Managing systems using the RHEL 8 web console
A guide to using the web console for managing systems in Red Hat Enterprise Linux 8
Abstract
Making open source more inclusive
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.
Providing feedback on Red Hat documentation
We appreciate your input on our documentation. Please let us know how we could make it better. To do so:
For simple comments on specific passages:
- Make sure you are viewing the documentation in the Multi-page HTML format. In addition, ensure you see the Feedback button in the upper right corner of the document.
- Use your mouse cursor to highlight the part of text that you want to comment on.
- Click the Add Feedback pop-up that appears below the highlighted text.
- Follow the displayed instructions.
For submitting more complex feedback, create a Bugzilla ticket:
- Go to the Bugzilla website.
- As the Component, use Documentation.
- Fill in the Description field with your suggestion for improvement. Include a link to the relevant part(s) of documentation.
- Click Submit Bug.
Chapter 1. Getting started using the RHEL web console
Install the web console in Red Hat Enterprise Linux 8 and learn how to add remote hosts and monitor them in the RHEL 8 web console.
Prerequisites
- Installed Red Hat Enterprise Linux 8.
- Enabled networking.
Registered system with appropriate subscription attached.
To obtain a subscription, see Managing subscriptions in the web console.
1.1. What is the RHEL web console
The RHEL web console is a Red Hat Enterprise Linux 8 web-based interface designed for managing and monitoring your local system, as well as Linux servers located in your network environment.
The RHEL web console enables you a wide range of administration tasks, including:
- Managing services
- Managing user accounts
- Managing and monitoring system services
- Configuring network interfaces and firewall
- Reviewing system logs
- Managing virtual machines
- Creating diagnostic reports
- Setting kernel dump configuration
- Configuring SELinux
- Updating software
- Managing system subscriptions
The RHEL web console uses the same system APIs as you would in a terminal, and actions performed in a terminal are immediately reflected in the RHEL web console.
You can monitor the logs of systems in the network environment, as well as their performance, displayed as graphs. In addition, you can change the settings directly in the web console or through the terminal.
1.2. Installing and enabling the web console
To access the RHEL 8 web console, first enable the cockpit.socket
service.
Red Hat Enterprise Linux 8 includes the RHEL 8 web console installed by default in many installation variants. If this is not the case on your system, install the cockpit
package before enabling the cockpit.socket
service.
Procedure
If the web console is not installed by default on your installation variant, manually install the
cockpit
package:# yum install cockpit
Enable and start the
cockpit.socket
service, which runs a web server:# systemctl enable --now cockpit.socket
If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the
cockpit
service tofirewalld
to open port 9090 in the firewall:# firewall-cmd --add-service=cockpit --permanent # firewall-cmd --reload
Verification steps
- To verify the previous installation and configuration, open the web console.
1.3. Logging in to the web console
Use the steps in this procedure for the first login to the RHEL web console using a system user name and password.
Prerequisites
Use one of the following browsers for opening the web console:
- Mozilla Firefox 52 and later
- Google Chrome 57 and later
- Microsoft Edge 16 and later
System user account credentials
The RHEL web console uses a specific PAM stack located at
/etc/pam.d/cockpit
. Authentication with PAM allows you to log in with the user name and password of any local account on the system.
Procedure
Open the web console in your web browser:
-
Locally:
https://localhost:9090
-
Remotely with the server’s hostname:
https://example.com:9090
Remotely with the server’s IP address:
https://192.0.2.2:9090
If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.
The console loads a certificate from the
/etc/cockpit/ws-certs.d
directory and uses the last file with a.cert
extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).
-
Locally:
In the login screen, enter your system user name and password.
Optionally, click the Reuse my password for privileged tasks option.
If the user account you are using to log in has sudo privileges, this makes it possible to perform privileged tasks in the web console, such as installing software or configuring SELinux.
- Click Log In.
After successful authentication, the RHEL web console interface opens.
1.4. Connecting to the web console from a remote machine
It is possible to connect to your web console interface from any client operating system and also from mobile phones or tablets.
Prerequisites
Device with a supported internet browser, such as:
- Mozilla Firefox 52 and later
- Google Chrome 57 and later
- Microsoft Edge 16 and later
- RHEL 8 server you want to access with an installed and accessible web console. For more information about the installation of the web console see Installing the web console.
Procedure
- Open your web browser.
Type the remote server’s address in one of the following formats:
-
With the server’s host name:
server.hostname.example.com:port_number
-
With the server’s IP address:
server.IP_address:port_number
-
With the server’s host name:
- After the login interface opens, log in with your RHEL machine credentials.
1.5. Logging in to the web console using a one-time password
If your system is part of an Identity Management (IdM) domain with enabled one-time password (OTP) configuration, you can use an OTP to log in to the RHEL web console.
It is possible to log in using a one-time password only if your system is part of an Identity Management (IdM) domain with enabled OTP configuration. For more information about OTP in IdM, see One-time password in Identity Management.
Prerequisites
The RHEL web console has been installed.
For details, see Installing the web console.
An Identity Management server with enabled OTP configuration.
For details, see One-time password in Identity Management.
- A configured hardware or software device generating OTP tokens.
Procedure
Open the RHEL web console in your browser:
-
Locally:
https://localhost:PORT_NUMBER
-
Remotely with the server hostname:
https://example.com:PORT_NUMBER
Remotely with the server IP address:
https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER
If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.
The console loads a certificate from the
/etc/cockpit/ws-certs.d
directory and uses the last file with a.cert
extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).
-
Locally:
- The Login window opens. In the Login window, enter your system user name and password.
- Generate a one-time password on your device.
- Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
- Click Log in.
- Successful login takes you to the Overview page of the web console interface.
1.6. Restarting the system using the web console
You can use the web console to restart a RHEL system that the web console is attached to.
Prerequisites
The web console is installed and accessible.
For details, see Installing the web console.
Procedure
Log into the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Overview.
Click the Restart restart button.
- If any users are logged into the system, write a reason for the restart in the Restart dialog box.
Optional: In the Delay drop down list, select a time interval.
- Click Restart.
1.7. Shutting down the system using the web console
You can use the web console to shut down a RHEL system that the web console is attached to.
Prerequisites
The web console is installed and accessible.
For details, see Installing the web console.
Procedure
Log into the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Overview.
In the Restart drop down list, select Shut Down.
- If any users are logged in to the system, write a reason for the shutdown in the Shut Down dialog box.
- Optional: In the Delay drop down list, select a time interval.
- Click Shut Down.
1.8. Configuring time settings using the web console
You can set a time zone and synchronize the system time with a Network Time Protocol (NTP) server.
Prerequisites
The web console is installed and accessible.
For details, see Installing the web console.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
Click the current system time in Overview.
- In the Change System Time dialog box, change the time zone if necessary.
In the Set Time drop down menu, select one of the following:
- Manually
- Use this option if you need to set the time manually, without an NTP server.
- Automatically using NTP server
- This is a default option, which synchronizes time automatically with the preset NTP servers.
- Automatically using specific NTP servers
- Use this option only if you need to synchronize the system with a specific NTP server. Specify the DNS name or the IP address of the server.
Click Change.
Verification steps
- Check the system time displayed in the System tab.
Additional resources
1.9. Joining a RHEL 8 system to an IdM domain using the web console
You can use the web console to join the Red Hat Enterprise Linux 8 system to the Identity Management (IdM) domain.
Prerequisites
- The IdM domain is running and reachable from the client you want to join.
- You have the IdM domain administrator credentials.
Procedure
Log into the RHEL web console.
For details, see Logging in to the web console.
- Open the System tab.
Click
.- In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
In the Authentication drop down list, select if you want to use a password or a one-time password for authentication.
- In the Domain Administrator Name field, enter the user name of the IdM administration account.
- In the password field, add the password or one-time password according to what you selected in the Authentication drop down list earlier.
Click
.
Verification steps
- If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.
To verify that the user is a member of the domain, click the Terminal page and type the
id
command:$ id euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
1.10. Disabling SMT to prevent CPU security issues using the web console
Disable Simultaneous Multi Threading (SMT) in case of attacks that misuse CPU SMT. Disabling SMT can mitigate security vulnerabilities, such as L1TF or MDS.
Disabling SMT might lower the system performance.
Prerequisites
The web console must be installed and accessible.
For details, see Installing the web console.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click System.
In the Hardware item, click the hardware information.
In the CPU Security item, click Mitigations.
If this link is not present, it means that your system does not support SMT, and therefore is not vulnerable.
In the CPU Security Toggles, switch on the Disable simultaneous multithreading (nosmt) option.
- Click on the Save and reboot button.
After the system restart, the CPU no longer uses SMT.
1.11. Adding a banner to the login page
Companies or agencies sometimes need to show a warning that usage of the computer is for lawful purposes, the user is subject to surveillance, and anyone trespassing will be prosecuted. The warning must be visible before login. Similarly to SSH, the web console can optionally show the content of a banner file on the login screen. To enable banners in your web console sessions, you need to modify the /etc/cockpit/cockpit.conf
file. Note that the file is not required and you may need to create it manually.
Prerequisites
- The web console is installed and accessible. For details, see Installing the web console.
- You must have sudo privileges.
Procedure
Create the
/etc/issue.cockpit
file in a text editor of your preference if you do not have it yet. Add the content you want to display as the banner to the file.Do not include any macros in the file as there is no re-formatting done between the file content and the displayed content. Use intended line breaks. It is possible to use ASCII art.
- Save the file.
Open or create the
cockpit.conf
file in the/etc/cockpit/
directory in a text editor of your preference.$ sudo vi cockpit.conf
Add the following text to the file:
[Session] Banner=/etc/issue.cockpit
- Save the file.
Restart the web console for changes to take effect.
# systemctl try-restart cockpit
Verification steps
- Open the web console login screen again to verify that the banner is now visible.
Example 1.1. Adding an example banner to the login page
Create an
/etc/issue.cockpit
file with a desired text using a text editor:This is an example banner for the RHEL web console login page.
Open or create the
/etc/cockpit/cockpit.conf
file and add the following text:[Session] Banner=/etc/issue.cockpit
- Restart the web console.
Open the web console login screen again.
1.12. Configuring automatic idle lock in the web console
By default, there is no idle timeout set in the web console interface. If you wish to enable an idle timeout on your system, you can do so by modifying the /etc/cockpit/cockpit.conf
configuration file. Note that the file is not required and you may need to create it manually.
Prerequisites
The web console must be installed and accessible.
For details, see Installing the web console.
- You must have sudo privileges.
Procedure
Open or create the
cockpit.conf
file in the/etc/cockpit/
directory in a text editor of your preference.$ sudo vi cockpit.conf
Add the following text to the file:
[Session] IdleTimeout=X
Substitute X with a number for a time period of your choice in minutes.
- Save the file.
Restart the web console for changes to take effect.
# systemctl try-restart cockpit
Verification steps
- Check if the session logs you out after a set period of time.
Chapter 2. Configuring the host name in the web console
Learn how to use the RHEL 8 web console to configure different forms of the host name on the system that the web console is attached to.
2.1. Host name
The host name identifies the system. By default, the host name is set to localhost
, but you can change it.
A host name consists of two parts:
- Host name
- It is a unique name which identifies a system.
- Domain
- Add the domain as a suffix behind the host name when using a system in a network and when using names instead of just IP addresses.
A host name with an attached domain name is called a fully qualified domain name (FQDN). For example: mymachine.example.com
.
Host names are stored in the /etc/hostname
file.
2.2. Pretty host name in the web console
You can configure a pretty host name in the RHEL web console. The pretty host name is a host name with capital letters, spaces, and so on.
The pretty host name displays in the web console, but it does not have to correspond with the host name.
Example 2.1. Host name formats in the web console
- Pretty host name
-
My Machine
- Host name
-
mymachine
- Real host name - fully qualified domain name (FQDN)
-
mymachine.idm.company.com
2.3. Setting the host name using the web console
This procedure sets the real host name or the pretty host name in the web console.
Prerequisites
The web console is installed and accessible.
For details, see Installing the web console.
Procedure
Log into the RHEL 8 web console.
For details, see Logging in to the web console.
- Click .
Click
next to the current host name.- In the Change Host Name dialog box, enter the host name in the Pretty Host Name field.
The Real Host Name field attaches a domain name to the pretty name.
You can change the real host name manually if it does not correspond with the pretty host name.
Click
.
Verification steps
- Log out from the web console.
Reopen the web console by entering an address with the new host name in the address bar of your browser.
Chapter 3. Red Hat web console add-ons
Install add-ons in the RHEL 8 web console and learn what add-on applications are available for you.
3.1. Installing add-ons
The cockpit
package is a part of Red Hat Enterprise Linux 8 by default. To be able to use add-on applications you must install them separately.
Prerequisites
-
Installed and enabled
cockpit
package. If you need to install web console first, check the installation section.
Procedure
Install an add-on.
# yum install <add-on>
3.2. Add-ons for the RHEL 8 web console
The following table lists available add-on applications for the RHEL 8 web console.
Feature name | Package name | Usage |
---|---|---|
Composer | cockpit-composer | Building custom OS images |
Dashboard | cockpit-dashboard | Managing multiple servers in one UI |
Machines | cockpit-machines | Managing libvirt virtual machines |
PackageKit | cockpit-packagekit | Software updates and application installation (usually installed by default) |
PCP | cockpit-pcp | Persistent and more fine-grained performance data (installed on demand from the UI) |
podman | cockpit-podman | Managing podman containers (available from RHEL 8.1) |
Session Recording | cockpit-session-recording | Recording and managing user sessions |
Chapter 4. Optimizing the system performance using the web console
Learn how to set a performance profile in the RHEL 8 web console to optimize the performance of the system for a selected task.
4.1. Performance tuning options in the web console
Red Hat Enterprise Linux 8 provides several performance profiles that optimize the system for the following tasks:
- Systems using the desktop
- Throughput performance
- Latency performance
- Network performance
- Low power consumption
- Virtual machines
The tuned
service optimizes system options to match the selected profile.
In the web console, you can set which performance profile your system uses.
Additional resources
-
For details about the
tuned
service, see Monitoring and managing system status and performance.
4.2. Setting a performance profile in the web console
This procedure uses the web console to optimize the system performance for a selected task.
Prerequisites
The web console is installed and accessible.
For details, see Installing the web console.
Procedure
Log into the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Overview.
In the Performance Profile field, click the current performance profile.
- In the Change Performance Profile dialog box, change the profile if necessary.
Click Change Profile.
Verification steps
- The Overview tab now shows the selected performance profile.
Chapter 5. Reviewing logs in the web console
Learn how to access, review and filter logs in the RHEL 8 web console.
5.1. Reviewing logs in the web console
The RHEL 8 web console Logs section is a UI for the journalctl
utility. This section describes how to access system logs in the web console interface.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
Click Logs.
- Open log entry details by clicking on your selected log entry in the list.
You can use the Pause button to pause new log entries from appearing. Once you resume new log entries, the web console will load all log entries that were reported after you used the Pause button.
You can filter the logs by time, priority or identifier. For more information, see Section 5.2, “Filtering logs in the web console”.
5.2. Filtering logs in the web console
This section shows how to filter log entries in the web console.
Prerequisites
The web console interface must be installed and accessible.
For details, see Installing the web console.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Logs.
By default, web console shows the latest log entries. To filter by a specific time range, click the Time drop-down menu and choose a preferred option.
Error and above severity logs list is shown by default. To filter by different priority, click the Error and above drop-down menu and choose a preferred priority.
By default, web console shows logs for all identifiers. To filter logs for a particular identifier, click the All drop-down menu and select an identifier.
- To open a log entry, click on a selected log.
5.3. Text search options for filtering logs in the web console
The text search option functionality provides a big variety of options for filtering logs. If you decide to filter logs by using the text search, you can use the predefined options that are defined in the three drop-down menus, or you can type the whole search yourself.
Drop-down menus
There are three drop-down menus that you can use to specify the main parameters of your search:
- Time: This drop-down menu contains predefined searches for different time ranges of your search.
-
Priority: This drop-down menu provides options for different priority levels. It corresponds to the
journalctl --priority
option. The default priority value is Error and above. It is set every time you do not specify any other priority. -
Identifier: In this drop-down menu, you can select an identifier that you want to filter. Corresponds to the
journalctl --identifier
option.
Quantifiers
There are six quantifiers that you can use to specify your search. They are covered in the Options for filtering logs table.
Log fields
If you want to search for a specific log field, it is possible to specify the field together with its content.
Free-form text search in logs messages
You can filter any text string of your choice in the logs messages. The string can also be in the form of a regular expressions.
Advanced logs filtering I
Filter all log messages identified by 'systemd' that happened since October 22, 2020 midnight and journal field 'JOB_TYPE' is either 'start' or 'restart.
-
Type
identifier:systemd since:2020-10-22 JOB_TYPE=start,restart
to search field. Check the results.
Advanced logs filtering II
Filter all log messages that come from 'cockpit.service' systemd unit that happened in the boot before last and the message body contains either "error" or "fail".
-
Type
service:cockpit boot:-1 error|fail
to the search field. Check the results.
5.4. Using a text search box to filter logs in the web console
Using the text search box allows you to filter logs according to different parameters. The search combines usage of the filtering drop-down menus, quantifiers, log fields and free-form string search.
Prerequisites
The web console interface must be installed and accessible.
For details, see Installing the web console.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Logs.
Use the drop-down menus to specify the three main quantifiers - time range, priority, and identifier(s) - you want to filter.
The Priority quantifier always has to have a value. If you do not specify it, it automatically filters the Error and above priority. Notice that the options you set reflect in the text search box.
Specify the log field you want to filter.
It is possible to add several log fields.
- You can use a free-form string to search for anything else. The search box also accepts regular expressions.
5.5. Options for logs filtering
There are several journalctl
options, which you can use for filtering logs in the web console, that may be useful. Some of these are already covered as part of the drop-down menus in the web console interface.
Table 5.1. Table
Option name | Usage | Notes |
---|---|---|
| Filter output by message priorities. Takes a single numeric or textual log level. The log levels are the usual syslog log levels. If a single log level is specified, all messages with this log level or a lower (hence more important) log level are shown. | Covered in the Priority drop-down menu. |
| Show messages for the specified syslog identifier SYSLOG_IDENTIFIER. Can be specified multiple times. | Covered in the Identifier drop-down menu. |
| Shows only the most recent journal entries, and continuously prints new entries as they are appended to the journal. | Not covered in a drop-down. |
|
Show messages for the specified |
Is not covered in a drop-down. Corresponds to the |
| Show messages from a specific boot. A positive integer will look up the boots starting from the beginning of the journal, and an equal-or-less-than zero integer will look up boots starting from the end of the journal. Thus, 1 means the first boot found in the journal in chronological order, 2 the second and so on; while -0 is the last boot, -1 the boot before last, and so on. | Covered only as Current boot or Previous boot in the Time drop-down menu. Other options need to be written manually. |
| Start showing entries on or newer than the specified date, or on or older than the specified date, respectively. Date specifications should be of the format "2012-10-30 18:17:16". If the time part is omitted, "00:00:00" is assumed. If only the seconds component is omitted, ":00" is assumed. If the date component is omitted, the current day is assumed. Alternatively the strings "yesterday", "today", "tomorrow" are understood, which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day, respectively. "now" refers to the current time. Finally, relative times may be specified, prefixed with "-" or "+", referring to times before or after the current time, respectively. | Not covered in a drop-down. |
Chapter 6. Managing user accounts in the web console
The RHEL web console offers an interface for adding, editing, and removing system user accounts.
After reading this section, you will know:
- From where the existing accounts come from.
- How to add new accounts.
- How to set password expiration.
- How and when to terminate user sessions.
Prerequisites
- Being logged into the RHEL web console with an account that has administrator permissions assigned. For details, see Logging in to the RHEL web console.
6.1. System user accounts managed in the web console
With user accounts displayed in the RHEL web console you can:
- Authenticate users when accessing the system.
- Set the access rights to the system.
The RHEL web console displays all user accounts located in the system. Therefore, you can see at least one user account just after the first login to the web console.
After logging into the RHEL web console, you can perform the following operations:
- Create new users accounts.
- Change their parameters.
- Lock accounts.
- Terminate user sessions.
6.2. Adding new accounts using the web console
Use the following steps for adding user accounts to the system and setting administration rights to the accounts through the RHEL web console.
Prerequisites
- The RHEL web console must be installed and accessible. For details, see Installing the web console.
Procedure
- Log in to the RHEL web console.
- Click .
- Click .
In the Full Name field, enter the full name of the user.
The RHEL web console automatically suggests a user name from the full name and fills it in the User Name field. If you do not want to use the original naming convention consisting of the first letter of the first name and the whole surname, update the suggestion.
In the Password/Confirm fields, enter the password and retype it for verification that your password is correct.
The color bar placed below the fields shows you security level of the entered password, which does not allow you to create a user with a weak password.
- Click to save the settings and close the dialog box.
- Select the newly created account.
Select Server Administrator in the Roles item.
Now you can see the new account in the Accounts settings and you can use the credentials to connect to the system.
6.3. Enforcing password expiration in the web console
By default, user accounts have set passwords to never expire. You can set system passwords to expire after a defined number of days. When the password expires, the next login attempt will prompt for a password change.
Procedure
- Log in to the RHEL 8 web console.
- Click .
- Select the user account for which to enforce password expiration.
- In the user account settings, click .
- In the Password Expiration dialog box, select Require password change every … days and enter a positive whole number representing the number of days when the password expires.
- Click .
Verification steps
To verify that the password expiration is set, open the account settings.
The RHEL 8 web console displays a link with the date of expiration.
6.4. Terminating user sessions in the web console
A user creates user sessions when logging into the system. Terminating user sessions means to log the user out from the system. It can be helpful if you need to perform administrative tasks sensitive to configuration changes, for example, system upgrades.
In each user account in the RHEL 8 web console, you can terminate all sessions for the account except for the web console session you are currently using. This prevents you from loosing access to your system.
Procedure
- Log in to the RHEL 8 web console.
- Click .
- Click the user account for which you want to terminate the session.
Click
.If the
button is inactive, the user is not logged in to the system.The RHEL web console terminates the sessions.
Chapter 7. Managing services in the web console
Learn how to manage system services in the RHEL 8 web console interface. You can activate or deactivate services, restart or reload them, or manage their automatic startup.
7.1. Activating or deactivating system services in the web console
This procedure activates or deactivates system services using the web console interface.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
You can filter the services by name or description and also by Enabled, Disabled, or Static automatic startup. The interface shows the current state of the service and its recent logs.
Log in to the RHEL web console with administrator privileges.
For details, see Logging in to the web console.
- Click Services in the web console menu on the left.
The default tab for Services is System Services. If you want to manage targets, sockets, timers, or paths, switch to the respective tab in the menu on top.
- To open service settings, click on a selected service from the list. You can tell which services are active or inactive by checking the State column.
Activate or deactivate a service:
To activate an inactive service, click the Start button.
To deactivate an active service, click the Stop button.
7.2. Restarting system services in the web console
This procedure restarts system services using the web console interface.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
You can filter the services by name or description and also by Enabled, Disabled, or Static automatic startup. The interface shows the current state of the service and its recent logs.
Log in to the RHEL web console with administrator privileges.
For details, see Logging in to the web console.
- Click Services in the web console menu on the left.
The default tab for Services is System Services. If you want to manage targets, sockets, timers, or paths, switch to the respective tab in the menu on top.
- To open service settings, click on a selected service from the list.
To restart a service, click the Restart button.
Chapter 8. Configuring network bonds using the web console
Learn how network bonding works and configure network bonds in the RHEL 8 web console.
The RHEL 8 web console is build on top of the NetworkManager service.
For details, see Getting started with NetworkManager for managing networking.
Prerequisites
The RHEL 8 web console installed and enabled.
For details, see Installing the web console.
8.1. Understanding network bonding
Network bonding is a method to combine or aggregate network interfaces to provide a logical interface with higher throughput or redundancy.
The active-backup
, balance-tlb
, and balance-alb
modes do not require any specific configuration of the network switch. However, other bonding modes require configuring the switch to aggregate the links. For example, Cisco switches requires EtherChannel
for modes 0, 2, and 3, but for mode 4, the Link Aggregation Control Protocol (LACP) and EtherChannel
are required.
For further details, see the documentation of your switch and Linux Ethernet Bonding Driver HOWTO.
Certain network bonding features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see the Is bonding supported with direct connection using crossover cables? KCS solution.
8.2. Bond modes
In RHEL 8 there are several mode options. Each mode option is characterize by specific load balancing and fault tolerance. The behavior of the bonded interfaces depends upon the mode. The bonding modes provide fault tolerance, load balancing or both.
Load balancing modes
- Round Robin: Sequentially transmit packets from the first available interface to the last one.
Fault tolerance modes
- Active Backup: Only when the primary interface fails, one of a backup interfaces replaces it. Only a MAC address used by active interface is visible.
Broadcast: All transmissions are sent on all interfaces.
NoteBroadcasting significantly increases network traffic on all the bonded interfaces.
Fault tolerance and load balancing modes
- XOR: The destination MAC addresses are distributed equally between interfaces with a modulo hash. Each interface then serves the same group of MAC addresses.
802.3ad: Sets an IEEE 802.3ad dynamic link aggregation policy. Creates aggregation groups that share the same speed and duplex settings. Transmits and receives on all interfaces in the active aggregator.
NoteThis mode requires a switch that is 802.3ad compliant.
- Adaptive transmit load balancing: The outgoing traffic is distributed according to the current load on each interface. Incoming traffic is received by the current interface. If the receiving interface fails, another interface takes over the MAC address of the failed one.
Adaptive load balancing: Includes transmit and receive load balancing for IPv4 traffic.
Receive load balancing is achieved through Address Resolution Protocol (ARP) negotiation, therefore, it is necessary to set Link Monitoring to ARP in the bond’s configuration.
8.3. Adding a new bond using the web console
Configure an active-backup bond on two or more network interfaces using the web console.
Other network bond modes can be configured similarly.
Prerequisites
- Two or more network cards are installed in the server.
- The network cards are connected to a switch.
Procedure
Log in to the web console.
For details, see Logging in to the web console.
- Open Networking.
- Click the Add Bond button.
- In the Bond Settings dialog box, enter a name for the new bond.
- In the Members field, select interfaces which should be a member of the bond.
[Optional] In the MAC drop down list, select a MAC address which will be used for this interface.
If you leave the MAC field empty, the bond will get one of the addresses that are listed in the drop down list.
In the Mode drop down list, select the mode.
For details, see network bond modes
If you select Active Backup, select the primary interface.
In the Link Monitoring drop down menu, leave here the MII option.
Only the adaptive load balancing mode requires to switch this option to ARP.
- The Monitoring Interval, Link up delay, and Link down delay fields, which contain values in milliseconds, leave as they are. Change it only for a troubleshooting purpose.
Click Apply.
To verify that the bond works correctly, go to the Networking section and check if the Sending and Receiving columns in the Interfaces table display a network activity.
8.4. Adding interfaces to the bond using the web console
Network bonds can include multiple interfaces and you can add or remove any of them at any time.
Learn how to add a network interface to an existing bond.
Prerequisites
- Having a bond with multiple interfaces configured as described in Section 8.3, “Adding a new bond using the web console”.
Procedure
Log in to the web console.
For details, see Logging in to the web console.
- Open Networking.
- In the Interfaces table, click on the bond you want to configure.
- In the bond settings screen, scroll down to the table of members (interfaces).
- Click the + icon.
Select the interface in the drop down list and click it.
The RHEL 8 web console adds the interface to the bond.
8.5. Removing or disabling an interface from the bond using the web console
Network bonds can include multiple interfaces. If you need to change a device, you can remove or disable particular interfaces from the bond, which will work with the rest of the active interfaces.
To stop using an interface included in a bond, you can:
- Remove the interface from the bond.
- Disable the interface temporarily. The interface stays a part of the bond, but the bond will not use it until you enable it again.
Prerequisites
- Having a bond with multiple interfaces configured as described in Section 8.3, “Adding a new bond using the web console”.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Open Networking.
- Click the bond you want to configure.
- In the bond settings screen, scroll down to the table of ports (interfaces).
Select the interface and and remove or disable it:
- Click the - icon to remove the interface.
- Switch the ON/OFF button to Off.
Based on your choice, the web console either removes or disables the interface from the bond and you can see it back in the Networking section as standalone interface.
8.6. Removing or disabling a bond using the web console
Remove or disable a network bond using the web console. If you disable the bond, the interfaces stay in the bond, but the bond will not be used for network traffic.
Prerequisites
- There is an existing bond in the web console.
Procedure
Log in to the web console.
For details, see Logging in to the web console.
- Open Networking.
- Click the bond you want to remove.
In the bond settings screen, you can disable the bond with the ON/OFF button or click the Delete button to remove the bond permanently.
You can go back to Networking and verify that all the interfaces from the bond are now standalone interfaces.
Chapter 9. Configuring network teams using the web console
Learn how network bonding works, what are the differences between network teams and network bonds, and what are the possibilities of configuration in the web console.
Additionally you can find guidelines for:
- Adding a new network team
- Adding new interfaces to an existing network team
- Removing interfaces from an existing network team
- Removing a network team
Prerequisites
The RHEL 8 web console installed and enabled.
For details, see Installing the web console.
9.1. Understanding network teaming
Network teaming is a feature that combines or aggregates network interfaces to provide a logical interface with higher throughput or redundancy.
Network teaming uses a kernel driver to implement fast handling of packet flows, as well as user-space libraries and services for other tasks. This way, network teaming is an easily extensible and scalable solution for load-balancing and redundancy requirements.
Certain network teaming features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see Is bonding supported with direct connection using crossover cables?
9.2. Comparison of network teaming and bonding features
Learn about the features supported in network teams and network bonds:
Feature | Network bond | Network team |
---|---|---|
Broadcast Tx policy | Yes | Yes |
Round-robin Tx policy | Yes | Yes |
Active-backup Tx policy | Yes | Yes |
LACP (802.3ad) support | Yes (active only) | Yes |
Hash-based Tx policy | Yes | Yes |
User can set hash function | No | Yes |
Tx load-balancing support (TLB) | Yes | Yes |
LACP hash port select | Yes | Yes |
Load-balancing for LACP support | No | Yes |
Ethtool link monitoring | Yes | Yes |
ARP link monitoring | Yes | Yes |
NS/NA (IPv6) link monitoring | No | Yes |
Ports up/down delays | Yes | Yes |
Port priorities and stickiness (“primary” option enhancement) | No | Yes |
Separate per-port link monitoring setup | No | Yes |
Multiple link monitoring setup | Limited | Yes |
Lockless Tx/Rx path | No (rwlock) | Yes (RCU) |
VLAN support | Yes | Yes |
User-space runtime control | Limited | Yes |
Logic in user-space | No | Yes |
Extensibility | Hard | Easy |
Modular design | No | Yes |
Performance overhead | Low | Very low |
D-Bus interface | No | Yes |
Multiple device stacking | Yes | Yes |
Zero config using LLDP | No | (in planning) |
NetworkManager support | Yes | Yes |
9.3. Adding a new team using the web console
Configure a new active backup network team on two or more network interfaces using the web console.
Prerequisites
- Two or more network cards installed on the server.
- The network cards are connected to a switch.
Procedure
Log in to the web console.
For details, see Logging in to the web console
- Go to the Networking tab.
- Click the Add Team button.
In the Team Settings area, configure parameters for the new team:
- Add a name for your team device to the Name field.
- In the Ports field, select all network interfaces you want to add to the team.
- In the Runner drop down menu, select the runner.
In the Link Watch drop down menu select a link watcher.
- If you select Ethtool, additionally, set a link up delay and a link down delay.
- If you select ARP Ping or NSNA Ping, additionally, set a ping interval and ping target.
Click Apply
Verification steps
Go to the Networking tab and check if the Sending and Receiving columns in the Interfaces table display a network activity.
Additional resources
9.4. Adding new interfaces to the team using the web console
Network teams can include multiple interfaces and it is possible to add or remove any of them at any time. The following section describes how to add a new network interface to an existing team.
Prerequisites
- A network team with is configured.
Procedure
Log in to the web console.
For details, see Logging in to the web console.
- Switch to the Networking tab.
- In the Interfaces table, click on the team you want to configure.
- In the team settings window, scroll down to the Ports table.
- Click on the icon.
Select the interface you wish to add from the drop down list.
The RHEL 8 web console adds the interface to the team.
9.5. Removing or disabling an interface from the team using the web console
Network teams can include multiple interfaces. If you need to change a device, you can remove or disable particular interfaces from the network team, which will work together with the rest of active interfaces.
There are two options how to stop using an interface included in a team:
- Removing the interface from the team
- Temporarily disabling the interface. The interface then stays a part of the team, but the team will not use it until you enable it again.
Prerequisites
- A network team with multiple interfaces exists on the host.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Switch to the Networking tab.
- Click the team you want to configure.
- In the team settings window, scroll down to the table of ports (interfaces).
Select an interface and remove or disable it.
- Switch the button to Off to disable the interface.
Click the
icon to remove the interface.
Based on your choice, the web console either removes or disables the interface. If you remove the interface, it will be available in Networking as a standalone interface.
9.6. Removing or disabling a team using the web console
Remove or disable a network team using the web console. If you only disable the team, interfaces in the team will stay in it but the team will not be used for network traffic.
Prerequisites
- A network team is configured on the host.
Procedure
Log in to the web console.
For details, see Logging in to the web console.
- Switch to the Networking tab.
- Click the team you wish to remove or disable.
Remove or disable the selected team.
- You can remove the team by clicking the button.
You can disable the team by moving the
switch to a disabled position.
Verification steps
- If you removed the team, go to Networking, and verify that all the interfaces from your team are now listed as standalone interfaces.
Chapter 10. Configuring network bridges in the web console
Network bridges are used to connect multiple interfaces to the one subnet with the same range of IP addresses.
Prerequisites
The RHEL 8 web console installed and enabled.
For details, see Installing the web console.
10.1. Adding bridges in the web console
Create a software bridge on multiple network interfaces using the web console.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Open Networking.
Click the Add Bridge button.
- In the Bridge Settings dialog box, enter a name for the new bridge.
- In the Port field, select interfaces which you want to put to the one subnet.
Optionally, you can select the Spanning Tree protocol (STP) to avoid bridge loops and broadcast radiation.
If you do not have a strong preference, leave the predefined values as they are.
- Click Create.
If the bridge is successfully created, the web console displays the new bridge in the Networking section. Check values in the Sending and Receiving columns in the new bridge row.
If you can see that zero bytes are sent and received through the bridge, the connection does not work correctly and you need to adjust the network settings.
10.2. Configuring a static IP address in the web console
IP address for your system can be assigned from the pool automatically by the DHCP server or you can configure the IP address manually. The IP address will not be influenced by the DHCP server settings.
Learn how to configure static IPv4 addresses of a network bridge using the RHEL web console.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Open the Networking section.
Click the interface where you want to set the static IP address.
In the interface details screen, click the IPv4 configuration.
In the IPv4 Settings dialog box, select Manual in the Addresses drop down list.
- Click Apply.
In the Addresses field, enter the desired IP address, netmask and gateway.
- Click Apply.
At this point, the IP address has been configured and the interface uses the new static IP address.
10.3. Removing interfaces from the bridge using the web console
Network bridges can include multiple interfaces. You can remove them from the bridge. Each removed interface will be automatically changed to the standalone interface.
Learn how to remove a network interface from a software bridge created in the RHEL 8 system.
Prerequisites
- Having a bridge with multiple interfaces in your system.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Open Networking.
Click the bridge you want to configure.
In the bridge settings screen, scroll down to the table of ports (interfaces).
- Select the interface and click the - icon.
The RHEL 8 web console removes the interface from the bridge and you can see it back in the Networking section as standalone interface.
10.4. Deleting bridges in the web console
You can delete a software network bridge in the RHEL web console. All network interfaces included in the bridge will be changed automatically to standalone interfaces.
Prerequisites
- Having a bridge in your system.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Open the Networking section.
Click the bridge you want to configure.
In the bridge settings screen, scroll down to the table of ports.
- Click Delete.
At this stage, go back to Networking and verify that all the network interfaces are displayed on the Interfaces tab. Interfaces which were part of the bridge can be inactive now. Therefore, you may need to activate them and set network parameters manually.
Chapter 11. Configuring VLANs in the web console
VLANs (Virtual LANs) are virtual networks created on a single physical Ethernet interface. Each VLAN is defined by an ID which represents a unique positive integer and works as a standalone interface.
Learn how to create VLANs in the RHEL web console.
Prerequisites
The RHEL 8 web console installed and enabled.
For details, see Installing the web console.
- Having a network interface in your system.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Open Networking.
Click Add VLAN button.
- In the VLAN Settings dialog box, select the physical interface for which you want to create a VLAN.
- Enter the VLAN Id or just use the predefined number.
In the Name field, you can see a predefined name consisted of the parent interface and VLAN Id. If it is not necessary, leave the name as it is.
- Click Apply.
The new VLAN has been created and you need to click at the VLAN and configure the network settings.
Chapter 12. Configuring the web console listening port
Learn how to allow new ports or change the existing ports using the RHEL web console.
Prerequisites
The RHEL 8 web console installed and enabled.
For details, see Installing the web console.
12.1. Allowing a new port on a system with active SELinux
Enable the web console to listen on a selected port.
Prerequisites
- The web console must be installed and accessible. For details, see Installing the web console.
Procedure
For ports that are not defined by any other part of SELinux, run:
$ sudo semanage port -a -t websm_port_t -p tcp PORT_NUMBER
For ports that already are defined by other part of SELinux, run:
$ sudo semanage port -m -t websm_port_t -p tcp PORT_NUMBER
The changes should take effect immediately.
12.2. Allowing a new port on a system with firewalld
Enable the web console to receive connections on a new port.
Prerequisites
- The web console must be installed and accessible. For details, see Installing the web console.
-
The
firewalld
service must be running.
Procedure
To add a new port number, run the following command:
$ sudo firewall-cmd --permanent --service cockpit --add-port=PORT_NUMBER/tcp
To remove the old port number from the
cockpit
service, run:$ sudo firewall-cmd --permanent --service cockpit --remove-port=OLD_PORT_NUMBER/tcp
If you only run the firewall-cmd --service cockpit --add-port=PORT_NUMBER/tcp
without the --permanent
option, your change will be canceled with the next reload of firewalld
or a system reboot.
12.3. Changing the web console port
Change default transmission control protocol (TCP) on port 9090 to a different one.
Prerequisites
- The web console must be installed and accessible. For details, see Installing the web console.
- If you have SELinux protecting your system, you need to set it to allow Cockpit to listen on a new port. For more information, see Allowing a new port on a system with active SELinux.
-
If you have
firewalld
configured as your firewall, you need to set it to allow Cockpit receive connections on a new port, for more information, see Allowing a new port on a system withfirewalld
.
Procedure
Change the listening port with one of the following methods:
Using the
systemctl edit cockpit.socket
command:Run the following command:
$ sudo systemctl edit cockpit.socket
This will open the
/etc/systemd/system/cockpit.socket.d/override.conf
file.Modify the content of
override.conf
or add a new content in the following format:[Socket] ListenStream= ListenStream=PORT_NUMBER
Alternatively, add the above mentioned content to the
/etc/systemd/system/cockpit.socket.d/listen.conf
file.Create the
cockpit.socket.d.
directory and thelisten.conf
file if they do not exist yet.
Run the following commands for changes to take effect:
$ sudo systemctl daemon-reload $ sudo systemctl restart cockpit.socket
If you used
systemctl edit cockpit.socket
in the previous step, runningsystemctl daemon-reload
is not necessary.
Verification steps
- To verify that the change was successful, try to connect to the web console with the new port.
Chapter 13. Managing firewall using the web console
A firewall is a way to protect machines from any unwanted traffic from outside. It enables users to control incoming network traffic on host machines by defining a set of firewall rules. These rules are used to sort the incoming traffic and either block it or allow through.
Prerequisites
The RHEL 8 web console configures the firewalld service.
For details about the firewalld service, see Getting started with firewalld.
13.1. Running firewall using the web console
This section describes where and how to run the RHEL 8 system firewall in the web console.
The RHEL 8 web console configures the firewalld service.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Open the Networking section.
In the Firewall section, click ON to run the firewall.
If you do not see the Firewall box, log in to the web console with the administration privileges.
At this stage, your firewall is running.
To configure firewall rules, see Section 13.7, “Enabling services on the firewall using the web console”.
13.2. Stopping firewall using the web console
This section describes where and how to stop the RHEL 8 system firewall in the web console.
The RHEL 8 web console configures the firewalld service.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Open the Networking section.
In the Firewall section, click OFF to stop it.
If you do not see the Firewall box, log in to the web console with the administration privileges.
At this stage, the firewall has been stopped and does not secure your system.
13.3. firewalld
firewalld
is a firewall service daemon that provides a dynamic customizable host-based firewall with a D-Bus
interface. Being dynamic, it enables creating, changing, and deleting the rules without the necessity to restart the firewall daemon each time the rules are changed.
firewalld
uses the concepts of zones and services, that simplify the traffic management. Zones are predefined sets of rules. Network interfaces and sources can be assigned to a zone. The traffic allowed depends on the network your computer is connected to and the security level this network is assigned. Firewall services are predefined rules that cover all necessary settings to allow incoming traffic for a specific service and they apply within a zone.
Services use one or more ports or addresses for network communication. Firewalls filter communication based on ports. To allow network traffic for a service, its ports must be open. firewalld
blocks all traffic on ports that are not explicitly set as open. Some zones, such as trusted, allow all traffic by default.
Additional resources
-
firewalld(1)
man page
13.4. Zones
firewalld
can be used to separate networks into different zones according to the level of trust that the user has decided to place on the interfaces and traffic within that network. A connection can only be part of one zone, but a zone can be used for many network connections.
NetworkManager
notifies firewalld
of the zone of an interface. You can assign zones to interfaces with:
-
NetworkManager
-
firewall-config
tool -
firewall-cmd
command-line tool - The RHEL web console
The latter three can only edit the appropriate NetworkManager
configuration files. If you change the zone of the interface using the web console, firewall-cmd
or firewall-config
, the request is forwarded to NetworkManager
and is not handled by firewalld
.
The predefined zones are stored in the /usr/lib/firewalld/zones/
directory and can be instantly applied to any available network interface. These files are copied to the /etc/firewalld/zones/
directory only after they are modified. The default settings of the predefined zones are as follows:
block
-
Any incoming network connections are rejected with an icmp-host-prohibited message for
IPv4
and icmp6-adm-prohibited forIPv6
. Only network connections initiated from within the system are possible. dmz
- For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
drop
- Any incoming network packets are dropped without any notification. Only outgoing network connections are possible.
external
- For use on external networks with masquerading enabled, especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
home
- For use at home when you mostly trust the other computers on the network. Only selected incoming connections are accepted.
internal
- For use on internal networks when you mostly trust the other computers on the network. Only selected incoming connections are accepted.
public
- For use in public areas where you do not trust other computers on the network. Only selected incoming connections are accepted.
trusted
- All network connections are accepted.
work
- For use at work where you mostly trust the other computers on the network. Only selected incoming connections are accepted.
One of these zones is set as the default zone. When interface connections are added to NetworkManager
, they are assigned to the default zone. On installation, the default zone in firewalld
is set to be the public
zone. The default zone can be changed.
The network zone names should be self-explanatory and to allow users to quickly make a reasonable decision. To avoid any security problems, review the default zone configuration and disable any unnecessary services according to your needs and risk assessments.
Additional resources
-
firewalld.zone(5)
man page
13.5. Zones in the web console
Firewall zones are new in the RHEL 8.1.0 Beta.
The Red Hat Enterprise Linux web console implements major features of the firewalld service and enables you to:
- Add predefined firewall zones to a particular interface or range of IP addresses
- Configure zones with selecting services into the list of enabled services
- Disable a service by removing this service from the list of enabled service
- Remove a zone from an interface
13.6. Enabling zones using the web console
The web console enables you to apply predefined and existing firewall zones on a particular interface or a range of IP addresses. This section describes how to enable a zone on an interface.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
The firewall must be enabled.
For details, see Section 13.1, “Running firewall using the web console”.
Procedure
Log in to the RHEL web console with administration privileges.
For details, see Logging in to the web console.
- Click Networking.
Click on the Firewall box title.
If you do not see the Firewall box, log in to the web console with the administrator privileges.
- In the Firewall section, click Add Services.
- Click on the Add Zone button.
In the Add Zone dialog box, select a zone from the Trust level scale.
You can see here all zones predefined in the
firewalld
service.- In the Interfaces part, select an interface or interfaces on which the selected zone is applied.
In the Allowed Addresses part, you can select whether the zone is applied on:
- the whole subnet
or a range of IP addresses in the following format:
- 192.168.1.0
- 192.168.1.0/24
- 192.168.1.0/24, 192.168.1.0
Click on the Add zone button.
Verify the configuration in Active zones.
13.7. Enabling services on the firewall using the web console
By default, services are added to the default firewall zone. If you use more firewall zones on more network interfaces, you must select a zone first and then add the service with port.
The RHEL 8 web console displays predefined firewalld
services and you can add them to active firewall zones.
The RHEL 8 web console configures the firewalld service.
The web console does not allow generic firewalld
rules which are not listed in the web console.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
The firewall must be enabled.
For details, see Section 13.1, “Running firewall using the web console”.
Procedure
Log in to the RHEL web console with administrator privileges.
For details, see Logging in to the web console.
- Click Networking.
Click on the Firewall box title.
If you do not see the Firewall box, log in to the web console with the administrator privileges.
In the Firewall section, click Add Services.
In the Add Services dialog box, select a zone for which you want to add the service.
The Add Services dialog box includes a list of active firewall zones only if the system includes multiple active zones.
If the system uses just one (the default) zone, the dialog does not include zone settings.
- In the Add Services dialog box, find the service you want to enable on the firewall.
Enable desired services.
- Click Add Services.
At this point, the RHEL 8 web console displays the service in the list of Allowed Services.
13.8. Configuring custom ports using the web console
The web console allows you to add:
- Services listening on standard ports: Section 13.7, “Enabling services on the firewall using the web console”
- Services listening on custom ports.
This section describes how to add services with custom ports configured.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
The firewall must be enabled.
For details, see Section 13.1, “Running firewall using the web console”.
Procedure
Log in to the RHEL web console with administrator privileges.
For details, see Logging in to the web console.
- Click Networking.
Click on the Firewall box title.
If you do not see the Firewall box, log in to the web console with the administration privileges.
In the Firewall section, click Add Services.
In the Add Services dialog box, select a zone for which you want to add the service.
The Add Services dialog box includes a list of active firewall zones only if the system includes multiple active zones.
If the system uses just one (the default) zone, the dialog does not include zone settings.
- In the Add Ports dialog box, click on the Custom Ports radio button.
In the TCP and UDP fields, add ports according to examples. You can add ports in the following formats:
- Port numbers such as 22
- Range of port numbers such as 5900-5910
- Aliases such as nfs, rsync
NoteYou can add multiple values into each field. Values must be separated with the comma and without the space, for example: 8080,8081,http
After adding the port number in the TCP and/or UDP fields, verify the service name in the Name field.
The Name field displays the name of the service for which is this port reserved. You can rewrite the name if you are sure that this port is free to use and no server needs to communicate on this port.
- In the Name field, add a name for the service including defined ports.
Click on the Add Ports button.
To verify the settings, go to the Firewall page and find the service in the list of Allowed Services.
13.9. Disabling zones using the web console
This section describes how to disable a firewall zone in your firewall configuration using the web console.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
Procedure
Log in to the RHEL web console with administrator privileges.
For details, see Logging in to the web console.
- Click Networking.
Click on the Firewall box title.
If you do not see the Firewall box, log in to the web console with the administrator privileges.
On the Active zones table, click on the Delete icon at the zone you want to remove.
The zone is now disabled and the interface does not include opened services and ports which were configured in the zone.
Chapter 14. Applying a generated Ansible playbook
When troubleshooting issues with SELinux, the web console is able to generate a shell script or an Ansible playbook that you can then export and apply for more machines.
Prerequisites
The web console interface needs to be installed and accessible.
For details, see Installing the web console.
Procedure
- Click SELinux.
Click "View the automation script" on the upper right side.
A window with the generated script opens. You can navigate between a shell script and an Ansible playbook generation options tab.
- Click the button to select the script or playbook and apply it.
As a result, you have an automation script that you can apply to more machines.
Additional resources
- Troubleshootng problems related to SELinux
- Deploying the same SELinux configuration on multiple systems
-
For details about the
ansible-playbook
command, see theansible-playbook(1)
man page.
Chapter 15. Managing partitions using the web console
Learn how to manage file systems on RHEL 8 using the web console.
For details about the available file systems, see the Overview of available file systems.
15.1. Displaying partitions formatted with file systems in the web console
The Storage section in the web console displays all available file systems in the Filesystems table.
This section navigates you to get to the list of partitions formatted with file systems displayed in the web console.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. The web console must be installed and accessible.
For details, see Installing the web console.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Click on the Storage tab.
In the Filesystems table, you can see all available partitions formatted with file systems, its name, size and how much space is available on each partition.
15.2. Creating partitions in the web console
To create a new partition:
- Use an existing partition table
- Create a partition
Prerequisites
-
The
cockpit-storaged
package is installed on your system. The web console must be installed and accessible.
For details, see Installing the web console.
- An unformatted volume connected to the system visible in the Other Devices table of the Storage tab.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Click the Storage tab.
- In the Other Devices table, click a volume in which you want to create the partition.
- In the Content section, click the Create Partition button.
- In the Create partition dialog box, select the size of the new partition.
In the Erase drop down menu, select:
- Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
- Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk, but it is more secure. Use this option if the disk includes any data and you need to overwrite it.
In the Type drop down menu, select a file system:
- XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.
ext4 file system supports:
- Logical volumes
- Switching physical drives online without outage
- Growing a file system
- Shrinking a file system
Additional option is to enable encryption of partition done by LUKS (Linux Unified Key Setup), which allows you to encrypt the volume with a passphrase.
- In the Name field, enter the logical volume name.
In the Mounting drop down menu, select Custom.
The Default option does not ensure that the file system will be mounted on the next boot.
- In the Mount Point field, add the mount path.
- Select Mount at boot.
Click the Create partition button.
Formatting can take several minutes depending on the volume size and which formatting options are selected.
After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.
To verify that the partition has been successfully added, switch to the Storage tab and check the Filesystems table.
15.3. Deleting partitions in the web console
This paragraph is the procedure module introduction: a short description of the procedure.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. The web console must be installed and accessible.
For details, see Installing the web console.
Unmount the partition’s file system.
For details about mounting and unmounting partitions, see Section 15.4, “Mounting and unmounting file systems in the web console”.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Click on the Storage tab.
- In the Filesystems table, select a volume in which you want to delete the partition.
In the Content section, click on the partition you want to delete.
The partition rolls down and you can click on the Delete button.
The partition must not be mounted and used.
To verify that the partition has been successfully removed, switch to the Storage tab and check the Content table.
15.4. Mounting and unmounting file systems in the web console
To be able to use partitions on RHEL systems, you need to mount a filesystem on the partition as a device.
You also can unmount a file system and the RHEL system will stop using it. Unmounting the file system enables you to delete, remove, or re-format devices.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. The web console must be installed and accessible.
For details, see Installing the web console.
- If you want to unmount a file system, ensure that the system does not use any file, service, or application stored in the partition.
Procedure
Log in to the RHEL web console.
For details, see Logging in to the web console.
- Click on the Storage tab.
- In the Filesystems table, select a volume in which you want to delete the partition.
- In the Content section, click on the partition whose file system you want to mount or unmount.
Click on the Mount or Unmount button.
At this point, the file system has been mounted or unmounted according to your action.
Chapter 16. Managing NFS mounts in the web console
The RHEL 8 web console enables you to mount remote directories using the Network File System (NFS) protocol.
NFS makes it possible to reach and mount remote directories located on the network and work with the files as if the directory was located on your physical drive.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. - NFS server name or IP address.
- Path to the directory on the remote server.
16.1. Connecting NFS mounts in the web console
Connect a remote directory to your file system using NFS.
Prerequisites
- NFS server name or IP address.
- Path to the directory on the remote server.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Storage.
Click + in the NFS mounts section.
- In the New NFS Mount dialog box, enter the server or IP address of the remote server.
- In the Path on Server field, enter the path to the directory you want to mount.
- In the Local Mount Point field, enter the path where you want to find the directory in your local system.
- Select Mount at boot. This ensures that the directory will be reachable also after the restart of the local system.
Optionally, select Mount read only if you do not want to change the content.
- Click Add.
At this point, you can open the mounted directory and verify that the content is accessible.
To troubleshoot the connection, you can adjust it with the Custom Mount Options.
16.2. Customizing NFS mount options in the web console
Edit an existing NFS mount and add custom mount options.
Custom mount options can help you to troubleshoot the connection or change parameters of the NFS mount such as changing timeout limits or configuring authentication.
Prerequisites
- NFS mount added.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Storage.
- Click on the NFS mount you want to adjust.
If the remote directory is mounted, click Unmount.
The directory must not be mounted during the custom mount options configuration. Otherwise the web console does not save the configuration and this will cause an error.
Click Edit.
- In the NFS Mount dialog box, select Custom mount option.
Enter mount options separated by a comma. For example:
-
nfsvers=4
— the NFS protocol version number -
soft
— type of recovery after an NFS request times out -
sec=krb5
— files on the NFS server can be secured by Kerberos authentication. Both the NFS client and server have to support Kerberos authentication.
For a complete list of the NFS mount options, enter
man nfs
in the command line.-
- Click Apply.
- Click Mount.
Now you can open the mounted directory and verify that the content is accessible.
Chapter 17. Managing Redundant Arrays of Independent Disks in the web console
Redundant Arrays of Independent Disks (RAID) represents a way how to arrange more disks into one storage. RAID protects data stored in the disks against disk failure.
RAID uses the following data distribution strategies:
- Mirroring — data are copied to two different locations. If one disk fails, you have a copy and your data is not lost.
- Striping — data are evenly distributed among disks.
Level of protection depends on the RAID level.
The RHEL web console supports the following RAID levels:
- RAID 0 (Stripe)
- RAID 1 (Mirror)
- RAID 4 (Dedicated parity)
- RAID 5 (Distributed parity)
- RAID 6 (Double Distributed Parity)
- RAID 10 (Stripe of Mirrors)
Before you can use disks in RAID, you need to:
- Create a RAID.
- Format it with file system.
- Mount the RAID to the server.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. The RHEL 8 web console is running and accessible.
For details, see Installing the web console.
17.1. Creating RAID in the web console
Configure RAID in the RHEL 8 web console.
Prerequisites
- Physical disks connected to the system. Each RAID level requires different amount of disks.
Procedure
- Open the RHEL 8 web console.
- Click Storage.
Click the + icon in the RAID Devices box.
- In the Create RAID Device dialog box, enter a name for a new RAID.
- In the RAID Level drop-down list, select a level of RAID you want to use.
In the Chunk Size drop-down list, leave the predefined value as it is.
The Chunk Size value specifies how large is each block for data writing. If the chunk size is 512 KiB, the system writes the first 512 KiB to the first disk, the second 512 KiB is written to the second disk, and the third chunk will be written to the third disk. If you have three disks in your RAID, the fourth 512 KiB will be written to the first disk again.
Select disks you want to use for RAID.
- Click Create.
In the Storage section, you can see the new RAID in the RAID devices box and format it.
Now you have the following options how to format and mount the new RAID in the web console:
17.2. Formatting RAID in the web console
Format the new software RAID device created in the RHEL 8 web interface.
Prerequisites
- Physical disks are connected and visible by RHEL 8.
- RAID is created.
- Consider the file system which will be used for the RAID.
- Consider creating of a partitioning table.
Procedure
- Open the RHEL 8 web console.
- Click Storage.
- In the RAID devices box, choose the RAID you want to format by clicking on it.
- In the RAID details screen, scroll down to the Content part.
Click to the newly created RAID.
- Click the Format button.
In the Erase drop-down list, select:
- Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
- Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk. Use this option if the RAID includes any data and you need to rewrite it.
- In the Type drop-down list, select a XFS file system, if you do not have another strong preference.
- Enter a name of the file system.
In the Mounting drop down list, select Custom.
The Default option does not ensure that the file system will be mounted on the next boot.
- In the Mount Point field, add the mount path.
-
Select Mount at boot.
Click the Format button.
Formatting can take several minutes depending on the used formatting options and size of RAID.
After successful finish, you can see the details of the formatted RAID on the Filesystem tab.
- To use the RAID, click Mount.
At this point, the system uses mounted and formatted RAID.
17.3. Using the web console for creating a partition table on RAID
Format RAID with the partition table on the new software RAID device created in the RHEL 8 web interface.
RAID requires formatting as any other storage device. You have two options:
- Format the RAID device without partitions
- Create a partition table with partitions
Prerequisites
- Physical disks are connected and visible by RHEL 8.
- RAID is created.
- Consider the file system used for the RAID.
- Consider creating a partitioning table.
Procedure
- Open the RHEL 8 web console.
- Click Storage.
- In the RAID devices box, select the RAID you want to edit.
- In the RAID details screen, scroll down to the Content part.
Click to the newly created RAID.
- Click the Create partition table button.
In the Erase drop-down list, select:
- Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
- Overwrite existing data with zeros — the RHEL web console rewrites the whole RAID with zeros. This option is slower because the program has to go through the whole RAID. Use this option if RAID includes any data and you need to rewrite it.
In the Partitioning drop-down list, select:
- Compatible with modern system and hard disks > 2TB (GPT) — GUID Partition Table is a modern recommended partitioning system for large RAIDs with more than four partitions.
Compatible with all systems and devices (MBR) — Master Boot Record works with disks up to 2 TB in size. MBR also support four primary partitions max.
- Click Format.
At this point, the partitioning table has been created and you can create partitions.
For creating partitions, see Using the web console for creating partitions on RAID.
17.4. Using the web console for creating partitions on RAID
Create a partition in the existing partition table.
Prerequisites
Partition table is created.
For details, see Section 17.3, “Using the web console for creating a partition table on RAID”
Procedure
- Open the RHEL 8 web console.
- Click Storage.
- In the RAID devices box, click to the RAID you want to edit.
- In the RAID details screen, scroll down to the Content part.
- Click to the newly created RAID.
- Click Create Partition.
- In the Create partition dialog box, set up the size of the first partition.
In the Erase drop-down list, select:
- Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
- Overwrite existing data with zeros — the RHEL web console rewrites the whole RAID with zeros. This option is slower because the program have to go through the whole RAID. Use this option if RAID includes any data and you need to rewrite it.
- In the Type drop-down list, select a XFS file system, if you do not have another strong preference.
- Enter any name for the file system. Do not use spaces in the name.
In the Mounting drop down list, select Custom.
The Default option does not ensure that the file system will be mounted on the next boot.
- In the Mount Point field, add the mount path.
- Select Mount at boot.
Click Create partition.
Formatting can take several minutes depending on used formatting options and size of RAID.
After successful finish, you can continue with creating other partitions.
At this point, the system uses mounted and formatted RAID.
17.5. Using the web console for creating a volume group on top of RAID
Build a volume group from software RAID.
Prerequisites
- RAID device, which is not formatted and mounted.
Procedure
- Open the RHEL 8 web console.
- Click Storage.
- Click the + icon in the Volume Groups box.
- In the Create Volume Group dialog box, enter a name for the new volume group.
In the Disks list, select a RAID device.
If you do not see the RAID in the list, unmount the RAID from the system. The RAID device must not be used by the RHEL 8 system.
- Click Create.
The new volume group has been created and you can continue with creating a logical volume.
Additional resources
- To learn more about soft corruption and how you can protect your data when configuring a RAID LV, see Using DM integrity with RAID LV.
Chapter 18. Using the web console for configuring LVM logical volumes
Red Hat Enterprise Linux 8 supports the LVM logical volume manager. When you install a Red Hat Enterprise Linux 8, it will be installed on LVM automatically created during the installation.
The screenshot shows you a clean installation of the RHEL 8 system with two logical volumes in the RHEL 8 web console automatically created during the installation.
To find out more about logical volumes, follow the sections describing:
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. - Physical drives, RAID devices, or any other type of block device from which you can create the logical volume.
18.1. Logical Volume Manager in the web console
The RHEL 8 web console provides a graphical interface to create LVM volume groups and logical volumes.
Volume groups create a layer between physical and logical volumes. It makes you possible to add or remove physical volumes without influencing logical volume itself. Volume groups appear as one drive with capacity consisting of capacities of all physical drives included in the group.
You can join physical drives into volume groups in the web console.
Logical volumes act as a single physical drive and it is built on top of a volume group in your system.
Main advantages of logical volumes are:
- Better flexibility than the partitioning system used on your physical drive.
- Ability to connect more physical drives into one volume.
- Possibility of expanding (growing) or reducing (shrinking) capacity of the volume on-line, without restart.
- Ability to create snapshots.
Additional resources
- For details, see Configuring and managing logical volumes.
18.2. Creating volume groups in the web console
Create volume groups from one or more physical drives or other storage devices.
Logical volumes are created from volume groups. Each volume group can include multiple logical volumes.
For details, see Volume groups.
Prerequisites
- Physical drives or other types of storage devices from which you want to create volume groups.
Procedure
- Log in to the RHEL 8 web console.
- Click Storage.
Click the + icon in the Volume Groups box.
- In the Name field, enter a name of a group without spaces.
Select the drives you want to combine to create the volume group.
It might happen that you cannot see devices as you expected. The RHEL web console displays only unused block devices. Used devices means, for example:
- Devices formatted with a file system
- Physical volumes in another volume group
Physical volumes being a member of another software RAID device
If you do not see the device, format it to be empty and unused.
- Click Create.
The web console adds the volume group in the Volume Groups section. After clicking the group, you can create logical volumes that are allocated from that volume group.
18.3. Creating logical volumes in the web console
Create LVM logical volumes.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. - Volume group created. For details, see Creating volume groups in the web console.
Procedure
- Log in to the RHEL 8 web console.
- Click Storage.
- Click the volume group in which you want to create logical volumes.
- Click Create new Logical Volume.
- In the Name field, enter a name for the new logical volume without spaces.
In the Purpose drop down menu, select Block device for filesystems.
This configuration enables you to create a logical volume with the maximum volume size which is equal to the sum of the capacities of all drives included in the volume group.
Define the size of the logical volume. Consider:
- How much space the system using this logical volume will need.
- How many logical volumes you want to create.
You do not have to use the whole space. If necessary, you can grow the logical volume later.
- Click Create.
To verify the settings, click your logical volume and check the details.
At this stage, the logical volume has been created and you need to create and mount a file system with the formatting process.
18.4. Formatting logical volumes in the web console
Logical volumes act as physical drives. To use them, you need to format them with a file system.
Formatting logical volumes will erase all data on the volume.
The file system you select determines the configuration parameters you can use for logical volumes. For example, some the XFS file system does not support shrinking volumes. For details, see Resizing logical volumes in the web console.
The following steps describe the procedure to format logical volumes.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. - Logical volume created. For details, see Creating volume groups in the web console.
Procedure
- Log in to the RHEL web console.
- Click Storage.
- Click the volume group in which the logical volume is placed.
- Click the logical volume.
Click on the Unrecognized Data tab.
- Click Format.
In the Erase drop down menu, select:
- Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
- Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program have to go through the whole disk. Use this option if the disk includes any data and you need to overwrite it.
In the Type drop down menu, select a file system:
XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.
XFS does not support reducing the size of a volume formatted with an XFS file system
ext4 file system supports:
- Logical volumes
- Switching physical drives online without outage
- Growing a file system
- Shrinking a file system
You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.
- In the Name field, enter the logical volume name.
In the Mounting drop down menu, select Custom.
The Default option does not ensure that the file system will be mounted on the next boot.
- In the Mount Point field, add the mount path.
Select Mount at boot.
Click Format.
Formatting can take several minutes depending on the volume size and which formatting options are selected.
After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.
- To use the logical volume, click Mount.
At this point, the system can use mounted and formatted logical volume.
18.5. Resizing logical volumes in the web console
Learn how to extend or reduce logical volumes in the RHEL 8 web console.
Whether you can resize a logical volume depends on which file system you are using. Most file systems enable you to extend (grow) the volume online (without outage).
You can also reduce (shrink) the size of logical volumes, if the logical volume contains a file system which supports shrinking. It should be available, for example, in the ext3/ext4 file systems.
You cannot reduce volumes that contains GFS2 or XFS filesystem.
Prerequisites
- Existing logical volume containing a file system which supports resizing logical volumes.
Procedure
The following steps provide the procedure for growing a logical volume without taking the volume offline:
- Log in to the RHEL web console.
- Click Storage.
- Click the volume group in which the logical volume is placed.
- Click the logical volume.
- On the Volume tab, click Grow.
In the Grow Logical Volume dialog box, adjust volume space.
- Click Grow.
LVM grows the logical volume without system outage.
Chapter 19. Using the web console for configuring thin logical volumes
Thinly-provisioned logical volumes enable you to allocate more space for designated applications or servers than how much space logical volumes actually contain.
For details, see Thinly-provisioned logical volumes (thin volumes).
The following sections describe:
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. - Physical drives or other types of storage devices from which you want to create volume groups.
19.1. Creating pools for thin logical volumes in the web console
Create a pool for thinly provisioned volumes.
Prerequisites
Procedure
- Log in to the RHEL 8 web console.
- Click Storage.
- Click the volume group in which you want to create thin volumes.
- Click Create new Logical Volume.
- In the Name field, enter a name for the new pool of thin volumes without spaces.
In the Purpose drop down menu, select Pool for thinly provisioned volumes. This configuration enables you to create the thin volume.
Define the size of the pool of thin volumes. Consider:
- How many thin volumes you will need in this pool?
- What is the expected size of each thin volume?
You do not have to use the whole space. If necessary, you can grow the pool later.
Click Create.
The pool for thin volumes has been created and you can add thin volumes.
19.2. Creating thin logical volumes in the web console
Create a thin logical volume in the pool. The pool can include multiple thin volumes and each thin volume can be as large as the pool for thin volumes itself.
Using thin volumes requires regular checkup of actual free physical space of the logical volume.
Prerequisites
Pool for thin volumes created.
For details, see Section 19.1, “Creating pools for thin logical volumes in the web console”.
Procedure
- Log in to the RHEL 8 web console.
- Click Storage.
- Click the volume group in which you want to create thin volumes.
- Click the desired pool.
Click Create Thin Volume.
- In the Create Thin Volume dialog box, enter a name for the thin volume without spaces.
Define the size of the thin volume.
- Click Create.
At this stage, the thin logical volume has been created and you need to format it.
19.3. Formatting logical volumes in the web console
Logical volumes act as physical drives. To use them, you need to format them with a file system.
Formatting logical volumes will erase all data on the volume.
The file system you select determines the configuration parameters you can use for logical volumes. For example, some the XFS file system does not support shrinking volumes. For details, see Resizing logical volumes in the web console.
The following steps describe the procedure to format logical volumes.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. - Logical volume created. For details, see Creating volume groups in the web console.
Procedure
- Log in to the RHEL web console.
- Click Storage.
- Click the volume group in which the logical volume is placed.
- Click the logical volume.
Click on the Unrecognized Data tab.
- Click Format.
In the Erase drop down menu, select:
- Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
- Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program have to go through the whole disk. Use this option if the disk includes any data and you need to overwrite it.
In the Type drop down menu, select a file system:
XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.
XFS does not support reducing the size of a volume formatted with an XFS file system
ext4 file system supports:
- Logical volumes
- Switching physical drives online without outage
- Growing a file system
- Shrinking a file system
You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.
- In the Name field, enter the logical volume name.
In the Mounting drop down menu, select Custom.
The Default option does not ensure that the file system will be mounted on the next boot.
- In the Mount Point field, add the mount path.
Select Mount at boot.
Click Format.
Formatting can take several minutes depending on the volume size and which formatting options are selected.
After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.
- To use the logical volume, click Mount.
At this point, the system can use mounted and formatted logical volume.
Chapter 20. Using the web console for changing physical drives in volume groups
Change the drive in a volume group using the RHEL 8 web console.
The change of physical drives consists of the following procedures:
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. - A new physical drive for replacing the old or broken one.
- The configuration expects that physical drives are organized in a volume group.
20.1. Adding physical drives to volume groups in the web console
The RHEL 8 web console enables you to add a new physical drive or other type of volume to the existing logical volume.
Prerequisites
- A volume group must be created.
- A new drive connected to the machine.
Procedure
- Log in to the RHEL 8 web console.
- Click Storage.
- In the Volume Groups box, click the volume group in which you want to add a physical volume.
In the Physical Volumes box, click the + icon.
In the Add Disks dialog box, select the preferred drive and click Add.
As a result, the RHEL 8 web console adds the physical volume. You can see it in the Physical Volumes section, and the logical volume can immediately start to write on the drive.
20.2. Removing physical drives from volume groups in the web console
If a logical volume includes multiple physical drives, you can remove one of the physical drives online.
The system moves automatically all data from the drive to be removed to other drives during the removal process. Notice that it can take some time.
The web console also verifies, if there is enough space for removing the physical drive.
Prerequisites
- A volume group with more than one physical drive connected.
Procedure
The following steps describe how to remove a drive from the volume group without causing outage in the RHEL web console.
- Log in to the RHEL 8 web console.
- Click Storage.
- Click the volume group in which you have the logical volume.
- In the Physical Volumes section, locate the preferred volume.
Click the - icon.
The RHEL 8 web console verifies, if the logical volume has enough free space for removing the disk. If not, you cannot remove the disk and it is necessary to add another disk first. For details, see Adding physical drives to logical volumes in the web console.
As results, the RHEL 8 web console removes the physical volume from the created logical volume without causing an outage.
Chapter 21. Using the web console for managing Virtual Data Optimizer volumes
Configure the Virtual Data Optimizer (VDO) using the RHEL 8 web console.
You will learn how to:
- Create VDO volumes
- Format VDO volumes
- Extend VDO volumes
Prerequisites
The RHEL 8 web console is installed and accessible.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system.
21.1. VDO volumes in the web console
Red Hat Enterprise Linux 8 supports Virtual Data Optimizer (VDO).
VDO is a block virtualization technology that combines:
- Compression
- For details, see Enabling or disabling compression in VDO.
- Deduplication
- For details, see Enabling or disabling deduplication in VDO.
- Thin provisioning
- For details, see Thinly-provisioned logical volumes (thin volumes).
Using these technologies, VDO:
- Saves storage space inline
- Compresses files
- Eliminates duplications
- Enables you to allocate more virtual space than how much the physical or logical storage provides
- Enables you to extend the virtual storage by growing
VDO can be created on top of many types of storage. In the RHEL 8 web console, you can configure VDO on top of:
LVM
NoteIt is not possible to configure VDO on top of thinly-provisioned volumes.
- Physical volume
- Software RAID
For details about placement of VDO in the Storage Stack, see System Requirements.
Additional resources
- For details about VDO, see Deduplicating and compressing storage.
21.2. Creating VDO volumes in the web console
Create a VDO volume in the RHEL web console.
Prerequisites
- Physical drives, LVMs, or RAID from which you want to create VDO.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Storage.
Click the + icon in the VDO Devices box.
- In the Name field, enter a name of a VDO volume without spaces.
- Select the drive that you want to use.
In the Logical Size bar, set up the size of the VDO volume. You can extend it more than ten times, but consider for what purpose you are creating the VDO volume:
- For active VMs or container storage, use logical size that is ten times the physical size of the volume.
- For object storage, use logical size that is three times the physical size of the volume.
For details, see Deploying VDO.
In the Index Memory bar, allocate memory for the VDO volume.
For details about VDO system requirements, see System Requirements.
Select the Compression option. This option can efficiently reduce various file formats.
For details, see Enabling or disabling compression in VDO.
Select the Deduplication option.
This option reduces the consumption of storage resources by eliminating multiple copies of duplicate blocks. For details, see Enabling or disabling deduplication in VDO.
- [Optional] If you want to use the VDO volume with applications that need a 512 bytes block size, select Use 512 Byte emulation. This reduces the performance of the VDO volume, but should be very rarely needed. If in doubt, leave it off.
Click Create.
If the process of creating the VDO volume succeeds, you can see the new VDO volume in the Storage section and format it with a file system.
21.3. Formatting VDO volumes in the web console
VDO volumes act as physical drives. To use them, you need to format them with a file system.
Formatting VDO will erase all data on the volume.
The following steps describe the procedure to format VDO volumes.
Prerequisites
- A VDO volume is created. For details, see Section 21.2, “Creating VDO volumes in the web console”.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Storage.
- Click the VDO volume.
- Click on the Unrecognized Data tab.
Click Format.
In the Erase drop down menu, select:
- Don’t overwrite existing data
- The RHEL web console rewrites only the disk header. The advantage of this option is the speed of formatting.
- Overwrite existing data with zeros
- The RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk. Use this option if the disk includes any data and you need to rewrite them.
In the Type drop down menu, select a filesystem:
The XFS file system supports large logical volumes, switching physical drives online without outage, and growing. Leave this file system selected if you do not have a different strong preference.
XFS does not support shrinking volumes. Therefore, you will not be able to reduce volume formatted with XFS.
- The ext4 file system supports logical volumes, switching physical drives online without outage, growing, and shrinking.
You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.
- In the Name field, enter the logical volume name.
In the Mounting drop down menu, select Custom.
The Default option does not ensure that the file system will be mounted on the next boot.
- In the Mount Point field, add the mount path.
Select Mount at boot.
Click Format.
Formatting can take several minutes depending on the used formatting options and the volume size.
After a successful finish, you can see the details of the formatted VDO volume on the Filesystem tab.
- To use the VDO volume, click Mount.
At this point, the system uses the mounted and formatted VDO volume.
21.4. Extending VDO volumes in the web console
Extend VDO volumes in the RHEL 8 web console.
Prerequisites
-
The
cockpit-storaged
package is installed on your system. - The VDO volume created.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Storage.
Click your VDO volume in the VDO Devices box.
- In the VDO volume details, click the Grow button.
In the Grow logical size of VDO dialog box, extend the logical size of the VDO volume.
Original size of the logical volume from the screenshot was 6 GB. As you can see, the RHEL web console enables you to grow the volume to more than ten times the size and it works correctly because of the compression and deduplication.
- Click Grow.
If the process of growing VDO succeeds, you can see the new size in the VDO volume details.
Chapter 22. Locking data with LUKS password in the RHEL web console
In the web console’s Storage tab, you can now create, lock, unlock, resize, and otherwise configure encrypted devices using the LUKS (Linux Unified Key Setup) version 2 format.
This new version of LUKS offers:
- More flexible unlocking policies
- Stronger cryptography
- Better compatibility with future changes
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system.
22.1. LUKS disk encryption
The Linux Unified Key Setup-on-disk-format (LUKS) enables you to encrypt block devices and it provides a set of tools that simplifies managing the encrypted devices. LUKS allows multiple user keys to decrypt a master key, which is used for the bulk encryption of the partition.
RHEL utilizes LUKS to perform block device encryption. By default, the option to encrypt the block device is unchecked during the installation. If you select the option to encrypt your disk, the system prompts you for a passphrase every time you boot the computer. This passphrase “unlocks” the bulk encryption key that decrypts your partition. If you choose to modify the default partition table, you can choose which partitions you want to encrypt. This is set in the partition table settings.
What LUKS does
- LUKS encrypts entire block devices and is therefore well-suited for protecting contents of mobile devices such as removable storage media or laptop disk drives.
- The underlying contents of the encrypted block device are arbitrary, which makes it useful for encrypting swap devices. This can also be useful with certain databases that use specially formatted block devices for data storage.
- LUKS uses the existing device mapper kernel subsystem.
- LUKS provides passphrase strengthening which protects against dictionary attacks.
- LUKS devices contain multiple key slots, allowing users to add backup keys or passphrases.
What LUKS does not do
- Disk-encryption solutions like LUKS protect the data only when your system is off. Once the system is on and LUKS has decrypted the disk, the files on that disk are available to anyone who would normally have access to them.
- LUKS is not well-suited for scenarios that require many users to have distinct access keys to the same device. The LUKS1 format provides eight key slots, LUKS2 up to 32 key slots.
- LUKS is not well-suited for applications requiring file-level encryption.
Ciphers
The default cipher used for LUKS is aes-xts-plain64
. The default key size for LUKS is 512 bits. The default key size for LUKS with Anaconda (XTS mode) is 512 bits. Ciphers that are available are:
- AES - Advanced Encryption Standard - FIPS PUB 197
- Twofish (a 128-bit block cipher)
- Serpent
Additional resources
22.2. Configuring the LUKS passphrase in the web console
If you want to add encryption to an existing logical volume on your system, you can only do so through formatting the volume.
Prerequisites
The web console must be installed and accessible.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. - Available existing logical volume without encryption.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
- Click Storage.
- Select the storage device you want to format.
- Click the menu icon and select Format option.
Select the Encrypt data box to activate encryption on your storage device.
- Set and confirm your new passphrase.
- [Optional] Modify further encryption options.
- Finalize formatting settings.
- Click Format.
22.3. Changing the LUKS passphrase in the web console
Change a LUKS passphrase on an encrypted disk or partition in the web console.
Prerequisites
The web console must be installed and accessible.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system.
Procedure
Log in to the web console.
For details, see Logging in to the web console.
- Click Storage
- In the Drives table, select the disk with encrypted data.
- In Content, select the encrypted partition.
- Click Encryption.
In the Keys table, click the pen icon.
In the Change passphrase dialog window:
- Enter your current passphrase.
- Enter your new passphrase.
Confirm your new passphrase.
- Click Save
Chapter 23. Configuring automated unlocking using a Tang key in the web console
Configure automated unlocking of a LUKS-encrypted storage device using a key provided by a Tang server.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
-
The
cockpit-storaged
package is installed on your system. -
The
cockpit.socket
service is running at port 9090. -
The
clevis
,tang
, andclevis-dracut
packages are installed. - A Tang server is running.
Procedure
Open the RHEL web console by entering the following address in a web browser:
https://localhost:9090
Replace the localhost part by the remote server’s host name or IP address when you connect to a remote system.
- Provide your credentials and click Content part: . Select an encrypted device and click in the
Click Keys section to add a Tang key:
in theProvide the address of your Tang server and a password that unlocks the LUKS-encrypted device. Click
to confirm:The following dialog window provides a command to verify that the key hash matches. RHEL 8.2 introduced the
tang-show-keys
script, and you can obtain the key hash using the following command on the Tang server running on the port 7500:# tang-show-keys 7500 3ZWS6-cDrCG61UPJS2BMmPU4I54
On RHEL 8.1 and earlier, obtain the key hash using the following command:
# curl -s localhost:7500/adv | jose fmt -j- -g payload -y -o- | jose jwk use -i- -r -u verify -o- | jose jwk thp -i- 3ZWS6-cDrCG61UPJS2BMmPU4I54
Click
when the key hashes in the web console and in the output of previously listed commands are the same:To enable the early boot system to process the disk binding, click
at the bottom of the left navigation bar and enter the following commands:# yum install clevis-dracut # dracut -fv --regenerate-all
Verification steps
Check that the newly added Tang key is now listed in the Keys section with the
Keyserver
type:Verify that the bindings are available for the early boot, for example:
# lsinitrd | grep clevis clevis clevis-pin-sss clevis-pin-tang clevis-pin-tpm2 -rwxr-xr-x 1 root root 1600 Feb 11 16:30 usr/bin/clevis -rwxr-xr-x 1 root root 1654 Feb 11 16:30 usr/bin/clevis-decrypt ... -rwxr-xr-x 2 root root 45 Feb 11 16:30 usr/lib/dracut/hooks/initqueue/settled/60-clevis-hook.sh -rwxr-xr-x 1 root root 2257 Feb 11 16:30 usr/libexec/clevis-luks-askpass
Additional resources
- For more details on automated unlocking of LUKS-encrypted volumes using Clevis and Tang, see the Configuring automated unlocking of encrypted volumes using policy-based decryption chapter.
Chapter 24. Managing software updates in the web console
Lear how to manage software updates in the RHEL 8 web console and ways to automate them.
The Software Updates module in the web console is based on the yum
utility. For more information about updating sofware with yum
, see the Checking for updates and updating packages section.
24.1. Managing manual software updates in the web console
This section describes how to manually update your software using the web console.
Prerequisites
The web console must be installed and accessible.
For details, see Installing the web console.
Procedure
Log in to the RHEL 8 web console.
For details, see Logging in to the web console.
Click Software Updates.
The list of available updates refreshes automatically if the last check happened more than 24 hours ago. To trigger a refresh, click the Check for Updates button.
Apply updates.
To install all available updates, click the Install all updates button.
If you have security updates available, you can install them separately by clicking the Install Security Updates button.
You can watch the update log while the update is running.
After the system applies updates, you get a recommendation to restart your system.
We recommend this especially if the update included a new kernel or system services that you do not want to restart individually.
Click Ignore to cancel the restart, or Restart Now to proceed with restarting your system.
After the system restart, log in to the web console and go to the Software Updates page to verify that the update has been successful.
24.2. Managing automatic software updates in the web console
In the web console, you can choose to apply all updates, or security updates and also manage periodicity and time of your automatic updates.
Prerequisites
- The web console must be installed and accessible. For details, see Installing the web console.
Procedure
Log in to RHEL 8 web console.
For details, see Logging in to the web console.
- Click Software Updates.
- If you want to automatically apply only security updates, click on the Apply all updates drop-down menu and select Apply security updates.
- To modify day of the automatic update, click on the every day drop-down menu and select a specific day.
To modify time of the automatic update, click on the 6:00 drop-down menu and select a specific time.
If you want to disable automatic software updates, click on switch next to Automatic Updates to move it to disabled position.
Chapter 25. Managing subscriptions in the web console
Manage your subscription for Red Hat Enterprise Linux 8 from the web console.
To get a subscription for your Red Hat Enterprise Linux, you need to have an account in the Red Hat Customer Portal or an activation key.
This chapter covers:
- Subscription management in the RHEL 8 web console.
- Registering subscriptions for your system in the web console with the Red Hat user name and password.
- Registering subscriptions with the activation key.
Prerequisites
- Purchased subscriptions.
- The system subjected to subscription has to be connected to the Internet because the web console needs to communicate with the Red Hat Customer Portal.
25.1. Subscription management in the web console
The RHEL 8 web console provides an interface for using Red Hat Subscription Manager installed on your local system.
The Subscription Manager connects to the Red Hat Customer Portal and verifies all available:
- Active subscriptions
- Expired subscriptions
- Renewed subscriptions
If you want to renew the subscription or get a different one in Red Hat Customer Portal, you do not have to update the Subscription Manager data manually. The Subscription Manager synchronizes data with Red Hat Customer Portal automatically.
25.2. Registering subscriptions with credentials in the web console
Use the following steps to register a newly installed Red Hat Enterprise Linux using the RHEL 8 web console.
Prerequisites
A valid user account on the Red Hat Customer Portal.
See the Create a Red Hat Login page.
- Active subscription for your RHEL system.
Procedure
Type subscription in the search field and press the Enter key.
Alternatively, you can log in to the RHEL 8 web console. For details, see Logging in to the web console.
In the
polkit
authentication dialog for privileged tasks, add the password belonging to the user name displayed in the dialog.- Click Authenticate.
In the Subscriptions dialog box, click Register.
Enter your Customer Portal credentials.
Enter the name of your organization.
If you have more than one account on the Red Hat Customer Portal, you have to add the organization name or organization ID. To get the org ID, go to your Red Hat contact point.
- Click the Register button.
At this point, your Red Hat Enterprise Linux 8 system has been successfully registered.
25.3. Registering subscriptions with activation keys in the web console
To register a subscription for Red Hat Enterprise Linux,
Prerequisites
- If you do not have a user account in the portal, your vendor provides you with the activation key.
Procedure
Type subscription in the search field and press the Enter key.
Alternatively, you can log in to the RHEL 8 web console. For details, see Logging in to the web console.
In the authentication dialog, add the system username and password you created during the system installation.
- Click Authenticate.
In the Subscriptions dialog box, click Register.
- Enter the activation key in the registration form.
Enter the name of your organization.
You need to add the organization name or organization ID, if you have more than one account in the Red Hat Customer Portal.
To get the org ID, go to your Red Hat contact point.
- Click the Register button.
At this point, your RHEL 8 system has been successfully registered.
Chapter 26. Configuring kdump in the web console
Setup and test the kdump
configuration in the RHEL 8 web console.
The web console is part of a default installation of Red Hat Enterprise Linux 8 and enables or disables the kdump
service at boot time. Further, the web console conveniently enables you to configure the reserved memory for kdump
; or to select the vmcore saving location in an uncompressed or compressed format.
Prerequisites
- See Red Hat Enterprise Linux web console for further details.
26.1. Configuring kdump memory usage and target location in web console
The procedure below shows you how to use the Kernel Dump
tab in the Red Hat Enterprise Linux web console interface to configure the amount of memory that is reserved for the kdump kernel. The procedure also describes how to specify the target location of the vmcore dump file and how to test your configuration.
Prerequisites
- Introduction to operating the web console
Procedure
-
Open the
Kernel Dump
tab and start thekdump
service. -
Configure the
kdump
memory usage through the command line. Click the link next to the
Crash dump location
option.Select the
Local Filesystem
option from the drop-down and specify the directory you want to save the dump in.Alternatively, select the
Remote over SSH
option from the drop-down to send the vmcore to a remote machine using the SSH protocol.Fill the
Server
,ssh key
, andDirectory
fields with the remote machine address, ssh key location, and a target directory.Another choice is to select the
Remote over NFS
option from the drop-down and fill theMount
field to send the vmcore to a remote machine using the NFS protocol.NoteTick the
Compression
check box to reduce the size of the vmcore file.
Test your configuration by crashing the kernel.
WarningThis step disrupts execution of the kernel and results in a system crash and loss of data.
Additional resources
-
For a complete list of currently supported targets for
kdump
, see Supported kdump targets. - For information on how to configure an SSH server and set up a key-based authentication, see Using secure communications between two systems with OpenSSH.
Chapter 27. Managing virtual machines in the web console
Manage your virtual machines in a RHEL 8 web console and learn about the virtualization management capabilities.
To manage virtual machines in a graphical interface on a RHEL 8 host, you can use the Virtual Machines
pane in the RHEL 8 web console.

27.1. Overview of virtual machine management using the web console
The RHEL 8 web console is a web-based interface for system administration. As one of its features, the web console provides a graphical view of virtual machines (VMs) on the host system, and makes it possible to create, access, and configure these VMs.
Note that to use the web console to manage your VMs on RHEL 8, you must first install a web console plug-in for virtualization.
Next steps
- For instructions on enabling VMs management in your web console, see Section 27.2, “Setting up the web console to manage virtual machines”.
- For a comprehensive list of VM management actions that the web console provides, see Section 27.3, “Virtual machine management features available in the web console”.
- For a list of features that are currently not available in the web console but can be used in the virt-manager application, see Section 27.4, “Differences between virtualization features in Virtual Machine Manager and the web console”.
27.2. Setting up the web console to manage virtual machines
Before using the RHEL 8 web console to manage virtual machines (VMs), you must install the web console virtual machine plug-in on the host.
Prerequisites
Ensure that the web console is installed and enabled on your machine.
# systemctl status cockpit.socket cockpit.socket - Cockpit Web Service Socket Loaded: loaded (/usr/lib/systemd/system/cockpit.socket [...]
If this command returns
Unit cockpit.socket could not be found
, follow the Installing the web console document to enable the web console.
Procedure
Install the
cockpit-machines
plug-in.# yum install cockpit-machines
Verification
If the installation is successful,
appears in the web console side menu.
Additional resources
- For instructions on connecting to the web console, as well as other information on using the web console, see the Managing systems using the RHEL 8 web console document.
27.3. Virtual machine management features available in the web console
Using the RHEL 8 web console, you can perform the following actions to manage the virtual machines (VMs) on your system.
Table 27.1. VM tasks that can be performed in the RHEL 8 web console
Task | For details, see: |
---|---|
Create a VM and install it with a guest operating system | Creating virtual machines and installing guest operating systems using the web console |
Delete a VM. | |
Start, shut down, and restart the VM | Starting virtual machines using the web console and Shutting down and restarting virtual machines using the web console |
Connect to and interact with a VM using a variety of consoles | |
View a variety of information about the VM | |
Adjust the host memory allocated to a VM | Adding and removing virtual machine memory using the web console |
Manage network connections for the VM | Using the web console for managing virtual machine network interfaces |
Manage the VM storage available on the host and attach virtual disks to the VM | |
Configure the virtual CPU settings of the VM |
27.4. Differences between virtualization features in Virtual Machine Manager and the web console
The Virtual Machine Manager (virt-manager) application is supported in RHEL 8, but has been deprecated. The web console is intended to become its replacement in a subsequent major release. It is, therefore, recommended that you get familiar with the web console for managing virtualization in a GUI.
However, in RHEL 8, some VM management tasks can only be performed in virt-manager or the command line. The following table highlights the features that are available in virt-manager but not available in the RHEL 8.0 web console.
If a feature is available in a later minor version of RHEL 8, the minimum RHEL 8 version appears in the Support in web console introduced column.
Table 27.2. VM managemennt tasks that cannot be performed using the web console in RHEL 8.0
Task | Support in web console introduced | Alternative method using CLI |
---|---|---|
Setting a virtual machine to start when the host boots | RHEL 8.1 |
|
Suspending a virtual machine | RHEL 8.1 |
|
Resuming a suspended virtual machine | RHEL 8.1 |
|
Creating file-system directory storage pools | RHEL 8.1 |
|
Creating NFS storage pools | RHEL 8.1 |
|
Creating physical disk device storage pools | RHEL 8.1 |
|
Creating LVM volume group storage pools | RHEL 8.1 |
|
Creating partition-based storage pools | CURRENTLY UNAVAILABLE |
|
Creating GlusterFS-based storage pools | CURRENTLY UNAVAILABLE |
|
Creating vHBA-based storage pools with SCSI devices | CURRENTLY UNAVAILABLE |
|
Creating Multipath-based storage pools | CURRENTLY UNAVAILABLE |
|
Creating RBD-based storage pools | CURRENTLY UNAVAILABLE |
|
Creating a new storage volume | RHEL 8.1 |
|
Adding a new virtual network | RHEL 8.1 |
|
Deleting a virtual network | RHEL 8.1 |
|
Creating a bridge from a host machine’s interface to a virtual machine | CURRENTLY UNAVAILABLE |
|
Creating a snapshot | CURRENTLY UNAVAILABLE |
|
Reverting to a snapshot | CURRENTLY UNAVAILABLE |
|
Deleting a snapshot | CURRENTLY UNAVAILABLE |
|
Cloning a virtual machine | CURRENTLY UNAVAILABLE |
|
Migrating a virtual machine to another host machine | CURRENTLY UNAVAILABLE |
|
Additional resources
- For information on the Virtual Machine Manager, see RHEL 7 documentation.
Chapter 28. Managing remote systems in the web console
Connect to the remote systems and manage them in the RHEL 8 web console.
The following chapter describes:
- The optimal topology of connected systems.
- What is the Dashboard.
- How to add and remove remote systems.
- When, why and how to use SSH keys to for remote system authentication.
Prerequisites
- Opened the SSH service on remote systems.
28.1. Remote system manager in the web console
Using the RHEL 8 web console to manage remote systems in the network requires considering the topology of connected servers.
For optimal security, Red Hat recommends the following connection setup:
- Use one system with the web console as a bastion host. The bastion host is a system with opened HTTPS port.
- All other systems communicate through SSH.
With the web interface running on the bastion host, you can reach all other systems through the SSH protocol using port 22 in the default configuration.
28.2. Adding remote hosts to the web console
This section helps you to connect other systems with a user name and password to the Dashboard located in the web console.
The Dashboard is a tool designed for remote server management, where you can add, connect, or remove remote systems.
The Dashboard displays graphs and status for each of the remote systems.
You can add up to 20 remote systems in the Dashboard.
Prerequisites
The
cockpit-dashboard
package installed in the system where the web interface is running:$ sudo yum install cockpit-dashboard
The
cockpit-dashboard
package extends the RHEL 8 web console with the remote system management.You need to be logged into the web console with administration privileges.
For details, see Logging in to the web console.
Procedure
- In the RHEL 8 web console, go to Dashboard.
In the Dashboard, click the Add Server icon.
- In the Add Machine to Dashboard dialog box, enter the host name or IP address of the remote system.
- (Optional) Click the Color field to change the color of the system in Dashboard.
- Click Add.
In the Log in to <servername> dialog box, enter the credentials for the remote system.
You can use any user account of the remote system. Howerver, if you use credetials of a user account without administration privileges, you will not be able to perform administration tasks.
If you use the same credentials as for your local system, the web console will authenticate remote systems automatically every time you log in. However, using the same credentials on more machines could be a potential security risk.
- Click Log In.
If the login succeeds the Dashboard adds a new item in the list. To verify the connection, click the system to see all the details in the web console.
The web console does not save passwords used to log in to remote systems which means that you have to log in again after each system restart. To open the login dialog, click the Troubleshoot button placed on the main screen of the disconnected remote system.
28.3. Removing remote hosts from the web console
This section guides you on removing other systems from a dashboard located in the web console.
Prerequisites
-
The
cockpit-dashboard
package installed in the system where the web interface is running. Remote systems added.
For details, see Section 28.2, “Adding remote hosts to the web console”.
You must be logged into the web console with administrator privileges.
For details, see Logging in to the web console.
Procedure
- Log in to the RHEL 8 web console.
- Click Dashboard.
Click the Edit Server icon.
To remove the server from the Dashboard, click the red Remove icon.
As a result, the server is removed from Dashboard.
28.4. Setting up SSH for remote management in the web console
The RHEL 8 web console supports authentication with SSH keys. This has the following advantages:
- Increasing security of the communication between servers.
- Avoiding entering credentials repeatedly.
Using SSH keys works only for read only access or for password-less sudo because the authentication happens without a password. To perform administrative tasks, use your system account credentials with administrative privileges.
To configure authentication with SSH keys in the web console:
- Copy the public key into the connected remote system.
- Set the path to the private key in the system, on which the RHEL 8 web console is running.
- Log out from the web console and log in again to ensure the authentication change.
Prerequisites
SSH key stored in the system with running web console. If you do not have any, use the following command:
$ ssh-keygen
- Password to the generated SSH key.
-
The contents of the
~/.ssh/id_rsa.pub
file copied in the clipboard.
Procedure
To copy the public SSH key into a remote system:
- Open the web console.
- Click Dashboard.
- Select the remote system where you want to add the public key.
- In the system settings, go to Accounts.
- Select the user account to which you want to assign the public key.
In the Authorized Public SSH Keys settings, click the + button.
- In the Add public key dialog box, paste the public key you have in the clipboard.
- Click Add key.
At this point, you can see the new public key assigned to the user account.
To set the path to the private SSH key:
- Go to upper right corner settings.
In the drop down menu, select Authentication.
Verify that the web console uses the correct path to the private key you want to use.
By default, the web console uses the following paths for private keys:
~/.ssh/id_rsa ~/.ssh/id_dsa ~/.ssh/id_ed25519 ~/.ssh/id_ecdsa
To use a different key, add the path manually.
Enable the key with the On/Off button.
Enabling the key opens a password dialog.
Enter the SSH key password.
Click Unlock Key.
On Details tab, you can verify the certificate owner and the fingerprint.
- Click Close.
The RHEL 8 web console uses now SSH keys on both sides. However, systems still use the original credentials.
To change the authentication settings:
Log out yourself from the web console.
After the logging back in the web console, red triangle icon appears before the remote system.
Click the system trying to connect to the web console.
You can see two buttons in the screen. Reconnect and Troubleshoot.
Click the Troubleshoot button.
Login dialog appears.
- In the Authentication drop down menu, select Using available credentials.
The web console creates a new connection secured with SSH keys. It works for the web console login as well as for a terminal access.
Chapter 29. Configuring Single Sign-On for the RHEL 8 web console in the IdM domain
Learn how to use Single Sign-on (SSO) authentication provided by Identity Management (IdM) in the RHEL 8 web console.
Advantages:
- IdM domain administrators can use the RHEL 8 web console to manage local machines.
- Users with a Kerberos ticket in the IdM domain do not need to provide login credentials to access the web console.
- All hosts known to the IdM domain are accessible via SSH from the local instance of the RHEL 8 web console.
- Certificate configuration is not necessary. The console’s web server automatically switches to a certificate issued by the IdM certificate authority and accepted by browsers.
This chapter covers the following steps to configure SSO for logging into the the RHEL web console:
Add machines to the IdM domain using the RHEL 8 web console.
For details, see Section 29.1, “Joining a RHEL 8 system to an IdM domain using the web console”.
If you want to use Kerberos for authentication, you need to obtain a Kerberos ticket on your machine.
For details, see Section 29.2, “Logging in to the web console using Kerberos authentication”.
Allow administrators on the IdM server to run any command on any host.
For details, see Section 29.3, “Enabling admin sudo access to domain administrators on the IdM server”.
Prerequisites
The RHEL web console installed on RHEL 8 systems.
For details, see Installing the web console.
IdM client installed on systems with the RHEL web console.
For details, see IdM client installation.
29.1. Joining a RHEL 8 system to an IdM domain using the web console
You can use the web console to join the Red Hat Enterprise Linux 8 system to the Identity Management (IdM) domain.
Prerequisites
- The IdM domain is running and reachable from the client you want to join.
- You have the IdM domain administrator credentials.
Procedure
Log into the RHEL web console.
For details, see Logging in to the web console.
- Open the System tab.
Click
.- In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
In the Authentication drop down list, select if you want to use a password or a one-time password for authentication.
- In the Domain Administrator Name field, enter the user name of the IdM administration account.
- In the password field, add the password or one-time password according to what you selected in the Authentication drop down list earlier.
Click
.
Verification steps
- If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.
To verify that the user is a member of the domain, click the Terminal page and type the
id
command:$ id euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
29.2. Logging in to the web console using Kerberos authentication
The following procedure describes steps on how to set up the RHEL 8 system to use Kerberos authentication.
With SSO you usually do not have any administrative privileges in the web console. This only works if you configured passwordless sudo. The web console does not interactively ask for a sudo password.
Prerequisites
IdM domain running and reachable in your company environment.
For details, see Section 29.1, “Joining a RHEL 8 system to an IdM domain using the web console”
Enable the
cockpit.socket
service on remote systems to which you want to connect and manage them with the RHEL web console.For details, see Installing the web console.
-
If the system does not use a Kerberos ticket managed by the SSSD client, try to request the ticket with the
kinit
utility manually.
Procedure
Log in to the RHEL web console with the following address: https://dns_name:9090
.
At this point, you are successfully connected to the RHEL web console and you can start with configuration.
29.3. Enabling admin sudo access to domain administrators on the IdM server
The following procedure describes steps on how to allow domain administrators to run any command on any host in the Identity Management (IdM) domain.
To accomplish this, enable sudo access to the admins user group created automatically during the IdM server installation.
All users added to the admins group will have sudo access if you run ipa-advise
script on the group.
Prerequisites
- The server runs IdM 4.7.1 or later.
Procedure
- Connect to the IdM server.
Run the ipa-advise script:
$ ipa-advise enable-admins-sudo | sh -ex
If the console did not display an error, the admins group have admin permissions on all machines in the IdM domain.
Chapter 30. Configuring smart card authentication with the web console for centrally managed users
Configure smart card authentication in the RHEL 8 web console for users who are centrally managed by:
- Identity Management
- Active Directory which is connected in the cross-forest trust with Identity Management
Smart card authentication does not elevate administrative privileges yet and the web console opens in the web browser in the read-only mode.
You can run administrative commands in the built-in terminal with `sudo`.
Prerequisites
The system for which you want to use the smart card authentication must be a member of an Active Directory or Identity Management domain.
For details about joining the RHEL 8 system into a domain using the web console, see Joining a RHEL 8 system to an IdM domain using the web console.
The certificate used for the smart card authentication must be associated with a particular user in Identity Management or Active Directory.
For more details about associating a certificate with the user in Identity Management, see Adding a certificate to a user entry in IdM.
30.1. Smart card authentication for centrally managed users
A smart card is a physical device, which can provide personal authentication using certificates stored on the card. Personal authentication means that you can use smart cards in the same way as user passwords.
You can store user credentials on the smart card in the form of a private key and a certificate. Special software and hardware is used to access them. You insert the smart card into a reader or a USB socket and supply the PIN code for the smart card instead of providing your password.
Identity Management (IdM) supports smart card authentication with:
- User certificates issued by the IdM certificate authority. For details, see Configuring Identity Management for smart card authentication.
- User certificates issued by the Active Directory Certificate Service (ADCS) certificate authority. For details, see Configuring certificates issued by ADCS for smart card authentication in IdM.
If you want to start to use smart card authentication, see the hardware requirements: Smart Card support in RHEL8.
30.2. Installing tools for managing and using smart cards
To configure your smart card, you need tools which can generate certificates and store them on a smart card.
You must:
-
Install the
gnutls-utils
package which helps you to manage certificates. -
Install the
opensc
package which provides a set of libraries and utilities to work with smart cards. -
Start the
pcscd
service which communicates with the smart card reader.
Procedure
Install the
opensc
andgnutls-utils
packages:# dnf -y install opensc gnutls-utils
Start the
pcscd
service.# systemctl start pcscd
Verify that the pcscd
service is up and running.
30.3. Storing a certificate on a smart card
This section describes smart card configuration with the pkcs15-init
tool, which helps you to configure:
- Erasing your smart card
- Setting new PINs and optional PIN Unblocking Keys (PUKs)
- Creating a new slot on the smart card
- Storing the certificate, private key, and public key in the slot
- Locking the smart card settings (some smart cards require this type of finalization)
Prerequisites
The
opensc
package, which includes thepkcs15-init
tool is installed.For details, see Installing tools for managing and using smart cards.
- The card is inserted in the reader and connected to the computer.
-
You have the private key, public key, and certificate to store on the smart card. In this procedure,
testuser.key
,testuserpublic.key
, andtestuser.crt
are the names used for the private key, public key, and the certificate. - Your current smart card user PIN and Security Officer PIN (SO-PIN)
Procedure
Erase your smart card and authenticate yourself with your PIN:
$ pkcs15-init --erase-card --use-default-transport-keys Using reader with a card: Reader name PIN [Security Officer PIN] required. Please enter PIN [Security Officer PIN]:
The card has been erased.
Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:
$ pkcs15-init --create-pkcs15 --use-default-transport-keys \ --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123 Using reader with a card: Reader name
The
pcks15-init
tool creates a new slot on the smart card.Set the label and the authentication ID for the slot:
$ pkcs15-init --store-pin --label testuser \ --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478 Using reader with a card: Reader name
The label is set to a human-readable value, in this case,
testuser
. Theauth-id
must be two hexadecimal values, in this case it is set to01
.Store and label the private key in the new slot on the smart card:
$ pkcs15-init --store-private-key testuser.key --label testuser_key \ --auth-id 01 --id 01 --pin 963214 Using reader with a card: Reader name
NoteThe value you specify for
--id
must be the same when storing your private key, and certificate. If you do not specify a value for--id
, a more complicated value is calculated by the tool and it is therefore easier to define your own value.Store and label the certificate in the new slot on the smart card:
$ pkcs15-init --store-certificate testuser.crt --label testuser_crt \ --auth-id 01 --id 01 --format pem --pin 963214 Using reader with a card: Reader name
(Optional) Store and label the public key in the new slot on the smart card:
$ pkcs15-init --store-public-key testuserpublic.key --label testuserpublic_key --auth-id 01 --id 01 --pin 963214 Using reader with a card: Reader name
NoteIf the public key corresponds to a private key and/or certificate, you should specify the same ID as that private key and/or certificate.
(Optional) Some smart cards require you to finalize the card by locking the settings:
$ pkcs15-init -F
At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.
30.4. Enabling smart card authentication for the web console
To be able to use smart card authentication in the web console, enable smart card authentication in the cockpit.conf
file.
Additionally, you can disable password authentication in the same file.
Prerequisites
The RHEL 8 web console has been installed.
For details, see Installing the web console.
Procedure
Log in to the RHEL web console with administrator privileges.
For details, see Logging in to the web console.
- Click Terminal.
In the
/etc/cockpit/cockpit.conf
, set theClientCertAuthentication
toyes
:[WebService] ClientCertAuthentication = yes
Optionally, disable password based authentication in
cockpit.conf
with:[Basic] action = none
This configuration disables password authentication and you must always use the smart card.
Restart the web console to make sure that the
cockpit.service
accepts the change:# systemctl restart cockpit
30.5. Logging in to the web console with smart cards
You can use smart cards to log in to the web console.
Prerequisites
- A valid certificate stored in your smart card that is associated to a user account created in a Active Directory or Identity Management domain.
- PIN to unlock the smart card.
- The smart card has been put into the reader.
Procedure
Open your web browser and add the web console’s address in the address bar.
The browser asks you to add the PIN protecting the certificate stored on the smart card.
- In the Password Required dialog box, enter PIN and click OK.
- In the User Identification Request dialog box, select the certificate stored in the smart card.
Select Remember this decision.
The system does not open this window next time.
- Click OK.
You are now connected and the web console displays its content.
30.6. Limiting user sessions and memory to prevent a DoS attack
Certificate authentication is protected by separating and isolating instances of the cockpit-ws
web server against attackers who wants to impersonate another user. However, this introduces a potential Denial of Service (DoS) attack: A remote attacker could create a large number of certificates and send a large number of HTTPS requests to cockpit-ws
each using a different certificate.
To prevent this DoS, the collective resources of these web server instances are limited. By default, limits to the number of connections and to memory usage are set to 200 threads and a 75% (soft) / 90% (hard) memory limit.
The following procedure describes resource protection by limiting the number of connections and memory.
Procedure
In the terminal, open the
system-cockpithttps.slice
configuration file:# systemctl edit system-cockpithttps.slice
Limit the
TasksMax
to 100 andCPUQuota
to 30%:[Slice] # change existing value TasksMax=100 # add new restriction CPUQuota=30%
To apply the changes, restart the system:
# systemctl daemon-reload # systemctl stop cockpit
Now, the new memory and user session limits protect the cockpit-ws
web server from DoS attacks.
30.7. Additional resources
- For more details on configuring certificates issued by IdM for smart card authentication, see the Configuring Identity Management for smart card authentication.
- For more details on configuring certificates issued by ADCS for smart card authentication, see the Configuring certificates issued by ADCS for smart card authentication in IdM.
- For more details on configuring certificates issued by local CA for smart card authentication, see the Configuring and importing local certificates to a smart card. :context: system-management-using-the-RHEL-8-web-console