Managing systems using the RHEL 9 web console Red Hat Enterprise Linux 9 Server management with a graphical web-based interface Red Hat Customer Content Services

Commands:
dnf install cockpit
systemctl enable --now cockpit.socket
firewall-cmd --add-service=cockpit --permanent firewall-cmd --reload
https://localhost:9090
vi cockpit.conf
[basic] action = none
systemctl try-restart cockpit
https:// <server.hostname.example.com> : <port-number>
https://example.com:9090
https:// <server.IP_address> : <port-number>
https://192.0.2.2:9090
vi /etc/cockpit/disallowed-users
List of users which are not allowed to login to Cockpit root
vi /etc/issue.cockpit
This is an example banner for the RHEL web console login page.
vi /etc/cockpit/cockpit.conf
[Session] Banner=/etc/issue.cockpit
systemctl try-restart cockpit
vi /etc/cockpit/cockpit.conf
[Session] IdleTimeout= <X>
systemctl try-restart cockpit
semanage port -a -t websm_port_t -p tcp <4488>
firewall-cmd --service cockpit --permanent --add-port= <4488> /tcp firewall-cmd --service cockpit --permanent --remove-port=9090/tcp
systemctl edit cockpit.socket
[Socket] ListenStream= ListenStream= <4488>
systemctl daemon-reload
systemctl show cockpit.socket -p Listen Listen=[::]:4488 (Stream)
systemctl restart cockpit.socket
https://machine1.example.com:4488
--- - name: Manage the RHEL web console hosts: managed-node-01.example.com tasks: - name: Install RHEL web console ansible.builtin.include_role: name: rhel-system-roles.cockpit vars: cockpit_packages: default cockpit_port: 9050 cockpit_manage_selinux: true cockpit_manage_firewall: true cockpit_certificates: - name: /etc/cockpit/ws-certs.d/01-certificate dns: ['localhost', 'www.example.com'] ca: ipa
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
dnf install <add-on>
vi /etc/cockpit/ <systemd> .override.json
vi ~/.config/cockpit/ <systemd> .override.json
{ "menu": { "services": null, "logs": { "order": -1 } } }
systemctl restart cockpit.service
klist Ticket cache: FILE:/run/user/1894000001/cockpit-session-3692.ccache Default principal: user@IDM.EXAMPLE.COM Valid starting Expires Service principal 07/30/21 09:19:06 07/31/21 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM 07/30/21 09:19:06 07/31/21 09:19:06 krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM for client HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
ipa servicedelegationtarget-add cockpit-target
ipa servicedelegationtarget-add-member cockpit-target --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM
ipa servicedelegationrule-add cockpit-delegation
ipa servicedelegationrule-add-member cockpit-delegation --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
ipa servicedelegationrule-add-target cockpit-delegation --servicedelegationtargets=cockpit-target
systemctl try-restart sshd.service
klist Ticket cache: FILE:/run/user/1894000001/cockpit-session-3692.ccache Default principal: user@IDM.EXAMPLE.COM Valid starting Expires Service principal 07/30/21 09:19:06 07/31/21 09:19:06 HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM 07/30/21 09:19:06 07/31/21 09:19:06 krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM for client HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM
cd ~/ MyPlaybooks /
--- - name: Playbook to create a constrained delegation target hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure servicedelegationtarget web-console-delegation-target is present ipaservicedelegationtarget: ipaadmin_password: "{{ ipaadmin_password }}" name: web-console-delegation-target
- name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present ipaservicedelegationtarget: ipaadmin_password: "{{ ipaadmin_password }}" name: web-console-delegation-target principal: host/remote.idm.example.com@IDM.EXAMPLE.COM action: member
- name: Ensure servicedelegationrule delegation-rule is present ipaservicedelegationrule: ipaadmin_password: "{{ ipaadmin_password }}" name: web-console-delegation-rule
- name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule ipaservicedelegationrule: ipaadmin_password: "{{ ipaadmin_password }}" name: web-console-delegation-rule principal: HTTP/myhost.idm.example.com action: member
- name: Ensure a constrained delegation rule is associated with a specific delegation target ipaservicedelegationrule: ipaadmin_password: "{{ ipaadmin_password }}" name: web-console-delegation-rule target: web-console-delegation-target action: member
ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml
id euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
https:// <dns_name> :9090
dnf -y install opensc gnutls-utils
systemctl start pcscd
systemctl status pcscd
pkcs15-init --erase-card --use-default-transport-keys Using reader with a card: Reader name PIN [Security Officer PIN] required. Please enter PIN [Security Officer PIN]:
pkcs15-init --create-pkcs15 --use-default-transport-keys --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123 Using reader with a card: Reader name
pkcs15-init --store-pin --label testuser --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478 Using reader with a card: Reader name
pkcs15-init --store-private-key testuser.key --label testuser_key --auth-id 01 --id 01 --pin 963214 Using reader with a card: Reader name
pkcs15-init --store-certificate testuser.crt --label testuser_crt --auth-id 01 --id 01 --format pem --pin 963214 Using reader with a card: Reader name
pkcs15-init --store-public-key testuserpublic.key --label testuserpublic_key --auth-id 01 --id 01 --pin 963214 Using reader with a card: Reader name
pkcs15-init -F
[WebService] ClientCertAuthentication = yes
[Basic] action = none
systemctl restart cockpit
ipa servicedelegationtarget-add cockpit-target ipa servicedelegationtarget-add-member cockpit-target --principals=host/host.example.com@EXAMPLE.COM --principals=host/remote.example.com@EXAMPLE.COM
ipa servicedelegationrule-add cockpit-delegation ipa servicedelegationrule-add-member cockpit-delegation --principals=HTTP/host.example.com@EXAMPLE.COM ipa servicedelegationrule-add-target cockpit-delegation --servicedelegationtargets=cockpit-target
[domain/example.com] pam_gssapi_services = sudo, sudo-i
auth sufficient pam_sss_gss.so
systemctl edit system-cockpithttps.slice
change existing value TasksMax= 100 add new restriction CPUQuota= 30%
systemctl daemon-reload systemctl stop cockpit
satellite-installer --enable-foreman-plugin-remote-execution-cockpit --reset-foreman-plugin-remote-execution-cockpit-ensure