user-documentation/modules/ROOT/partials/installation/post-install/cockpit-secure-access.adoc

There are several ways to improve the security of Cockpit access. All of them are based on permanently withdrawing access to Cockpit in the firewall. So, reconfigure the firewall permanently.

[…]# firewall-cmd --permanent --remove-service=cockpit
[…]# firewall-cmd --reload

Use one of the following alternatives to access Cockpit.

1. Access Cockpit via ssh tunnel

   • Login to the server via ssh and setup a tunnel in one go

     ssh host.example.com -L 9090:host.example.com:9090

   • While you remain logged in, open in your local browser localhost:9090

2. Add Cockpit service temporarily on demand

   • Login to the server and reconfigure firewall

     firewall-cmd –add-service=cockpit

   • When finished remove cockpit again

     firewall-cmd –remove-service=cockpit

3. Use a secure local proxy

   • Install Cockpit on your local Fedora workstation or on a lab server shielded by a firewall. Configure this instance to access any of your remote Cockpit instances using Cockpits remote administration capability. It uses a protected ssh connection in the public network.

   • In the upper left corner of Cockpit you will see the name of the logged-in user and the (local) lab server name, along with an expand icon. This opens a box where you can switch to another server or add a new one.

   • The Add new host link opens a simple form to fill in hostname and user. Use your administrative user name on the (remote) server. And you can assign a color. Select automatic login via ssh keyfile. Cockpit will create one for you if none exists or otherwise uses an existing one. For a newly created key, Cockpit installs the public key on the remote server, too.