to bind to that port:

   # semanage port -a -t websm_port_t -p tcp <4488>

   Copy to clipboard

   Note that a port can be used only by one service at a time, and thus an attempt to use an already occupied port implies the ValueError: Port already defined error message.

2. Open the new port and close the former one in the firewall:

   # firewall-cmd --service cockpit --permanent --add-port=<4488>/tcp
   # firewall-cmd --service cockpit --permanent --remove-port=9090/tcp

   Copy to clipboard

3. Create an override file for the cockpit.socket service:

   # systemctl edit cockpit.socket

   Copy to clipboard

4. In the following editor screen, which opens an empty override.conf file located in the /etc/systemd/system/cockpit.socket.d/ directory, change the default port for the web console from 9090 to the previously picked number by adding the following lines:

   [Socket]
   ListenStream=
   ListenStream=<4488>

   Copy to clipboard

   Note that the first ListenStream= directive with an empty value is intentional. You can declare multiple ListenStream directives in a single socket unit and the empty value in the drop-in file resets the list and disables the default port 9090 from the original unit.

   Important

   Insert the previous code snippet between the lines starting with # Anything between here and # Lines below this. Otherwise, the system discards your changes.

5. Save the changes by pressing Ctrl+O and Enter. Exit the editor by pressing Ctrl+X.

6. Reload the changed configuration:

   # systemctl daemon-reload

   Copy to clipboard

7. Check that your configuration is working:

   # systemctl show cockpit.socket -p Listen
   Listen=[::]:4488 (Stream)

   Copy to clipboard

8. Restart cockpit.socket:

   # systemctl restart cockpit.socket

   Copy to clipboard