Chapter 6. Managing remote systems in the web console

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the RHEL 9 web console, click your <username>@<hostname> in the top left corner of the Overview page.

   

3. From the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add.

5. Optional: Add the user name for the account to which you want to connect.

   You can use any user account of the remote system. However, if you use the credentials of a user account without administration privileges, you cannot perform administration tasks.

   If you use the same credentials as on your local system, the web console authenticates remote systems automatically every time you log in. Note that using the same credentials on more systems weakens the security.

6. Optional: Click the Color field to change the color of the system.
7. Click Add.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. In the RHEL 9 web console, click your <username>@<hostname> in the top left corner of the Overview page.

   

3. From the drop-down menu, click Add new host.
4. In the Add new host dialog box, specify the host you want to add.

5. Add the user name for the account to which you want to connect.

   You can use any user account of the remote system. However, if you use a user account without administration privileges, you cannot perform administration tasks.

6. Optional: Click the Color field to change the color of the system.

7. Click Add.

   A new dialog window appears asking for a password.

8. Enter the user account password.

9. Check Authorize SSH key if you already have an SSH key.

   

10. Check Create a new SSH key and authorize it if you do not have an SSH key. The web console creates the key.

    

    1. Add a password for the SSH key.
    2. Confirm the password.
11. Click Log in.

Verification

1. Log out.
2. Log back in.
3. Click Log in in the Not connected to host screen.

4. Select SSH key as your authentication option.

   
5. Enter your key password.
6. Click Log in.

Procedure

1. Create a list of the target hosts that the delegation rule can access:

   1. Create a service delegation target:

      $ ipa servicedelegationtarget-add cockpit-target

   2. Add the target host to the delegation target:

      $ ipa servicedelegationtarget-add-member cockpit-target \
        --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM

2. Allow cockpit sessions to access the target host list by creating a service delegation rule and adding the HTTP service Kerberos principal to it:

   1. Create a service delegation rule:

      $ ipa servicedelegationrule-add cockpit-delegation

   2. Add the web console client to the delegation rule:

      $ ipa servicedelegationrule-add-member cockpit-delegation \
        --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM

   3. Add the delegation target to the delegation rule:

      $ ipa servicedelegationrule-add-target cockpit-delegation \
        --servicedelegationtargets=cockpit-target

3. Enable Kerberos authentication on the remote.idm.example.com host:

   1. Connect through SSH to remote.idm.example.com as root.
   2. Open the /etc/ssh/sshd_config file for editing.
   3. Enable GSSAPIAuthentication by uncommenting the GSSAPIAuthentication no line and replacing it with GSSAPIAuthentication yes.

4. Restart the sshd service on remote.idm.example.com so that the changes take effect immediately:

   $ systemctl try-restart sshd.service

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create a web-console-smart-card-ssh.yml playbook with the following content:

   1. Create a task that ensures the presence of a delegation target:

      ---
      - name: Playbook to create a constrained delegation target
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        - name: Ensure servicedelegationtarget web-console-delegation-target is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target

   2. Add a task that adds the target host to the delegation target:

        - name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target
            principal: host/remote.idm.example.com@IDM.EXAMPLE.COM
            action: member

   3. Add a task that ensures the presence of a delegation rule:

        - name: Ensure servicedelegationrule delegation-rule is present
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule

   4. Add a task that ensures that the Kerberos principal of the web console client service is a member of the constrained delegation rule:

        - name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            principal: HTTP/myhost.idm.example.com
            action: member

   5. Add a task that ensures that the constrained delegation rule is associated with the web-console-delegation-target delegation target:

        - name: Ensure a constrained delegation rule is associated with a specific delegation target
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            target: web-console-delegation-target
            action: member

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml

5. Enable Kerberos authentication on remote.idm.example.com:

   1. Connect through SSH to remote.idm.example.com as root.
   2. Open the /etc/ssh/sshd_config file for editing.
   3. Enable GSSAPIAuthentication by uncommenting the GSSAPIAuthentication no line and replacing it with GSSAPIAuthentication yes.

6. Restart the sshd service on remote.idm.example.com so that the changes take effect immediately:

   $ systemctl try-restart sshd.service