How to Install Cockpit on Fedora 39, 38 Linux

Navigating the complexities of server management can be a daunting task, even for seasoned IT professionals. Enter Cockpit, a user-friendly, web-based interface that simplifies this process, making it more accessible and efficient. This guide will demonstrate the process of how to install Cockpit on Fedora Linux, providing a clear and straightforward approach to enhance your server management experience.

Key Features of Cockpit:

• Real-time System Monitoring: Track CPU, memory, disk, and network performance instantly.
• Log Management: Easily view and manage system logs to quickly diagnose issues.
• Service Management: Start, stop, and restart services with a single click.
• User Account Management: Add or remove users and set up SSH keys.
• Web Console: Access the terminal directly from your web browser.
• Container Management: Integrate with Docker and Kubernetes for container deployment.

As we delve into the setup process for Cockpit on Fedora Linux, you’ll discover how these features boost your server management capabilities and offer a user-friendly approach to handling complex tasks. Whether you’re a system administrator or just venturing into server management, Cockpit stands as an invaluable tool in your arsenal. Let’s explore how you can harness its full potential on your Fedora Linux system.

Install Cockpit on Fedora Linux via DNF

Step 1: Update Fedora Before Cockpit Installation

Updating Fedora is a crucial first step in preparing your system for a new installation. This process ensures that all current packages are up-to-date, reducing the risk of compatibility issues during the Cockpit installation.

To update your system, open the command terminal and execute the following command:

sudo dnf upgrade --refresh

This command refreshes the repository metadata and updates all installed packages to their latest versions, providing a stable foundation for installing new software.

Step 2: Install Cockpit via DNF Command

Cockpit, a web-based server management tool, is in Fedora’s default repository. While Fedora Server comes with Cockpit pre-installed, Fedora Workstation and other variants may not have the software installed by default.

To install Cockpit on these systems, open your terminal and run the following command with administrative privileges:

sudo dnf install cockpit cockpit-selinux

Incorporating the SELinux package alongside Cockpit enhances security by managing access controls. This combination can help in diagnosing issues where SELinux policies might impede software functions.

Step 3: Verify Cockpit Service on Fedora

Once Cockpit is installed, you need to start and enable its service manually, as it’s not active by default. To initiate the Cockpit service, use this command:

sudo systemctl start cockpit cockpit.socket

For automatic activation of Cockpit upon system startup, ensuring its availability whenever the system is running, use:

sudo systemctl enable cockpit cockpit.socket

After these steps, it’s important to verify that Cockpit is functioning correctly. You can check the status of the Cockpit service with:

systemctl status cockpit

This command displays the current status of the Cockpit service, confirming whether it’s active and running without issues.

Configure Firewalld For Cockpit on Fedora

Allowing Cockpit on Port 9090

Cockpit, by default, operates on port 9090. To enable traffic on this port, which is essential for Cockpit’s functionality, use the following command:

sudo firewall-cmd --permanent --zone=public --add-service=cockpit

This command configures the firewall to allow incoming connections on port 9090, where Cockpit’s web interface is accessible.

Restricting Cockpit Access to Specific IP Addresses

For enhanced security, you may wish to limit Cockpit access to certain IP addresses. Use this command to restrict access:

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="x.x.x.x/24" service name="cockpit" accept'

Replace x.x.x.x/24 with the specific IP range you wish to grant access. This setup is particularly useful in controlled environments.

Enabling Cockpit Access to SSH

Cockpit requires access to SSH for various functionalities. To allow this, execute:

sudo firewall-cmd --permanent --zone=public --add-service=ssh

This command ensures that SSH traffic is permitted through the firewall, a necessary step for remote server management.

Implementing HTTPS for Secure Connections

To ensure that connections to Cockpit are secure, enable HTTPS by executing:

sudo firewall-cmd --permanent --zone=public --add-service=https

This step is crucial for encrypting data transmitted between the Cockpit interface and the user, safeguarding against data interception.

Blocking Cockpit Access from Certain IP Addresses

In some cases, you may need to deny access to Cockpit from specific IPs. To do this, use:

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="x.x.x.x/24" service name="cockpit" reject'

Again, replace x.x.x.x/24 with the IP range you intend to block, enhancing your security posture.

Granting Cockpit Access on a Specific Network Interface

To allow Cockpit access over a specific network interface, utilize this command:

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.0.0/24" service name="cockpit" accept' --permanent --zone=public --change-interface=eth0

Customize the source address and interface (here, eth0) according to your network configuration.

Activating Firewall Event Logging

For monitoring and troubleshooting, enable firewall logging with:

sudo firewall-cmd --set-log-denied=all

This command logs all denied connections, offering valuable insights into potential security incidents.

Securing the Network by Default Deny Policy

To adopt a stringent security stance, block all incoming connections except those explicitly allowed:

sudo firewall-cmd --default-deny

This command shifts your firewall to a default deny posture, significantly reducing the surface for potential attacks.

Enabling Automatic Updates for Firewall Rules

For maintaining up-to-date firewall configurations, especially useful when rules are frequently changed or updated, use:

sudo firewall-cmd --permanent --add-service=cockpit --runtime-to-permanent

This command ensures that any runtime changes to firewall rules are persisted across system reboots, keeping your configurations consistent and reliable.

Access Cockpit Web UI on Fedora

Step 1: Identifying Your Server’s IP Address

Before accessing the Cockpit Web UI, you need to know your server’s IP address. This address is crucial for connecting to the Cockpit interface. Determine your server’s IP by executing this command in the terminal:

hostname -I

This command displays the IP address assigned to your server, which you will use to access the Cockpit Web UI.

Step 2: Opening Cockpit in Your Web Browser

With the IP address in hand, you can now access the Cockpit Web UI. Launch your web browser and enter the following URL:

http://server-ip-address:9090

Replace [server-ip-address] with the actual IP address of your server. The 9090 denotes the default port on which Cockpit operates.

For local systems or specific configurations, accessing Cockpit via localhost is also feasible:

http://localhost:9090

This approach is generally used when accessing the Cockpit interface on the same machine where it is installed.

Step 3: Navigating the Security Alert

Upon your initial visit to the Cockpit Web UI, you might encounter a security alert. This alert typically indicates that the connection is not privately established. To proceed, click on “Advanced” and then select “Accept the Risk and Continue”. This step is a common necessity due to self-signed certificates used in local server setups.

Step 4: Logging into Cockpit

Once past the security alert, you’ll reach the Cockpit login page. Here, use your system’s sudo or root credentials to log in. These credentials grant you access to the Cockpit dashboard, where you can manage and monitor your server.

First-Time Tips For Cockpit on Fedora Linux

Now that you have successfully installed Cockpit on Fedora Linux, here are some first-time tips to help you get started with the software:

General Cockpit Tips for New Users on Fedora

• Explore the Dashboard: Familiarize yourself with the Cockpit dashboard. It provides a comprehensive overview of your system’s status, including CPU, memory usage, and network activity.
• Check System Logs: Regularly monitor your system logs. Cockpit simplifies log management, allowing you to spot and address issues promptly.
• User Management: Use Cockpit to create or manage user accounts. It’s a straightforward process and a fundamental aspect of system administration.
• Terminal Access: Cockpit includes a web-based terminal. It’s a powerful feature that gives you direct command-line access to your server from the web interface.

Cockpit Customization Tips on Fedora

• Change Interface Language: Cockpit supports multiple languages. To change the language, go to the upper right corner of the dashboard and select your preferred language.
• Adjust Time Zone and Network Settings: Easily configure your server’s time zone and network settings directly from the Cockpit interface, ensuring that your server operates in sync with your local settings.

Other Useful Cockpit Tips on Fedora

• Monitor and Manage Services: Keep an eye on running services. You can start, stop, and restart services directly from the Cockpit interface.
• Docker and Kubernetes Integration: If you work with containers, explore Cockpit’s integration with Docker and Kubernetes. This feature allows you to manage containers and orchestration directly from the dashboard.
• Use the Performance Graphs: Analyze the performance graphs for CPU, Memory, and Network. These graphs are essential tools for monitoring system health and performance.
• Access System Reports: Regularly check the system reports generated by Cockpit. These reports provide valuable insights into your system’s operations and can help with troubleshooting.

Cockpit SELinux Troubleshoot Tips on Fedora Linux

Checking SELinux Status

Cockpit integrates seamlessly with Fedora’s SELinux security features. However, conflicts might arise, such as the “Forbidden” error, often due to SELinux restrictions. Start troubleshooting by verifying SELinux status. Run this command in the terminal:

sestatus

This command provides an overview of the current SELinux operational mode and policy settings.

Reviewing SELinux Audit Logs

If SELinux is causing issues with Cockpit, its audit logs can offer vital insights. These logs record instances where SELinux has blocked access. To view the most recent audit entries related to Cockpit, use:

sudo ausearch -m avc -ts recent

This command filters the audit logs for AVC (Access Vector Cache) messages, which are key to identifying denied operations.

Configuring SELinux Policy for Cockpit

Should SELinux be restricting necessary access for Cockpit, adjusting the SELinux policy is a viable solution. Switching SELinux to permissive mode temporarily allows operations while still logging potential security violations. Execute the following to enable permissive mode:

sudo setenforce 0

Alternatively, the semanage command can be employed to fine-tune SELinux policies, providing access to specific resources without fully disabling enforcement. Remember, changes to SELinux policies often require a system reboot to become effective.

Conclusion

In this guide, we’ve walked through the essentials of installing and accessing Cockpit on Fedora Linux, ensuring a smooth start for those new to this powerful server management tool. Along the way, we’ve delved into the rich features of Cockpit, from its comprehensive dashboard to its robust system monitoring capabilities. We’ve also touched on key areas like services, storage, networking, and logs, while highlighting the importance of customization and the wealth of resources available through add-ons, documentation, and the active community.

As you continue to explore Cockpit, remember these insights and tips to fully leverage its potential in managing and monitoring your Fedora Linux servers.