Procedure

1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

   # yum install cockpit

2. Enable and start the cockpit.socket service, which runs a web server:

   # systemctl enable --now cockpit.socket

3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

   # firewall-cmd --add-service=cockpit --permanent
   # firewall-cmd --reload

Procedure

1. In your web browser, enter the following address to access the web console:

   https://localhost:9090

   Note

   This provides a web-console login on your local machine. If you want to log in to the web console of a remote system, see Section 1.6, “Connecting to the web console from a remote machine”

   If you use a self-signed certificate, the browser displays a warning. Check the certificate, and accept the security exception to proceed with the login.

   The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. In the login screen, enter your system user name and password.
3. Click Log In.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. In the upper right corner, click the Session button.
3. In the section Style, choose the preferred setting. The Default setting uses the same style setting as your browser.

Verification steps

1. The style setting has changed according to set style.

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

   $ sudo vi cockpit.conf

2. Add the following text:

   [basic]
   action = none

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Open your web browser.

2. Type the remote server’s address in one of the following formats:

   1. With the server’s host name: https://server.hostname.example.com:port_number.

      For example:

      https://example.com:9090

   2. With the server’s IP address: https://server.IP_address:port_number

      For example:

      https://192.0.2.2:9090

3. After the login interface opens, log in with your RHEL machine credentials.

Procedure

1. Open the RHEL web console in your browser:

   • Locally: https://localhost:PORT_NUMBER
   • Remotely with the server hostname: https://example.com:PORT_NUMBER

   • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER

     If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

     The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

2. The Login window opens. In the Login window, enter your system user name and password.
3. Generate a one-time password on your device.
4. Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
5. Click Log in.
6. Successful login takes you to the Overview page of the web console interface.

Procedure

1. Log into the RHEL web console. For details, see Logging in to the web console.

2. In the Overview page, click the Reboot button.

   

3. If any users are logged in to the system, write a reason for the restart in the Reboot dialog box.

4. Optional: In the Delay drop down list, select a time interval for the reboot delay.

   

5. Click Reboot.

Procedure

1. Log into the RHEL web console.

   For details, see Logging in to the web console.

2. Click Overview.

3. In the Restart drop down list, select Shut Down.

   

4. If any users are logged in to the system, write a reason for the shutdown in the Shut Down dialog box.
5. Optional: In the Delay drop down list, select a time interval.
6. Click Shut Down.

Procedure

1. Log in to the RHEL web console.

   For details, see Logging in to the web console.

2. Click the current system time in Overview.

   

3. Click System time.
4. In the Change System Time dialog box, change the time zone if necessary.

5. In the Set Time drop down menu, select one of the following:

   Manually

   Use this option if you need to set the time manually, without an NTP server.

   Automatically using NTP server

   This is a default option, which synchronizes time automatically with the preset NTP servers.

   Automatically using specific NTP servers

   Use this option only if you need to synchronize the system with a specific NTP server. Specify the DNS name or the IP address of the server.

6. Click Change.

   

Procedure

1. Log into the RHEL web console.

   For details, see Logging in to the web console.

2. In the Configuration field of the Overview tab click Join Domain.
3. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
4. In the Domain administrator name field, enter the user name of the IdM administration account.
5. In the Domain administrator password, add a password.
6. Click Join.

Verification steps

1. If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.

2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

   $ id
   euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. In the Overview tab find the System information field and click View hardware details.

3. On the CPU Security line, click Mitigations.

   If this link is not present, it means that your system does not support SMT, and therefore is not vulnerable.

4. In the CPU Security Toggles table, turn on the Disable simultaneous multithreading (nosmt) option.
5. Click the Save and reboot button.

Procedure

1. Create the /etc/issue.cockpit file in a text editor of your preference if you do not have it yet. Add the content you want to display as the banner to the file.

   Do not include any macros in the file as there is no re-formatting done between the file content and the displayed content. Use intended line breaks. It is possible to use ASCII art.

2. Save the file.

3. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

   $ sudo vi cockpit.conf

4. Add the following text to the file:

   [Session]
   Banner=/etc/issue.cockpit

5. Save the file.

6. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

   $ sudo vi cockpit.conf

2. Add the following text to the file:

   [Session]
   IdleTimeout=X

   Substitute X with a number for a time period of your choice in minutes.

3. Save the file.

4. Restart the web console for changes to take effect.

   # systemctl try-restart cockpit

Procedure

1. Log into the web console.

   For details, see Logging in to the web console.

2. Click Overview.

3. Click edit next to the current host name.

   

4. In the Change Host Name dialog box, enter the host name in the Pretty Host Name field.

5. The Real Host Name field attaches a domain name to the pretty name.

   You can change the real host name manually if it does not correspond with the pretty host name.

6. Click Change.

   

Verification steps

1. Log out from the web console.

2. Reopen the web console by entering an address with the new host name in the address bar of your browser.

   

Procedure

1. Log into the RHEL web console. For details, see Logging in to the web console.
2. Click Overview.

3. In the Performance Profile field, click the current performance profile.

   

4. In the Change Performance Profile dialog box, change the profile if necessary.

5. Click Change Profile.

   

Procedure

1. Log into the RHEL 8 web console. In the Overview page click View metrics and history to view the Metrics and history page.

   

   

Procedure

1. In the Overview page, click View metrics and history in the Usage table.
2. Click the Metrics settings button.

3. Move the Export to network slider to active position.

   

   If you do not have the redis package installed, the web console prompts you to install it.

4. To open the pmproxy service, select a zone from a drop-down list and click the Add pmproxy button.
5. Click Save.

Verification

1. Click Networking.
2. In the Firewall table, click the Edit rules and zones button.
3. Search for pmproxy in your selected zone.

Procedure

1. Log in to the RHEL web console.

   For details, see Logging in to the web console.

2. Click Logs.

   

3. Open log entry details by clicking on your selected log entry in the list.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Logs.

3. By default, web console shows the latest log entries. To filter by a specific time range, click the Time drop-down menu and choose a preferred option.

   

4. Error and above severity logs list is shown by default. To filter by different priority, click the Error and above drop-down menu and choose a preferred priority.

   

5. By default, web console shows logs for all identifiers. To filter logs for a particular identifier, click the All drop-down menu and select an identifier.

   

6. To open a log entry, click on a selected log.

1. Type identifier:systemd since:2020-10-22 JOB_TYPE=start,restart to search field.

2. Check the results.

   

1. Type service:cockpit boot:-1 error|fail to the search field.

2. Check the results.

   

Procedure

1. Log in to the RHEL web console.

   For details, see Logging in to the web console.

2. Click Logs.

3. Use the drop-down menus to specify the three main quantifiers - time range, priority, and identifier(s) - you want to filter.

   The Priority quantifier always has to have a value. If you do not specify it, it automatically filters the Error and above priority. Notice that the options you set reflect in the text search box.

4. Specify the log field you want to filter.

   It is possible to add several log fields.

5. You can use a free-form string to search for anything else. The search box also accepts regular expressions.

Procedure

1. Log in to the RHEL web console.
2. Click Accounts.
3. Click Create New Account.

4. In the Full Name field, enter the full name of the user.

   The RHEL web console automatically suggests a user name from the full name and fills it in the User Name field. If you do not want to use the original naming convention consisting of the first letter of the first name and the whole surname, update the suggestion.

5. In the Password/Confirm fields, enter the password and retype it for verification that your password is correct.

   The color bar below the fields shows you the security level of the entered password, which does not allow you to create a user with a weak password.

6. Click Create to save the settings and close the dialog box.
7. Select the newly created account.

8. In the Groups drop down menu, select the groups that you want to add to the new account.

   

   Now you can see the new account in the Accounts settings and you can use its credentials to connect to the system.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Accounts.
3. Select the user account for which you want to enforce password expiration.

4. Click edit on the Password line.

   

5. In the Password expiration dialog box, select Require password change every …​ days and enter a positive whole number representing the number of days after which the password expires.

6. Click Change.

   The web console immediately shows the date of the future password change request on the Password line.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Accounts.
3. Click the user account for which you want to terminate the session.

4. Click Terminate Session.

   If the Terminate Session button is inactive, the user is not logged in to the system.

   The RHEL web console terminates the sessions.

1. Log in to the RHEL web console with administrator privileges.

   For details, see Logging in to the web console.

2. Click Services in the web console menu on the left.
3. The default tab for Services is System Services. If you want to manage targets, sockets, timers, or paths, switch to the respective tab in the menu on top.
4. To open service settings, click on a selected service from the list. You can tell which services are active or inactive by checking the State column.

5. Activate or deactivate a service:

   • To activate an inactive service, click the Start button.

     

   • To deactivate an active service, click the Stop button.

     

1. Log in to the RHEL web console with administrator privileges.

   For details, see Logging in to the web console.

2. Click Services in the web console menu on the left.
3. The default tab for Services is System Services. If you want to manage targets, sockets, timers, or paths, switch to the respective tab in the menu on top.
4. To open service settings, click on a selected service from the list.
5. To restart a service, click the Restart button.

Procedure

1. Select the Networking tab in the navigation on the left side of the screen.
2. Click Add bond in the Interfaces section.
3. Enter the name of the bond device you want to create.
4. Select the interfaces that should be members of the bond.

5. Select the mode of the bond.

   If you select Active backup, the web console shows the additional field Primary in which you can select the preferred active device.

6. Set the link monitoring mode. For example, when you use the Adaptive load balancing mode, set it to ARP.

7. Optional: Adjust the monitoring interval, link up delay, and link down delay settings. Typically, you only change the defaults for troubleshooting purposes.

   
8. Click Apply.

9. By default, the bond uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the bond in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Verification

1. Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface:

   

2. Temporarily remove the network cable from the host.

   Note that there is no method to properly test link failure events using software utilities. Tools that deactivate connections, such as the web console, show only the bonding driver’s ability to handle member configuration changes and not actual link failure events.

3. Display the status of the bond:

   # cat /proc/net/bonding/bond0

Procedure

1. Log in to the web console.

   For details, see Logging in to the web console.

2. Open Networking.
3. In the Interfaces table, click on the bond you want to configure.
4. In the bond settings screen, scroll down to the table of members (interfaces).
5. Click the Add member drop down icon.
6. Select the interface in the drop down menu and click it.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. Open Networking.
3. Click the bond you want to configure.
4. In the bond settings screen, scroll down to the table of ports (interfaces).

5. Select the interface and remove or disable it:

   • To remove the interface, click the - button.
   • To disable or enable the interface, toggle the switch next to the selected interface.

Procedure

1. Log in to the web console.

   For details, see Logging in to the web console.

2. Open Networking.
3. Click the bond you want to remove.

4. In the bond settings screen, you can disable or enable the bond by toggling a switcher or click the Delete button to remove the bond permanently.

   

Procedure

1. Select the Networking tab in the navigation on the left side of the screen.
2. Click Add team in the Interfaces section.
3. Enter the name of the team device you want to create.
4. Select the interfaces that should be ports of the team.

5. Select the runner of the team.

   If you select Load balancing or 802.3ad LACP, the web console shows the additional field Balancer.

6. Set the link watcher:

   • If you select Ethtool, additionally, set a link up and link down delay.
   • If you set ARP ping or NSNA ping, additionally, set a ping interval and ping target.
   
7. Click Apply.

8. By default, the team uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the team in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Verification

1. Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface.

   

2. Display the status of the team:

   # teamdctl team0 state
   setup:
     runner: activebackup
   ports:
     enp7s0
       link watches:
         link summary: up
         instance[link_watch_0]:
           name: ethtool
           link: up
           down count: 0
     enp8s0
       link watches:
         link summary: up
         instance[link_watch_0]:
           name: ethtool
           link: up
           down count: 0
   runner:
     active port: enp7s0

   In this example, both ports are up.

Procedure

1. Log in to the web console.

   For details, see Logging in to the web console.

2. Switch to the Networking tab.
3. In the Interfaces table, click on the team you want to configure.
4. In the team settings window, scroll down to the Ports table.
5. Click on the + button.

6. Select the interface you want to add from the drop down list.

   

Procedure

1. Log in to the RHEL web console.

   For details, see Logging in to the web console.

2. Switch to the Networking tab.
3. Click the team you want to configure.
4. In the team settings window, scroll down to the table of ports (interfaces).

5. Select an interface and remove or disable it.

   1. Switch the ON/OFF button to Off to disable the interface.

   2. Click the - button to remove the interface.

      

Procedure

1. Log in to the web console.

   For details, see Logging in to the web console.

2. Switch to the Networking tab.
3. Click the team you want to remove or disable.

4. Remove or disable the selected team.

   1. You can remove the team by clicking the Delete button.

   2. You can disable the team by moving the ON/OFF switch to a disabled position.

      

Procedure

1. Select the Networking tab in the navigation on the left side of the screen.
2. Click Add bridge in the Interfaces section.
3. Enter the name of the bridge device you want to create.
4. Select the interfaces that should be ports of the bridge.

5. Optional: Enable the Spanning tree protocol (STP) feature to avoid bridge loops and broadcast radiation.

   
6. Click Apply.

7. By default, the bridge uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the bridge in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Verification

1. Select the Networking tab in the navigation on the left side of the screen, and check if there is incoming and outgoing traffic on the interface:

   

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. Open Networking.
3. Click the bridge you want to configure.
4. In the bridge settings screen, scroll down to the table of ports (interfaces).
5. Select an interface and click the - button.

Procedure

1. Log in to the RHEL web console.

   For details, see Logging in to the web console.

2. Open the Networking section.
3. Click the bridge you want to configure.

4. Click Delete.

   

Procedure

1. Select the Networking tab in the navigation on the left side of the screen.
2. Click Add VLAN in the Interfaces section.
3. Select the parent device.
4. Enter the VLAN ID.

5. Enter the name of the VLAN device or keep the automatically-generated name.

   
6. Click Apply.

7. By default, the VLAN device uses a dynamic IP address. If you want to set a static IP address:

   1. Click the name of the VLAN device in the Interfaces section.
   2. Click Edit next to the protocol you want to configure.
   3. Select Manual next to Addresses, and enter the IP address, prefix, and default gateway.
   4. In the DNS section, click the + button, and enter the IP address of the DNS server. Repeat this step to set multiple DNS servers.
   5. In the DNS search domains section, click the + button, and enter the search domain.

   6. If the interface requires static routes, configure them in the Routes section.

      
   7. Click Apply

Procedure

1. To add a new port number, run the following command:

   $ sudo firewall-cmd --permanent --service cockpit --add-port=PORT_NUMBER/tcp

2. To remove the old port number from the cockpit service, run:

   $ sudo firewall-cmd --permanent --service cockpit --remove-port=OLD_PORT_NUMBER/tcp

Procedure

1. Change the listening port with one of the following methods:

   1. Using the systemctl edit cockpit.socket command:

      1. Run the following command:

         $ sudo systemctl edit cockpit.socket

         This will open the /etc/systemd/system/cockpit.socket.d/override.conf file.

      2. Modify the content of override.conf or add a new content in the following format:

         [Socket]
         ListenStream=
         ListenStream=PORT_NUMBER

         The ListenStream option specifies the desired address and TCP port.

         Note

         The first line with an empty value is intentional. systemd allows multiple ListenStream directives to be declared in a single socket unit. An empty value in a drop-in file resets the list and disables the default port 9090 from the original unit.

   2. Alternatively, add the above mentioned content to the /etc/systemd/system/cockpit.socket.d/listen.conf file.

      Create the cockpit.socket.d. directory and the listen.conf file if they do not exist yet.

2. Run the following commands for changes to take effect:

   $ sudo systemctl daemon-reload
   $ sudo systemctl restart cockpit.socket

   If you used systemctl edit cockpit.socket in the previous step, running systemctl daemon-reload is not necessary.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Open the Networking section.

3. In the Firewall section, click the slider to run the firewall.

   

   If you do not see the Firewall slider, log in to the web console with the administrative privileges.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Open the Networking section.

3. In the Firewall section, click the slider to stop the firewall.

   

   If you do not see the Firewall slider, log in to the web console with the administrative privileges.

Procedure

1. Log in to the RHEL web console with administrative privileges. For details, see Logging in to the web console.
2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. In the Firewall section, click Add new zone.

5. In the Add zone dialog box, select a zone from the Trust level options.

   You can see here all zones predefined in the firewalld service.

6. In the Interfaces part, select an interface or interfaces on which the selected zone is applied.

7. In the Allowed Addresses part, you can select whether the zone is applied on:

   • the whole subnet

   • or a range of IP addresses in the following format:

     • 192.168.1.0
     • 192.168.1.0/24
     • 192.168.1.0/24, 192.168.1.0

8. Click on the Add zone button.

   

Procedure

1. Log in to the RHEL web console with administrator privileges. For details, see Logging in to the web console.
2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. In the Firewall section, select a zone for which you want to add the service and click Add Services.

   

5. In the Add Services dialog box, find the service you want to enable on the firewall.

6. Enable desired services.

   

7. Click Add Services.

Procedure

1. Log in to the RHEL web console with administrator privileges. For details, see Logging in to the web console.
2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrative privileges.

4. In the Firewall section, select a zone for which you want to configure a custom port and click Add Services.

   

5. In the Add services dialog box, click on the Custom Ports radio button.

6. In the TCP and UDP fields, add ports according to examples. You can add ports in the following formats:

   • Port numbers such as 22
   • Range of port numbers such as 5900-5910
   • Aliases such as nfs, rsync
   Note

   You can add multiple values into each field. Values must be separated with the comma and without the space, for example: 8080,8081,http

7. After adding the port number in the TCP filed, the UDP filed, or both, verify the service name in the Name field.

   The Name field displays the name of the service for which is this port reserved. You can rewrite the name if you are sure that this port is free to use and no server needs to communicate on this port.

8. In the Name field, add a name for the service including defined ports.

9. Click on the Add Ports button.

   

Procedure

1. Log in to the RHEL web console with administrator privileges. For details, see Logging in to the web console.
2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. Click on the Options icon at the zone you want to remove.

   

5. Click Delete.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Click on the Storage tab.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. Click the Storage tab.
3. In the Other Devices table, click a volume in which you want to create the partition.
4. In the Content section, click the Create Partition button.
5. In the Create partition dialog box, select the size of the new partition.

6. In the Erase drop down menu, select:

   • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
   • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk, but it is more secure. Use this option if the disk includes any data and you need to overwrite it.

7. In the Type drop down menu, select a file system:

   • XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.

   • ext4 file system supports:

     • Logical volumes
     • Switching physical drives online without outage
     • Growing a file system
     • Shrinking a file system

   Additional option is to enable encryption of partition done by LUKS (Linux Unified Key Setup), which allows you to encrypt the volume with a passphrase.

8. In the Name field, enter the logical volume name.

9. In the Mounting drop down menu, select Custom.

   The Default option does not ensure that the file system will be mounted on the next boot.

10. In the Mount Point field, add the mount path.
11. Select Mount at boot.

12. Click the Create Partition button.

    Formatting can take several minutes depending on the volume size and which formatting options are selected.

    After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. Click on the Storage tab.
3. In the Filesystems table, select a volume in which you want to delete the partition.
4. In the Content section, click on the partition you want to delete.

5. The partition rolls down and you can click on the Delete button.

   The partition must not be mounted and used.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.
2. Click on the Storage tab.
3. In the Filesystems table, select a volume in which you want to delete the partition.
4. In the Content section, click on the partition whose file system you want to mount or unmount.

5. Click on the Mount or Unmount button.

   At this point, the file system has been mounted or unmounted according to your action.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Click Storage.

3. Click + in the NFS mounts section.

   

4. In the New NFS Mount dialog box, enter the server or IP address of the remote server.
5. In the Path on Server field, enter the path to the directory you want to mount.
6. In the Local Mount Point field, enter the path where you want to find the directory in your local system.
7. Select Mount at boot. This ensures that the directory will be reachable also after the restart of the local system.

8. Optionally, select Mount read only if you do not want to change the content.

   

9. Click Add.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Click Storage.
3. Click on the NFS mount you want to adjust.

4. If the remote directory is mounted, click Unmount.

   The directory must not be mounted during the custom mount options configuration. Otherwise the web console does not save the configuration and this will cause an error.

1. Click Edit.

1. In the NFS Mount dialog box, select Custom mount option.

2. Enter mount options separated by a comma. For example:

   • nfsvers=4 — the NFS protocol version number
   • soft — type of recovery after an NFS request times out
   • sec=krb5 — files on the NFS server can be secured by Kerberos authentication. Both the NFS client and server have to support Kerberos authentication.

1. Click Apply.
2. Click Mount.

Procedure

1. Open the RHEL 8 web console.
2. Click Storage.
3. Click the menu icon in the Devices table.
4. Click Create RAID device.
5. In the Create RAID Device dialog box, enter a name for a new RAID.
6. In the RAID Level drop-down list, select a level of RAID you want to use.

7. In the Chunk Size drop-down list, leave the predefined value as it is.

   The Chunk Size value specifies how large is each block for data writing. If the chunk size is 512 KiB, the system writes the first 512 KiB to the first disk, the second 512 KiB is written to the second disk, and the third chunk will be written to the third disk. If you have three disks in your RAID, the fourth 512 KiB will be written to the first disk again.

8. Select disks you want to use for RAID.
9. Click Create.

Procedure

1. Open the RHEL 8 web console.
2. Click Storage.
3. In the RAID devices box, choose the RAID you want to format by clicking on it.
4. In the RAID details screen, scroll down to the Content part.
5. Click to the newly created RAID.
6. Click the Format button.

7. In the Erase drop-down list, select:

   • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
   • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk. Use this option if the RAID includes any data and you need to rewrite it.
8. In the Type drop-down list, select a XFS file system, if you do not have another strong preference.
9. Enter a name of the file system.

10. In the Mounting drop down list, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

11. In the Mount Point field, add the mount path.
12. Select Mount at boot.

13. Click the Format button.

    Formatting can take several minutes depending on the used formatting options and size of RAID.

    After successful finish, you can see the details of the formatted RAID on the Filesystem tab.

14. To use the RAID, click Mount.

Procedure

1. Open the RHEL 8 console.
2. Click Storage.
3. In the RAID devices box, select the RAID you want to edit.
4. In the RAID details screen, scroll down to the Content part.
5. Click to the newly created RAID.
6. Click the Create partition table button.

7. In the Erase drop-down list, select:

   • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
   • Overwrite existing data with zeros — the RHEL web console rewrites the whole RAID with zeros. This option is slower because the program has to go through the whole RAID. Use this option if RAID includes any data and you need to rewrite it.

8. In the Partitioning drop-down list, select:

   • Compatible with modern system and hard disks > 2TB (GPT) — GUID Partition Table is a modern recommended partitioning system for large RAIDs with more than four partitions.
   • Compatible with all systems and devices (MBR) — Master Boot Record works with disks up to 2 TB in size. MBR also support four primary partitions max.
9. Click Format.

Procedure

1. Open the RHEL 8 web console.
2. Click Storage.
3. In the RAID devices box, click to the RAID you want to edit.
4. In the RAID details screen, scroll down to the Content part.
5. Click to the newly created RAID.
6. Click Create Partition.
7. In the Create partition dialog box, set up the size of the first partition.

8. In the Erase drop-down list, select:

   • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
   • Overwrite existing data with zeros — the RHEL web console rewrites the whole RAID with zeros. This option is slower because the program have to go through the whole RAID. Use this option if RAID includes any data and you need to rewrite it.
9. In the Type drop-down list, select a XFS file system, if you do not have another strong preference.
10. Enter any name for the file system. Do not use spaces in the name.

11. In the Mounting drop down list, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

12. In the Mount Point field, add the mount path.
13. Select Mount at boot.
14. Click Create partition.

Procedure

1. Open the RHEL 8 web console.
2. Click Storage.
3. Click the + button in the Volume Groups box.
4. In the Create Volume Group dialog box, enter a name for the new volume group.

5. In the Disks list, select a RAID device.

   If you do not see the RAID in the list, unmount the RAID from the system. The RAID device must not be used by the RHEL 8 system.

6. Click Create.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Storage.

3. In the Devices section, select Create LVM2 volume group in the drop down menu.

   

4. In the Name field, enter a name of a group without spaces.

5. Select the drives you want to combine to create the volume group.

   

   It might happen that you cannot see devices as you expected. The RHEL web console displays only unused block devices. Used devices means, for example:

   • Devices formatted with a file system
   • Physical volumes in another volume group

   • Physical volumes being a member of another software RAID device

     If you do not see the device, format it to be empty and unused.

6. Click Create.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Storage.
3. In the Devices section, click the volume group in which you want to create logical volumes.
4. In the Logical volumes section, click Create new Logical Volume.
5. In the Name field, enter a name for the new logical volume without spaces.

6. In the Purpose drop down menu, select Block device for filesystems.

   This configuration enables you to create a logical volume with the maximum volume size which is equal to the sum of the capacities of all drives included in the volume group.

   

7. Define the size of the logical volume. Consider:

   • How much space the system using this logical volume will need.
   • How many logical volumes you want to create.

   You do not have to use the whole space. If necessary, you can grow the logical volume later.

   

8. Click Create.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Storage.
3. In the Devices section, click the volume group in which the logical volume is placed.

4. In the Logical volumes section, click Format.

   

5. In the Name field, enter a name for the file system.

6. In the Type drop down menu, select a file system:

   • XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.

     XFS does not support reducing the size of a volume formatted with an XFS file system

   • ext4 file system supports:

     • Logical volumes
     • Switching physical drives online without outage
     • Growing a file system
     • Shrinking a file system

   You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.

7. Select the Overwrite option:

   • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
   • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program have to go through the whole disk. Use this option if the disk includes any data and you need to overwrite it.

8. In the Mount Point field, add the mount path.

   

9. Click Format.

   Formatting can take several minutes depending on the volume size and which formatting options are selected.

   After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.

   

10. To use the logical volume, click Mount.

1. Log in to the RHEL web console.
2. Click Storage.
3. In the Devices section, click the volume group in which the logical volume is placed.
4. In the Logical volumes section, click the logical volume.

5. On the Volume tab, click Grow.

   

6. In the Grow logical volume dialog box, adjust volume size.

   

7. Click Grow.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Storage.
3. Click the volume group in which you want to create thin volumes.
4. Click Create new Logical Volume.
5. In the Name field, enter a name for the new pool of thin volumes without spaces.
6. In the Purpose drop down menu, select Pool for thin-provisioned volumes. This configuration enables you to create the thin volume.

7. Define the size of the pool of thin volumes. Consider:

   • How many thin volumes you will need in this pool?
   • What is the expected size of each thin volume?

   You do not have to use the whole space. If necessary, you can grow the pool later.

8. Click Create.

   The pool for thin volumes has been created and you can add thin volumes.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Storage.
3. Click the volume group in which you want to create thin volumes.
4. Click the desired pool.
5. Click Create Thin Volume.
6. In the Create Thin Volume dialog box, enter a name for the thin volume without spaces.
7. Define the size of the thin volume.
8. Click Create.

Procedure

1. Log in to the RHEL 8 web console.
2. Click Storage.
3. In the Devices section, click the volume group in which the logical volume is placed.

4. In the Logical volumes section, click Format.

   

5. In the Name field, enter a name for the file system.

6. In the Type drop down menu, select a file system:

   • XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.

     XFS does not support reducing the size of a volume formatted with an XFS file system

   • ext4 file system supports:

     • Logical volumes
     • Switching physical drives online without outage
     • Growing a file system
     • Shrinking a file system

   You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.

7. Select the Overwrite option:

   • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
   • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program have to go through the whole disk. Use this option if the disk includes any data and you need to overwrite it.

8. In the Mount Point field, add the mount path.

   

9. Click Format.

   Formatting can take several minutes depending on the volume size and which formatting options are selected.

   After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.

   

10. To use the logical volume, click Mount.

Procedure

1. Log in to the RHEL 8 console.
2. Click Storage.
3. In the Volume Groups box, click the volume group in which you want to add a physical volume.
4. In the Physical Volumes box, click the + button.
5. In the Add Disks dialog box, select the preferred drive and click Add.

1. Log in to the RHEL 8 web console.
2. Click Storage.
3. Click the volume group in which you have the logical volume.
4. In the Physical Volumes section, locate the preferred volume.

5. Click the - button.

   The RHEL 8 web console verifies whether the logical volume has enough free space for removing the disk. If not, you cannot remove the disk and it is necessary to add another disk first. For details, see Adding physical drives to logical volumes in the web console.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. Click the + button in the VDO Devices box.
4. In the Name field, enter a name of a VDO volume without spaces.
5. Select the drive that you want to use.

6. In the Logical Size bar, set up the size of the VDO volume. You can extend it more than ten times, but consider for what purpose you are creating the VDO volume:

   • For active VMs or container storage, use logical size that is ten times the physical size of the volume.
   • For object storage, use logical size that is three times the physical size of the volume.

   For details, see Deploying VDO.

7. In the Index Memory bar, allocate memory for the VDO volume.

   For details about VDO system requirements, see System Requirements.

8. Select the Compression option. This option can efficiently reduce various file formats.

   For details, see Enabling or disabling compression in VDO.

9. Select the Deduplication option.

   This option reduces the consumption of storage resources by eliminating multiple copies of duplicate blocks. For details, see Enabling or disabling compression in VDO.

10. [Optional] If you want to use the VDO volume with applications that need a 512 bytes block size, select Use 512 Byte emulation. This reduces the performance of the VDO volume, but should be very rarely needed. If in doubt, leave it off.
11. Click Create.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Click Storage.
3. Click the VDO volume.
4. Click on the Unrecognized Data tab.
5. Click Format.

6. In the Erase drop down menu, select:

   Don’t overwrite existing data

   The RHEL web console rewrites only the disk header. The advantage of this option is the speed of formatting.

   Overwrite existing data with zeros

   The RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk. Use this option if the disk includes any data and you need to rewrite them.

7. In the Type drop down menu, select a filesystem:

   • The XFS file system supports large logical volumes, switching physical drives online without outage, and growing. Leave this file system selected if you do not have a different strong preference.

     XFS does not support shrinking volumes. Therefore, you will not be able to reduce volume formatted with XFS.

   • The ext4 file system supports logical volumes, switching physical drives online without outage, growing, and shrinking.

   You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.

8. In the Name field, enter the logical volume name.

9. In the Mounting drop down menu, select Custom.

   The Default option does not ensure that the file system will be mounted on the next boot.

10. In the Mount Point field, add the mount path.
11. Select Mount at boot.

12. Click Format.

    Formatting can take several minutes depending on the used formatting options and the volume size.

    After a successful finish, you can see the details of the formatted VDO volume on the Filesystem tab.

13. To use the VDO volume, click Mount.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. Click your VDO volume in the VDO Devices box.
4. In the VDO volume details, click the Grow button.
5. In the Grow logical size of VDO dialog box, extend the logical size of the VDO volume.

1. Click Grow.

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Storage.
3. Select the storage device you want to format.
4. Click the menu icon and select Format option.
5. Select the Encrypt data box to activate encryption on your storage device.
6. Set and confirm your new passphrase.
7. [Optional] Modify further encryption options.
8. Finalize formatting settings.
9. Click Format.

Procedure

1. Log in to the web console. For details, see Logging in to the web console.
2. Click Storage
3. In the Drives table, select the disk with encrypted data.
4. In Content, select the encrypted partition.
5. Click Encryption.
6. In the Keys table, click the pen icon.

7. In the Change passphrase dialog window:

   1. Enter your current passphrase.
   2. Enter your new passphrase.
   3. Confirm your new passphrase.
8. Click Save

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click Software Updates.

   The list of available updates refreshes automatically if the last check happened more than 24 hours ago. To trigger a refresh, click the Check for Updates button.

3. Apply updates. You can watch the update log while the update is running.

   1. To install all available updates, click the Install all updates button.
   2. If you have security updates available, you can install them separately by clicking the Install Security Updates button.
   3. If you have kpatch updates available, you can install them separately by clicking the Install kpatch updates button.

4. Optional: You can turn on the Reboot after completion switch for an automatic restart of your system.

   If you perform this step, you can skip the remaining steps of this procedure.

5. After the system applies updates, you get a recommendation to restart your system.

   We recommend this especially if the update included a new kernel or system services that you do not want to restart individually.

6. Click Ignore to cancel the restart, or Restart Now to proceed with restarting your system.

   After the system restart, log in to the web console and go to the Software Updates page to verify that the update has been successful.

Procedure

1. Log in to RHEL 8 web console. For details, see Logging in to the web console.
2. Click Software Updates.
3. In the Settings table, click the Edit button.
4. Pick one of the types of automatic updates. You can select from Security updates only, or All updates.
5. To modify the day of the automatic update, click on the every day drop-down menu and select a specific day.
6. To modify the time of the automatic update, click into the 6:00 field and select or type a specific time.
7. If you want to disable automatic software updates, select the No updates type.

Procedure

1. Log in to the RHEL 8 web console. For details, see Logging in to the web console.
2. Click Software Updates.
3. Apply an update of your system.
4. After a successful update, click Reboot system…​, Restart services…​, or Ignore

5. If you decide to ignore, you can return to the restart or reboot menu by doing one of the following:

   1. Rebooting:

      1. Click the Reboot system button in the Status field of the Software Updates page.
      2. (Optional) Write a message to the logged in users.
      3. Select a delay from the Delay drop down menu.
      4. Click Reboot.

   2. Restarting services:

      1. Click the Restart services…​ button in the Status field of the Software Updates page.

         You will see a list of all the services that require a restart.

      2. Click Restart services.

         Depending on your choice, the system will reboot or your services will restart.

Procedure

1. Log in to the web console with administrative privileges. For details, see Logging in to the web console.
2. Click Software Updates.

3. Check the status of your kernel patching settings.

   1. If the patching is not installed, click Install.

      

   2. To enable kernel patching, click Enable.

      

   3. Check the check box for applying kernel patches.

   4. Select whether you want to apply patches for current and future kernels, or for the current kernel only. If you choose to subscribe to applying patches for future kernels, the system will apply patches also for the upcoming kernel releases.

      

      

   5. Click Apply.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.

2. In the Health filed in the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to page with your subscription information.

   .

3. In the Overview filed, click Register.

   

4. In the Register system dialog box, select that you want to register using your account credentials.

   

5. Enter your username.
6. Enter your password.

7. Optionally, enter your organization’s name or ID.

   If your account belongs to more than one organization on the Red Hat Customer Portal, you have to add the organization name or organization ID. To get the org ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Insights, clear the Insights check box.
8. Click the Register button.

Procedure

1. Log in to the RHEL web console. For details, see Logging in to the web console.

2. In the Health filed in the Overview page, click the Not registered warning, or click Subscriptions in the main menu to move to page with your subscription information.

   .

3. In the Overview filed, click Register.

   

4. In the Register system dialog box, select that you want to register using an activation key.

   

5. Enter your key or keys.

6. Enter your organization’s name or ID.

   To get the organization ID, go to your Red Hat contact point.

   • If you do not want to connect your system to Red Hat Insights, clear the Insights check box.
7. Click the Register button.

Procedure

1. In the web console, open the Kernel Dump tab and start the kdump service by setting the Kernel crash dump switch to on.
2. Configure the kdump memory usage in the command line.

3. In the Kernel Dump tab, go to Crash dump location and click the link with the path to the dump location.

   

4. Specify the target directory for saving the vmcore dump file:

   • For a local filesystem, select Local Filesystem from the drop-down menu.

     

   • For a remote system by using the SSH protocol, select Remote over SSH from the drop-down menu and specify the following fields:

     • In the Server field, enter the remote server address
     • In the ssh key field, enter the ssh key location
     • In the Directory field, enter the target directory

   • For a remote system by using the NFS protocol, select Remote over NFS from the drop-down menu and specify the following fields:

     • In the Server field, enter the remote server address
     • In the Export field, enter the location of the shared folder of an NFS server

     • In the Directory field, enter the target directory

       Note

       You can reduce the size of the vmcore file by selecting the Compression check box.

Verification

1. Click the Test configuration.

   

2. Click Crash system under Test kdump settings.

   Warning

   When you initiate the system crash, the kernel’s operation stops and results in a system crash with data loss.

Verification

1. Access the web console, for example by entering the https://localhost:9090 address in your browser.
2. Log in.

3. If the installation was successful, Virtual Machines appears in the web console side menu.

   

Procedure

1. In the Virtual Machines interface, click the Menu button ⋮ of the VM that you want to rename.

   A drop down menu appears with controls for various VM operations.

2. Click Rename.

   The Rename a VM dialog appears.

   
3. In the New name field, enter a name for the VM.
4. Click Rename.

Procedure

1. In the RHEL 8 web console, click on your username@hostname in the top left corner of the Overview page.

   

2. In the drop down menu, click the Add new host button.

   

3. In the Add new host dialog box, specify the host you want to add.

4. (Optional) Add the user name for the account to which you want to connect.

   You can use any user account of the remote system. However, if you use credentials of a user account without administration privileges, you will not be able to perform administration tasks.

   If you use the same credentials as for your local system, the web console will authenticate remote systems automatically every time you log in. However, using the same credentials on more machines could be a potential security risk.

5. (Optional) Click the Color field to change the color of the system.

6. Click Add.

   The new host will appear in the list of hosts in the username@hostname drop down menu.

Procedure

1. Log in to the RHEL 8 web console.

2. Click on your username@hostname in the top left corner of the Overview page.

   

3. Click the Edit hosts icon.

   

4. To remove a host from web console, click the red minus sign - button next to its host name. Note that you cannot remove a host you are currently connected to.

   

Procedure

1. In the RHEL 8 web console, click on your username@hostname in the top left corner of the Overview page.

   

2. In the drop down menu, click the Add new host button.

   

3. In the Add new host dialog box, specify the host you want to add.

4. Add the user name for the account to which you want to connect.

   You can use any user account of the remote system. However, if you use credentials of a user account without administration privileges, you will not be able to perform administration tasks.

5. (Optional) Click the Color field to change the color of the system.

6. Click Add.

   A new dialog window will appear asking for a password.

7. Enter the user account password.

8. Check Authorize ssh key if you already have an SSH key.

   

9. Check Create a new SSH key and authorize it if you do not have an SSH key. The web console will create it for you.

   

   1. Add a password for the SSH key.
   2. Confirm the password.

10. Click Log in

    The new host will appear in the list of hosts in the username@hostname drop down menu.

Verification steps

1. Log out.
2. Log back in.
3. Click Log in in the Not connected to host screen.

4. Select SSH key as your authentication option.

   
5. Enter your key password.
6. Click Log in.

Procedure

1. Create a list of the target hosts that can be accessed by the delegation rule:

   1. Create a service delegation target:

      $ ipa servicedelegationtarget-add cockpit-target

   2. Add the target host to the delegation target:

      $ ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/remote.idm.example.com@IDM.EXAMPLE.COM

2. Allow cockpit sessions to access the target host list by creating a service delegation rule and adding the HTTP service Kerberos principal to it:

   1. Create a service delegation rule:

      $ ipa servicedelegationrule-add cockpit-delegation

   2. Add the web console client to the delegation rule:

      $ ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/myhost.idm.example.com@IDM.EXAMPLE.COM

   3. Add the delegation target to the delegation rule:

      $ ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

3. Enable Kerberos authentication on the remote.idm.example.com host:

   1. SSH to remote.idm.example.com as root.
   2. Open the /etc/ssh/sshd_config file for editing.
   3. Enable GSSAPIAuthentication by uncommenting the GSSAPIAuthentication no line and replacing it with GSSAPIAuthentication yes.

4. Restart the SSH service on remote.idm.example.com so that the above changes take effect immediately:

   $ systemctl try-restart sshd.service

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create a web-console-smart-card-ssh.yml playbook with the following content:

   1. Create a task that ensures the presence of a delegation target:

      ---
      - name: Playbook to create a constrained delegation target
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        - name: Ensure servicedelegationtarget web-console-delegation-target is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target

   2. Add a task that adds the target host to the delegation target:

        - name: Ensure servicedelegationtarget web-console-delegation-target member principal host/remote.idm.example.com@IDM.EXAMPLE.COM is present
          ipaservicedelegationtarget:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-target
            principal: host/remote.idm.example.com@IDM.EXAMPLE.COM
            action: member

   3. Add a task that ensures the presence of a delegation rule:

        - name: Ensure servicedelegationrule delegation-rule is present
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule

   4. Add a task that ensures that the Kerberos principal of the web console client service is a member of the constrained delegation rule:

        - name: Ensure the Kerberos principal of the web console client service is added to the servicedelegationrule web-console-delegation-rule
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            principal: HTTP/myhost.idm.example.com
            action: member

   5. Add a task that ensures that the constrained delegation rule is associated with the web-console-delegation-target delegation target:

        - name: Ensure a constrained delegation rule is associated with a specific delegation target
          ipaservicedelegationrule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: web-console-delegation-rule
            target: web-console-delegation-target
            action: member

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory web-console-smart-card-ssh.yml

5. Enable Kerberos authentication on remote.idm.example.com:

   1. SSH to remote.idm.example.com as root.
   2. Open the /etc/ssh/sshd_config file for editing.
   3. Enable GSSAPIAuthentication by uncommenting the GSSAPIAuthentication no line and replacing it with GSSAPIAuthentication yes.

Procedure

1. Log into the RHEL web console.

   For details, see Logging in to the web console.

2. In the Configuration field of the Overview tab click Join Domain.
3. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
4. In the Domain administrator name field, enter the user name of the IdM administration account.
5. In the Domain administrator password, add a password.
6. Click Join.

Verification steps

1. If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.

2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

   $ id
   euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Procedure

1. Connect to the IdM server.

2. Run the ipa-advise script:

   $ ipa-advise enable-admins-sudo | sh -ex

Procedure

1. Install the opensc and gnutls-utils packages:

   # dnf -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \
       --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set the label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \
       --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \
       --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key and storing your certificate in the next step. Specifying your own value for --id is recommended as otherwise a more complicated value is calculated by the tool.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \
       --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. (Optional) Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key
       --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key or certificate, specify the same ID as the ID of the private key or certificate.

7. (Optional) Certain smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Log in to the RHEL web console with administrator privileges.

   For details, see Logging in to the web console.

2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

4. Optionally, disable password based authentication in cockpit.conf with:

   [Basic]
   action = none

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

Procedure

1. Open your web browser and add the web console’s address in the address bar.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

3. To apply the changes, restart the system:

   # systemctl daemon-reload
   # systemctl stop cockpit

Procedure

1. Click Podman containers in the main menu.
2. In the Images table, click the overflow menu in the upper-right corner and select Download new image.
3. The Search for an image dialog box appears.
4. In the Search for field, enter the name of the image or specify its description.
5. In the in drop-down list, select the registry from which you want to pull the image.
6. Optional: In the Tag field, enter the tag of the image.
7. Click Download

Procedure

1. Click Podman containers in the main menu.
2. In the Images table, click the overflow menu in the upper-right corner and select Prune unused images.
3. The pop-up window with the list of images appears. Click Prune to confirm your choice.

Procedure

1. Click Podman containers in the main menu.
2. In the Images table, select the image you want to delete and click the overflow menu and select Delete.
3. The pop-up window appears. Click Delete tagged images to confirm your choice.

Procedure

1. Click Podman containers in the main menu.
2. Click Create container.
3. In the Name field, enter the name of your container.

4. Provide desired info in the Details tab.

   • Available only with the administrative access: Select the Owner of the container: System or User.

   • In the Image drop down list select or search the container image in selected registries.

     • Optional: Check the Pull latest image checkbox to pull the latest container image.

   • The Command field specifies the command. You can change the default command if you need.

     • Optional: Check the With terminal checkbox to run your container with a terminal.
   • The Memory limit field specifies the memory limit for the container. To change the default memory limit, check the checkbox and specify the limit.
   • Available only for system containers: In the CPU shares field, specify the relative amount of CPU time. Default value is 1024. Check the checkbox to modify the default value.

   • Available only for system containers: In the Restart policy drop down menu, select one of the following options:

     • No (default value): No action.
     • On Failure: Restarts a container on failure.
     • Always: Restarts container when exits or after system boot.

5. Provide desired info in the Integration tab.

   • Click Add port mapping to add port mapping between container and host system.

     • Enter the IP address, Host port, Container port and Protocol.

   • Click Add volume to add volume.

     • Enter the host path, Container path. You can check the Writable checkbox to create a writable volume. In the SELinux drop down list, select one of the following options: No Label, Shared or Private.

   • Click Add variable to add environment variable.

     • Enter the Key and Value.

6. Provide desired info in the Health check tab.

   • In the Command fields, enter the healthcheck command.

   • Specify the healthcheck options:

     • Interval (default is 30 seconds)
     • Timeout (default is 30 seconds)
     • Start period
     • Retries (default is 3) for the healthcheck command
7. Click Create and run to create and run the container.

Procedure

1. Click Podman containers in the main menu.

2. Click the > arrow icon to see details of the container.

   • In the Details tab, you can see container ID, Image, Command, Created (timestamp when the container was created), and its State.

     • Available only for system containers: You can also see IP address, MAC address, and Gateway address.
   • In the Integration tab, you can see environment variables, port mappings, and volumes.
   • In the Log tab, you can see container logs.
   • In the Console tab, you can interact with the container using the command line.

Procedure

1. Click Podman containers in the main menu.

2. In the Containers table, select the container you want to modify and click the overflow menu and select the action you want to perform:

   • Start
   • Stop
   • Force stop
   • Restart
   • Force restart
   • Pause
   • Rename

Procedure

1. Click Podman containers in the main menu.
2. In the Containers table, select the container you want to modify and click the overflow menu and select Commit.

3. In the Commit container form, add the following details:

   • In the New image name field, enter the image name.
   • Optional: In the Tag field, enter the tag.
   • Optional: In the Author field, enter your name.
   • Optional: In the Command field, change command if you need.

   • Optional: Check the Options you need:

     • Pause container when creating image: The container and its processes are paused while the image is committed.
     • Use legacy Docker format: if you do not use the Docker image format, the OCI format is used.
4. Click Commit.

Procedure

1. Click Podman containers in the main menu.
2. In the Containers table, select the container you want to modify and click the overflow icon menu and select Checkpoint.

3. Optional: In the Checkpoint container form, check the options you need:

   • Keep all temporary checkpoint files: keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging.
   • Leave running after writing checkpoint to disk: leave the container running after checkpointing instead of stopping it.
   • Support preserving established TCP connections
4. Click Checkpoint.

Procedure

1. Click Podman containers in the main menu.
2. In the Containers table, select the container you want to modify and click the overflow menu and select Restore.

3. Optional: In the Restore container form, check the options you need:

   • Keep all temporary checkpoint files: Keep all temporary log and statistics files created by CRIU during checkpointing. These files are not deleted if checkpointing fails for further debugging.
   • Restore with established TCP connections
   • Ignore IP address if set statically: If the container was started with IP address the restored container also tries to use that IP address and restore fails if that IP address is already in use. This option is applicable if you added port mapping in the Integration tab when you create the container.
   • Ignore MAC address if set statically: If the container was started with MAC address the restored container also tries to use that MAC address and restore fails if that MAC address is already in use.
4. Click Restore.

Procedure

1. Click Podman containers in the main menu.
2. In the Containers table, select the container you want to delete and click the overflow menu and select Delete.
3. The pop-up window appears. Click Delete to confirm your choice.

Procedure

1. Click Podman containers in the main menu.
2. Click Create pod.

3. Provide desired information in the Create pod form:

   • Available only with the administrative access: Select the Owner of the container: System or User.
   • In the Name field, enter the name of your container.

   • Click Add port mapping to add port mapping between container and host system.

     • Enter the IP address, Host port, Container port and Protocol.

   • Click Add volume to add volume.

     • Enter the host path, Container path. You can check the Writable checkbox to create a writable volume. In the SELinux drop down list, select one of the following options: No Label, Shared or Private.
4. Click Create.

Procedure

1. Click Podman containers in the main menu.
2. Click Create container in pod.
3. Follow the steps 3.-8. in Creating containers in the web console.

Procedure

1. Click Podman containers in the main menu.

2. In the Containers table, select the pod you want to modify and click the overflow menu and select the action you want to perform:

   • Start
   • Stop
   • Force stop
   • Restart
   • Force restart
   • Pause

Procedure

1. Click Podman containers in the main menu.
2. In the Containers table, select the pod you want to delete and click the overflow menu and select Delete.
3. The pop-up window appears. Click Delete to confirm your choice.