Managing systems using the RHEL 8 web console

Red Hat Enterprise Linux 8

A guide to using the web console for managing systems in Red Hat Enterprise Linux 8

Red Hat Customer Content Services

Abstract

This document describes how to manage physical and virtual Linux-based systems using the RHEL 8 web console.
The instructions assume that the server used for management is running in Red Hat Enterprise Linux 8.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message.

Providing feedback on Red Hat documentation

We appreciate your input on our documentation. Please let us know how we could make it better. To do so:

  • For simple comments on specific passages:

    1. Make sure you are viewing the documentation in the Multi-page HTML format. In addition, ensure you see the Feedback button in the upper right corner of the document.
    2. Use your mouse cursor to highlight the part of text that you want to comment on.
    3. Click the Add Feedback pop-up that appears below the highlighted text.
    4. Follow the displayed instructions.
  • For submitting more complex feedback, create a Bugzilla ticket:

    1. Go to the Bugzilla website.
    2. As the Component, use Documentation.
    3. Fill in the Description field with your suggestion for improvement. Include a link to the relevant part(s) of documentation.
    4. Click Submit Bug.

Chapter 1. Getting started using the RHEL web console

Install the web console in Red Hat Enterprise Linux 8 and learn how to add remote hosts and monitor them in the RHEL 8 web console.

Prerequisites

1.1. What is the RHEL web console

The RHEL web console is a Red Hat Enterprise Linux 8 web-based interface designed for managing and monitoring your local system, as well as Linux servers located in your network environment.

cockpit overview page PF4

The RHEL web console enables you a wide range of administration tasks, including:

  • Managing services
  • Managing user accounts
  • Managing and monitoring system services
  • Configuring network interfaces and firewall
  • Reviewing system logs
  • Managing virtual machines
  • Creating diagnostic reports
  • Setting kernel dump configuration
  • Configuring SELinux
  • Updating software
  • Managing system subscriptions

The RHEL web console uses the same system APIs as you would in a terminal, and actions performed in a terminal are immediately reflected in the RHEL web console.

You can monitor the logs of systems in the network environment, as well as their performance, displayed as graphs. In addition, you can change the settings directly in the web console or through the terminal.

1.2. Installing and enabling the web console

To access the RHEL 8 web console, first enable the cockpit.socket service.

Red Hat Enterprise Linux 8 includes the RHEL 8 web console installed by default in many installation variants. If this is not the case on your system, install the cockpit package before enabling the cockpit.socket service.

Procedure

  1. If the web console is not installed by default on your installation variant, manually install the cockpit package:

    # yum install cockpit
  2. Enable and start the cockpit.socket service, which runs a web server:

    # systemctl enable --now cockpit.socket
  3. If the web console was not installed by default on your installation variant and you are using a custom firewall profile, add the cockpit service to firewalld to open port 9090 in the firewall:

    # firewall-cmd --add-service=cockpit --permanent
    # firewall-cmd --reload

Verification steps

  1. To verify the previous installation and configuration, open the web console.

1.3. Logging in to the web console

Use the steps in this procedure for the first login to the RHEL web console using a system user name and password.

Prerequisites

  • Use one of the following browsers for opening the web console:

    • Mozilla Firefox 52 and later
    • Google Chrome 57 and later
    • Microsoft Edge 16 and later
  • System user account credentials

    The RHEL web console uses a specific PAM stack located at /etc/pam.d/cockpit. Authentication with PAM allows you to log in with the user name and password of any local account on the system.

Procedure

  1. Open the web console in your web browser:

    • Locally: https://localhost:9090
    • Remotely with the server’s hostname: https://example.com:9090
    • Remotely with the server’s IP address: https://192.0.2.2:9090

      If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

      The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

  2. In the login screen, enter your system user name and password.

    cockpit login page PF4

  3. Optionally, click the Reuse my password for privileged tasks option.

    If the user account you are using to log in has sudo privileges, this makes it possible to perform privileged tasks in the web console, such as installing software or configuring SELinux.

  4. Click Log In.

After successful authentication, the RHEL web console interface opens.

1.4. Connecting to the web console from a remote machine

It is possible to connect to your web console interface from any client operating system and also from mobile phones or tablets.

Prerequisites

  • Device with a supported internet browser, such as:

    • Mozilla Firefox 52 and later
    • Google Chrome 57 and later
    • Microsoft Edge 16 and later
  • RHEL 8 server you want to access with an installed and accessible web console. For more information about the installation of the web console see Installing the web console.

Procedure

  1. Open your web browser.
  2. Type the remote server’s address in one of the following formats:

    1. With the server’s host name: server.hostname.example.com:port_number
    2. With the server’s IP address: server.IP_address:port_number
  3. After the login interface opens, log in with your RHEL machine credentials.

1.5. Logging in to the web console using a one-time password

If your system is part of an Identity Management (IdM) domain with enabled one-time password (OTP) configuration, you can use an OTP to log in to the RHEL web console.

Important

It is possible to log in using a one-time password only if your system is part of an Identity Management (IdM) domain with enabled OTP configuration. For more information about OTP in IdM, see One-time password in Identity Management.

Prerequisites

Procedure

  1. Open the RHEL web console in your browser:

    • Locally: https://localhost:PORT_NUMBER
    • Remotely with the server hostname: https://example.com:PORT_NUMBER
    • Remotely with the server IP address: https://EXAMPLE.SERVER.IP.ADDR:PORT_NUMBER

      If you use a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

      The console loads a certificate from the /etc/cockpit/ws-certs.d directory and uses the last file with a .cert extension in alphabetical order. To avoid having to grant security exceptions, install a certificate signed by a certificate authority (CA).

  2. The Login window opens. In the Login window, enter your system user name and password.
  3. Generate a one-time password on your device.
  4. Enter the one-time password into a new field that appears in the web console interface after you confirm your password.
  5. Click Log in.
  6. Successful login takes you to the Overview page of the web console interface.

1.6. Restarting the system using the web console

You can use the web console to restart a RHEL system that the web console is attached to.

Prerequisites

Procedure

  1. Log into the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Overview.
  3. Click the Restart restart button.

    cockpit system restart pf4

  4. If any users are logged into the system, write a reason for the restart in the Restart dialog box.
  5. Optional: In the Delay drop down list, select a time interval.

    cockpit restart delay pf4

  6. Click Restart.

1.7. Shutting down the system using the web console

You can use the web console to shut down a RHEL system that the web console is attached to.

Prerequisites

Procedure

  1. Log into the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Overview.
  3. In the Restart drop down list, select Shut Down.

    cockpit system shutdown pf4

  4. If any users are logged in to the system, write a reason for the shutdown in the Shut Down dialog box.
  5. Optional: In the Delay drop down list, select a time interval.
  6. Click Shut Down.

1.8. Configuring time settings using the web console

You can set a time zone and synchronize the system time with a Network Time Protocol (NTP) server.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click the current system time in Overview.

    cockpit time settings pf4

  3. In the Change System Time dialog box, change the time zone if necessary.
  4. In the Set Time drop down menu, select one of the following:

    Manually
    Use this option if you need to set the time manually, without an NTP server.
    Automatically using NTP server
    This is a default option, which synchronizes time automatically with the preset NTP servers.
    Automatically using specific NTP servers
    Use this option only if you need to synchronize the system with a specific NTP server. Specify the DNS name or the IP address of the server.
  5. Click Change.

    cockpit time change pf4

Verification steps

  • Check the system time displayed in the System tab.

1.9. Joining a RHEL 8 system to an IdM domain using the web console

You can use the web console to join the Red Hat Enterprise Linux 8 system to the Identity Management (IdM) domain.

Prerequisites

  • The IdM domain is running and reachable from the client you want to join.
  • You have the IdM domain administrator credentials.

Procedure

  1. Log into the RHEL web console.

    For details, see Logging in to the web console.

  2. Open the System tab.
  3. Click Join Domain.

    idm cockpit join domain

  4. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
  5. In the Authentication drop down list, select if you want to use a password or a one-time password for authentication.

    idm cockpit join psswd

  6. In the Domain Administrator Name field, enter the user name of the IdM administration account.
  7. In the password field, add the password or one-time password according to what you selected in the Authentication drop down list earlier.
  8. Click Join.

    idm cockpit join

Verification steps

  1. If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.
  2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

    $ id
    euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

1.10. Disabling SMT to prevent CPU security issues using the web console

Disable Simultaneous Multi Threading (SMT) in case of attacks that misuse CPU SMT. Disabling SMT can mitigate security vulnerabilities, such as L1TF or MDS.

Important

Disabling SMT might lower the system performance.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click System.
  3. In the Hardware item, click the hardware information.

    cockpit smt hardware

  4. In the CPU Security item, click Mitigations.

    If this link is not present, it means that your system does not support SMT, and therefore is not vulnerable.

  5. In the CPU Security Toggles, switch on the Disable simultaneous multithreading (nosmt) option.

    cockpit smt disable

  6. Click on the Save and reboot button.

After the system restart, the CPU no longer uses SMT.

1.11. Adding a banner to the login page

Companies or agencies sometimes need to show a warning that usage of the computer is for lawful purposes, the user is subject to surveillance, and anyone trespassing will be prosecuted. The warning must be visible before login. Similarly to SSH, the web console can optionally show the content of a banner file on the login screen. To enable banners in your web console sessions, you need to modify the /etc/cockpit/cockpit.conf file. Note that the file is not required and you may need to create it manually.

Prerequisites

Procedure

  1. Create the /etc/issue.cockpit file in a text editor of your preference if you do not have it yet. Add the content you want to display as the banner to the file.

    Do not include any macros in the file as there is no re-formatting done between the file content and the displayed content. Use intended line breaks. It is possible to use ASCII art.

  2. Save the file.
  3. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

    $ sudo vi cockpit.conf
  4. Add the following text to the file:

    [Session]
    Banner=/etc/issue.cockpit
  5. Save the file.
  6. Restart the web console for changes to take effect.

    # systemctl try-restart cockpit

Verification steps

  • Open the web console login screen again to verify that the banner is now visible.

Example 1.1. Adding an example banner to the login page

  1. Create an /etc/issue.cockpit file with a desired text using a text editor:

    This is an example banner for the RHEL web console login page.
  2. Open or create the /etc/cockpit/cockpit.conf file and add the following text:

    [Session]
    Banner=/etc/issue.cockpit
  3. Restart the web console.
  4. Open the web console login screen again.

    cockpit login page banner

1.12. Configuring automatic idle lock in the web console

By default, there is no idle timeout set in the web console interface. If you wish to enable an idle timeout on your system, you can do so by modifying the /etc/cockpit/cockpit.conf configuration file. Note that the file is not required and you may need to create it manually.

Prerequisites

Procedure

  1. Open or create the cockpit.conf file in the /etc/cockpit/ directory in a text editor of your preference.

    $ sudo vi cockpit.conf
  2. Add the following text to the file:

    [Session]
    IdleTimeout=X

    Substitute X with a number for a time period of your choice in minutes.

  3. Save the file.
  4. Restart the web console for changes to take effect.

    # systemctl try-restart cockpit

Verification steps

  • Check if the session logs you out after a set period of time.

Chapter 2. Configuring the host name in the web console

Learn how to use the RHEL 8 web console to configure different forms of the host name on the system that the web console is attached to.

2.1. Host name

The host name identifies the system. By default, the host name is set to localhost, but you can change it.

A host name consists of two parts:

Host name
It is a unique name which identifies a system.
Domain
Add the domain as a suffix behind the host name when using a system in a network and when using names instead of just IP addresses.

A host name with an attached domain name is called a fully qualified domain name (FQDN). For example: mymachine.example.com.

Host names are stored in the /etc/hostname file.

2.2. Pretty host name in the web console

You can configure a pretty host name in the RHEL web console. The pretty host name is a host name with capital letters, spaces, and so on.

The pretty host name displays in the web console, but it does not have to correspond with the host name.

Example 2.1. Host name formats in the web console

Pretty host name
My Machine
Host name
mymachine
Real host name - fully qualified domain name (FQDN)
mymachine.idm.company.com

2.3. Setting the host name using the web console

This procedure sets the real host name or the pretty host name in the web console.

Prerequisites

Procedure

  1. Log into the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Overview.
  3. Click edit next to the current host name.

    cockpit hostname pf4

  4. In the Change Host Name dialog box, enter the host name in the Pretty Host Name field.
  5. The Real Host Name field attaches a domain name to the pretty name.

    You can change the real host name manually if it does not correspond with the pretty host name.

  6. Click Change.

    cockpit hostname change pf4

Verification steps

  1. Log out from the web console.
  2. Reopen the web console by entering an address with the new host name in the address bar of your browser.

    cockpit hostname change verify pf4

Chapter 3. Red Hat web console add-ons

Install add-ons in the RHEL 8 web console and learn what add-on applications are available for you.

3.1. Installing add-ons

The cockpit package is a part of Red Hat Enterprise Linux 8 by default. To be able to use add-on applications you must install them separately.

Prerequisites

  • Installed and enabled cockpit package. If you need to install web console first, check the installation section.

Procedure

  • Install an add-on.

    # yum install <add-on>

3.2. Add-ons for the RHEL 8 web console

The following table lists available add-on applications for the RHEL 8 web console.

Feature namePackage nameUsage

Composer

cockpit-composer

Building custom OS images

Dashboard

cockpit-dashboard

Managing multiple servers in one UI

Machines

cockpit-machines

Managing libvirt virtual machines

PackageKit

cockpit-packagekit

Software updates and application installation (usually installed by default)

PCP

cockpit-pcp

Persistent and more fine-grained performance data (installed on demand from the UI)

podman

cockpit-podman

Managing podman containers (available from RHEL 8.1)

Session Recording

cockpit-session-recording

Recording and managing user sessions

Chapter 4. Optimizing the system performance using the web console

Learn how to set a performance profile in the RHEL 8 web console to optimize the performance of the system for a selected task.

4.1. Performance tuning options in the web console

Red Hat Enterprise Linux 8 provides several performance profiles that optimize the system for the following tasks:

  • Systems using the desktop
  • Throughput performance
  • Latency performance
  • Network performance
  • Low power consumption
  • Virtual machines

The tuned service optimizes system options to match the selected profile.

In the web console, you can set which performance profile your system uses.

Additional resources

4.2. Setting a performance profile in the web console

This procedure uses the web console to optimize the system performance for a selected task.

Prerequisites

Procedure

  1. Log into the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Overview.
  3. In the Performance Profile field, click the current performance profile.

    cockpit performance profile pf4

  4. In the Change Performance Profile dialog box, change the profile if necessary.
  5. Click Change Profile.

    cockpit performance profile change pf4

Verification steps

  • The Overview tab now shows the selected performance profile.

Chapter 5. Reviewing logs in the web console

Learn how to access, review and filter logs in the RHEL 8 web console.

5.1. Reviewing logs in the web console

The RHEL 8 web console Logs section is a UI for the journalctl utility. This section describes how to access system logs in the web console interface.

Prerequisites

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Click Logs.

    cockpit logs new

  3. Open log entry details by clicking on your selected log entry in the list.
Note

You can use the Pause button to pause new log entries from appearing. Once you resume new log entries, the web console will load all log entries that were reported after you used the Pause button.

You can filter the logs by time, priority or identifier. For more information, see Section 5.2, “Filtering logs in the web console”.

5.2. Filtering logs in the web console

This section shows how to filter log entries in the web console.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Logs.
  3. By default, web console shows the latest log entries. To filter by a specific time range, click the Time drop-down menu and choose a preferred option.

    cockpit logs time new

  4. Error and above severity logs list is shown by default. To filter by different priority, click the Error and above drop-down menu and choose a preferred priority.

    cockpit logs priority

  5. By default, web console shows logs for all identifiers. To filter logs for a particular identifier, click the All drop-down menu and select an identifier.

    cockpit logs identifier

  6. To open a log entry, click on a selected log.

5.3. Text search options for filtering logs in the web console

The text search option functionality provides a big variety of options for filtering logs. If you decide to filter logs by using the text search, you can use the predefined options that are defined in the three drop-down menus, or you can type the whole search yourself.

Drop-down menus

There are three drop-down menus that you can use to specify the main parameters of your search:

  • Time: This drop-down menu contains predefined searches for different time ranges of your search.
  • Priority: This drop-down menu provides options for different priority levels. It corresponds to the journalctl --priority option. The default priority value is Error and above. It is set every time you do not specify any other priority.
  • Identifier: In this drop-down menu, you can select an identifier that you want to filter. Corresponds to the journalctl --identifier option.

Quantifiers

There are six quantifiers that you can use to specify your search. They are covered in the Options for filtering logs table.

Log fields

If you want to search for a specific log field, it is possible to specify the field together with its content.

Free-form text search in logs messages

You can filter any text string of your choice in the logs messages. The string can also be in the form of a regular expressions.

Advanced logs filtering I

Filter all log messages identified by 'systemd' that happened since October 22, 2020 midnight and journal field 'JOB_TYPE' is either 'start' or 'restart.

  1. Type identifier:systemd since:2020-10-22 JOB_TYPE=start,restart to search field.
  2. Check the results.

    advanced logs search I

Advanced logs filtering II

Filter all log messages that come from 'cockpit.service' systemd unit that happened in the boot before last and the message body contains either "error" or "fail".

  1. Type service:cockpit boot:-1 error|fail to the search field.
  2. Check the results.

    advanced logs search II

5.4. Using a text search box to filter logs in the web console

Using the text search box allows you to filter logs according to different parameters. The search combines usage of the filtering drop-down menus, quantifiers, log fields and free-form string search.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Logs.
  3. Use the drop-down menus to specify the three main quantifiers - time range, priority, and identifier(s) - you want to filter.

    The Priority quantifier always has to have a value. If you do not specify it, it automatically filters the Error and above priority. Notice that the options you set reflect in the text search box.

  4. Specify the log field you want to filter.

    It is possible to add several log fields.

  5. You can use a free-form string to search for anything else. The search box also accepts regular expressions.

5.5. Options for logs filtering

There are several journalctl options, which you can use for filtering logs in the web console, that may be useful. Some of these are already covered as part of the drop-down menus in the web console interface.

Table 5.1. Table

Option nameUsageNotes

priority

Filter output by message priorities. Takes a single numeric or textual log level. The log levels are the usual syslog log levels. If a single log level is specified, all messages with this log level or a lower (hence more important) log level are shown.

Covered in the Priority drop-down menu.

identifier

Show messages for the specified syslog identifier SYSLOG_IDENTIFIER. Can be specified multiple times.

Covered in the Identifier drop-down menu.

follow

Shows only the most recent journal entries, and continuously prints new entries as they are appended to the journal.

Not covered in a drop-down.

service

Show messages for the specified systemd unit. Can be specified multiple times.

Is not covered in a drop-down. Corresponds to the journalctl --unit parameter.

boot

Show messages from a specific boot.

A positive integer will look up the boots starting from the beginning of the journal, and an equal-or-less-than zero integer will look up boots starting from the end of the journal. Thus, 1 means the first boot found in the journal in chronological order, 2 the second and so on; while -0 is the last boot, -1 the boot before last, and so on.

Covered only as Current boot or Previous boot in the Time drop-down menu. Other options need to be written manually.

since

Start showing entries on or newer than the specified date, or on or older than the specified date, respectively. Date specifications should be of the format "2012-10-30 18:17:16". If the time part is omitted, "00:00:00" is assumed. If only the seconds component is omitted, ":00" is assumed. If the date component is omitted, the current day is assumed. Alternatively the strings "yesterday", "today", "tomorrow" are understood, which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day, respectively. "now" refers to the current time. Finally, relative times may be specified, prefixed with "-" or "+", referring to times before or after the current time, respectively.

Not covered in a drop-down.

Chapter 6. Managing user accounts in the web console

The RHEL web console offers an interface for adding, editing, and removing system user accounts.

After reading this section, you will know:

  • From where the existing accounts come from.
  • How to add new accounts.
  • How to set password expiration.
  • How and when to terminate user sessions.

Prerequisites

6.1. System user accounts managed in the web console

With user accounts displayed in the RHEL web console you can:

  • Authenticate users when accessing the system.
  • Set them access rights to the system.

The RHEL web console displays all user accounts located in the system. Therefore, you can see at least one user account just after the first login to the web console.

After logging into the RHEL web console, you can perform the following operations:

  • Create new users accounts.
  • Change their parameters.
  • Lock accounts.
  • Terminate user sessions.

6.2. Adding new accounts using the web console

Use the following steps for adding user accounts to the system and setting administration rights to the accounts through the RHEL web console.

Prerequisites

Procedure

  1. Log in to the RHEL web console.
  2. Click Accounts.
  3. Click Create New Account.

    cockpit create new account pf4

  4. In the Full Name field, enter the full name of the user.

    The RHEL web console automatically suggests a user name from the full name and fills it in the User Name field. If you do not want to use the original naming convention consisting of the first letter of the first name and the whole surname, update the suggestion.

  5. In the Password/Confirm fields, enter the password and retype it for verification that your password is correct. The color bar placed below the fields shows you security level of the entered password, which does not allow you to create a user with a weak password.

    cockpit user accounts pf4

  6. Click Create to save the settings and close the dialog box.
  7. Select the newly created account.
  8. Select Server Administrator in the Roles item.

cockpit terminate session pf4

Now you can see the new account in the Accounts settings and you can use the credentials to connect to the system.

6.3. Enforcing password expiration in the web console

By default, user accounts have set passwords to never expire. To enforce password expiration, as administrator, set system passwords to expire after a defined number of days.

When the password expires, the next login attempt will prompt for a password change.

Procedure

  1. Log in to the RHEL 8 web console interface.
  2. Click Accounts.
  3. Select the user account for which to enforce password expiration.
  4. In the user account settings, click Never expire password.
  5. In the Password Expiration dialog box, select Require password change every …​ days and enter a positive whole number representing the number of days when the password expires.

    cockpit password expiration

  6. Click Change.

To verify the settings, open the account settings. The RHEL 8 web console displays a link with the date of expiration.

cockpit password expiration date

6.4. Terminating user sessions in the web console

A user creates user sessions when logging into the system. Terminating user sessions means to log the user out from the system.

It can be helpful if you need to perform administrative tasks sensitive to configuration changes, for example, system upgrades.

In each user account in the RHEL 8 web console, you can terminate all sessions for the account except for the web console session you are currently using. This prevents you from cutting yourself off the system.

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Accounts.
  3. Click the user account for which you want to terminate the session.
  4. Click the Terminate Session button.

    cockpit password expiration date

If the Terminate Session button is inactive, the user is not logged in to the system.

The RHEL web console terminates the sessions.

Chapter 7. Managing services in the web console

Learn how to manage system services in the RHEL 8 web console interface. You can activate or deactivate services, restart or reload them, or manage their automatic startup.

7.1. Activating or deactivating system services in the web console

This procedure activates or deactivates system services using the web console interface.

Prerequisites

Procedure

You can filter the services by name or description and also by Enabled, Disabled, or Static automatic startup. The interface shows the current state of the service and its recent logs.

  1. Log in to the RHEL web console with administrator privileges.

    For details, see Logging in to the web console.

  2. Click Services in the web console menu on the left.
  3. The default tab for Services is System Services. If you want to manage targets, sockets, timers, or paths, switch to the respective tab in the menu on top.

    cockpit system services pf4

  4. To open service settings, click on a selected service from the list. You can tell which services are active or inactive by checking the State column.
  5. Activate or deactivate a service:

    • To activate an inactive service, click the Start button.

      cockpit service start pf4

    • To deactivate an active service, click the Stop button.

      cockpit service stop pf4

7.2. Restarting system services in the web console

This procedure restarts system services using the web console interface.

Prerequisites

Procedure

You can filter the services by name or description and also by Enabled, Disabled, or Static automatic startup. The interface shows the current state of the service and its recent logs.

  1. Log in to the RHEL web console with administrator privileges.

    For details, see Logging in to the web console.

  2. Click Services in the web console menu on the left.
  3. The default tab for Services is System Services. If you want to manage targets, sockets, timers, or paths, switch to the respective tab in the menu on top.

    cockpit system services pf4

  4. To open service settings, click on a selected service from the list.
  5. To restart a service, click the Restart button.

    cockpit service restart pf4

Chapter 8. Configuring network bonds using the web console

Learn how network bonding works and configure network bonds in the RHEL 8 web console.

Note

The RHEL 8 web console is build on top of the NetworkManager service.

For details, see Getting started with NetworkManager for managing networking.

Prerequisites

8.1. Understanding network bonding

Network bonding is a method to combine or aggregate network interfaces to provide a logical interface with higher throughput or redundancy.

The active-backup, balance-tlb, and balance-alb modes do not require any specific configuration of the network switch. However, other bonding modes require configuring the switch to aggregate the links. For example, Cisco switches requires EtherChannel for modes 0, 2, and 3, but for mode 4, the Link Aggregation Control Protocol (LACP) and EtherChannel are required.

For further details, see the documentation of your switch and Linux Ethernet Bonding Driver HOWTO.

Important

Certain network bonding features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see the Is bonding supported with direct connection using crossover cables? KCS solution.

8.2. Bond modes

In RHEL 8 there are several mode options. Each mode option is characterize by specific load balancing and fault tolerance. The behavior of the bonded interfaces depends upon the mode. The bonding modes provide fault tolerance, load balancing or both.

Load balancing modes

  • Round Robin: Sequentially transmit packets from the first available interface to the last one.

Fault tolerance modes

  • Active Backup: Only when the primary interface fails, one of a backup interfaces replaces it. Only a MAC address used by active interface is visible.
  • Broadcast: All transmissions are sent on all interfaces.

    Note

    Broadcasting significantly increases network traffic on all the bonded interfaces.

Fault tolerance and load balancing modes

  • XOR: The destination MAC addresses are distributed equally between interfaces with a modulo hash. Each interface then serves the same group of MAC addresses.
  • 802.3ad: Sets an IEEE 802.3ad dynamic link aggregation policy. Creates aggregation groups that share the same speed and duplex settings. Transmits and receives on all interfaces in the active aggregator.

    Note

    This mode requires a switch that is 802.3ad compliant.

  • Adaptive transmit load balancing: The outgoing traffic is distributed according to the current load on each interface. Incoming traffic is received by the current interface. If the receiving interface fails, another interface takes over the MAC address of the failed one.
  • Adaptive load balancing: Includes transmit and receive load balancing for IPv4 traffic.

    Receive load balancing is achieved through Address Resolution Protocol (ARP) negotiation, therefore, it is necessary to set Link Monitoring to ARP in the bond’s configuration.

8.3. Adding a new bond using the web console

Configure an active-backup bond on two or more network interfaces using the web console.

Other network bond modes can be configured similarly.

Prerequisites

  • Two or more network cards are installed in the server.
  • The network cards are connected to a switch.

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. Click the Add Bond button.
  4. In the Bond Settings dialog box, enter a name for the new bond.
  5. In the Members field, select interfaces which should be a member of the bond.
  6. [Optional] In the MAC drop down list, select a MAC address which will be used for this interface.

    If you leave the MAC field empty, the bond will get one of the addresses that are listed in the drop down list.

  7. In the Mode drop down list, select the mode.

    For details, see network bond modes

  8. If you select Active Backup, select the primary interface.

    cockpit bond backup

  9. In the Link Monitoring drop down menu, leave here the MII option.

    Only the adaptive load balancing mode requires to switch this option to ARP.

  10. The Monitoring Interval, Link up delay, and Link down delay fields, which contain values in milliseconds, leave as they are. Change it only for a troubleshooting purpose.
  11. Click Apply.

    cockpit bond add

To verify that the bond works correctly, go to the Networking section and check if the Sending and Receiving columns in the Interfaces table display a network activity.

cockpit bond added

8.4. Adding interfaces to the bond using the web console

Network bonds can include multiple interfaces and you can add or remove any of them at any time.

Learn how to add a network interface to an existing bond.

Prerequisites

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. In the Interfaces table, click on the bond you want to configure.
  4. In the bond settings screen, scroll down to the table of members (interfaces).
  5. Click the + icon.
  6. Select the interface in the drop down list and click it.

    cockpit bond add interface

The RHEL 8 web console adds the interface to the bond.

8.5. Removing or disabling an interface from the bond using the web console

Network bonds can include multiple interfaces. If you need to change a device, you can remove or disable particular interfaces from the bond, which will work with the rest of the active interfaces.

To stop using an interface included in a bond, you can:

  • Remove the interface from the bond.
  • Disable the interface temporarily. The interface stays a part of the bond, but the bond will not use it until you enable it again.

Prerequisites

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. Click the bond you want to configure.
  4. In the bond settings screen, scroll down to the table of ports (interfaces).
  5. Select the interface and and remove or disable it:

    • Click the - icon to remove the interface.
    • Switch the ON/OFF button to Off.

    cockpit bond remove interface

Based on your choice, the web console either removes or disables the interface from the bond and you can see it back in the Networking section as standalone interface.

8.6. Removing or disabling a bond using the web console

Remove or disable a network bond using the web console. If you disable the bond, the interfaces stay in the bond, but the bond will not be used for network traffic.

Prerequisites

  • There is an existing bond in the web console.

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. Click the bond you want to remove.
  4. In the bond settings screen, you can disable the bond with the ON/OFF button or click the Delete button to remove the bond permanently.

    cockpit bond remove

You can go back to Networking and verify that all the interfaces from the bond are now standalone interfaces.

Chapter 9. Configuring network teams using the web console

Learn how network bonding works, what are the differences between network teams and network bonds, and what are the possibilities of configuration in the web console.

Additionally you can find guidelines for:

  • Adding a new network team
  • Adding new interfaces to an existing network team
  • Removing interfaces from an existing network team
  • Removing a network team

Prerequisites

9.1. Understanding network teaming

Network teaming is a feature that combines or aggregates network interfaces to provide a logical interface with higher throughput or redundancy.

Network teaming uses a kernel driver to implement fast handling of packet flows, as well as user-space libraries and services for other tasks. This way, network teaming is an easily extensible and scalable solution for load-balancing and redundancy requirements.

Note that in the context of network teaming, the term port is also known as slave. In the teamd service, the term port is preferred while in the NetworkManager service, the term slave refers to interfaces which create a team.

Important

Certain network teaming features, such as the fail-over mechanism, do not support direct cable connections without a network switch. For further details, see Is bonding supported with direct connection using crossover cables?

9.2. Comparison of network teaming and bonding features

Learn about the features supported in network teams and network bonds:

FeatureNetwork bondNetwork team

Broadcast Tx policy

Yes

Yes

Round-robin Tx policy

Yes

Yes

Active-backup Tx policy

Yes

Yes

LACP (802.3ad) support

Yes (active only)

Yes

Hash-based Tx policy

Yes

Yes

User can set hash function

No

Yes

Tx load-balancing support (TLB)

Yes

Yes

LACP hash port select

Yes

Yes

Load-balancing for LACP support

No

Yes

Ethtool link monitoring

Yes

Yes

ARP link monitoring

Yes

Yes

NS/NA (IPv6) link monitoring

No

Yes

Ports up/down delays

Yes

Yes

Port priorities and stickiness (“primary” option enhancement)

No

Yes

Separate per-port link monitoring setup

No

Yes

Multiple link monitoring setup

Limited

Yes

Lockless Tx/Rx path

No (rwlock)

Yes (RCU)

VLAN support

Yes

Yes

User-space runtime control

Limited

Yes

Logic in user-space

No

Yes

Extensibility

Hard

Easy

Modular design

No

Yes

Performance overhead

Low

Very low

D-Bus interface

No

Yes

Multiple device stacking

Yes

Yes

Zero config using LLDP

No

(in planning)

NetworkManager support

Yes

Yes

9.3. Adding a new team using the web console

Configure a new active backup network team on two or more network interfaces using the web console.

Prerequisites

  • Two or more network cards installed on the server.
  • The network cards are connected to a switch.

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console

  2. Go to the Networking tab.
  3. Click the Add Team button.
  4. In the Team Settings area, configure parameters for the new team:

    1. Add a name for your team device to the Name field.
    2. In the Ports field, select all network interfaces you want to add to the team.
    3. In the Runner drop down menu, select the runner.
    4. In the Link Watch drop down menu select a link watcher.

      1. If you select Ethtool, additionally, set a link up delay and a link down delay.
      2. If you select ARP Ping or NSNA Ping, additionally, set a ping interval and ping target.
  5. Click Apply

    cockpit network team settings

Verification steps

  1. Go to the Networking tab and check if the Sending and Receiving columns in the Interfaces table display a network activity.

    cockpit network team activity

Additional resources

9.4. Adding new interfaces to the team using the web console

Network teams can include multiple interfaces and it is possible to add or remove any of them at any time. The following section describes how to add a new network interface to an existing team.

Prerequisites

  • A network team with is configured.

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console.

  2. Switch to the Networking tab.
  3. In the Interfaces table, click on the team you want to configure.
  4. In the team settings window, scroll down to the Ports table.
  5. Click on the + icon.
  6. Select the interface you wish to add from the drop down list.

    cockpit network team add interface

The RHEL 8 web console adds the interface to the team.

9.5. Removing or disabling an interface from the team using the web console

Network teams can include multiple interfaces. If you need to change a device, you can remove or disable particular interfaces from the network team, which will work together with the rest of active interfaces.

There are two options how to stop using an interface included in a team:

  • Removing the interface from the team
  • Temporarily disabling the interface. The interface then stays a part of the team, but the team will not use it until you enable it again.

Prerequisites

  • A network team with multiple interfaces exists on the host.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Switch to the Networking tab.
  3. Click the team you want to configure.
  4. In the team settings window, scroll down to the table of ports (interfaces).
  5. Select an interface and remove or disable it.

    1. Switch the ON/OFF button to Off to disable the interface.
    2. Click the - icon to remove the interface.

      cockpit team remove interface

Based on your choice, the web console either removes or disables the interface. If you remove the interface, it will be available in Networking as a standalone interface.

9.6. Removing or disabling a team using the web console

Remove or disable a network team using the web console. If you only disable the team, interfaces in the team will stay in it but the team will not be used for network traffic.

Prerequisites

  • A network team is configured on the host.

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console.

  2. Switch to the Networking tab.
  3. Click the team you wish to remove or disable.
  4. Remove or disable the selected team.

    1. You can remove the team by clicking the Delete button.
    2. You can disable the team by moving the ON/OFF switch to a disabled position.

      cockpit team remove

Verification steps

  • If you removed the team, go to Networking, and verify that all the interfaces from your team are now listed as standalone interfaces.

Chapter 10. Configuring network bridges in the web console

Network bridges are used to connect multiple interfaces to the one subnet with the same range of IP addresses.

Prerequisites

10.1. Adding bridges in the web console

Create a software bridge on multiple network interfaces using the web console.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. Click the Add Bridge button.

    cockpit add bridge

  4. In the Bridge Settings dialog box, enter a name for the new bridge.
  5. In the Port field, select interfaces which you want to put to the one subnet.
  6. Optionally, you can select the Spanning Tree protocol (STP) to avoid bridge loops and broadcast radiation.

    If you do not have a strong preference, leave the predefined values as they are.

    cockpit bridge add interfaces

  7. Click Create.

If the bridge is successfully created, the web console displays the new bridge in the Networking section. Check values in the Sending and Receiving columns in the new bridge row.

cockpit bridge interface

If you can see that zero bytes are sent and received through the bridge, the connection does not work correctly and you need to adjust the network settings.

10.2. Configuring a static IP address in the web console

IP address for your system can be assigned from the pool automatically by the DHCP server or you can configure the IP address manually. The IP address will not be influenced by the DHCP server settings.

Learn how to configure static IPv4 addresses of a network bridge using the RHEL web console.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Open the Networking section.
  3. Click the interface where you want to set the static IP address.

    cockpit network interfaces

  4. In the interface details screen, click the IPv4 configuration.

    cockpit ipv4

  5. In the IPv4 Settings dialog box, select Manual in the Addresses drop down list.

    cockpit ipv4 settings

  6. Click Apply.
  7. In the Addresses field, enter the desired IP address, netmask and gateway.

    cockpit ipv4 settings addresses

  8. Click Apply.

At this point, the IP address has been configured and the interface uses the new static IP address.

cockpit ipv4 settings static

10.3. Removing interfaces from the bridge using the web console

Network bridges can include multiple interfaces. You can remove them from the bridge. Each removed interface will be automatically changed to the standalone interface.

Learn how to remove a network interface from a software bridge created in the RHEL 8 system.

Prerequisites

  • Having a bridge with multiple interfaces in your system.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. Click the bridge you want to configure.

    cockpit network interfaces

  4. In the bridge settings screen, scroll down to the table of ports (interfaces).

    cockpit bridge remove interface

  5. Select the interface and click the - icon.

The RHEL 8 web console removes the interface from the bridge and you can see it back in the Networking section as standalone interface.

10.4. Deleting bridges in the web console

You can delete a software network bridge in the RHEL web console. All network interfaces included in the bridge will be changed automatically to standalone interfaces.

Prerequisites

  • Having a bridge in your system.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Open the Networking section.
  3. Click the bridge you want to configure.

    cockpit network interfaces

  4. In the bridge settings screen, scroll down to the table of ports.

    cockpit bridge remove interface

  5. Click Delete.

At this stage, go back to Networking and verify that all the network interfaces are displayed on the Interfaces tab. Interfaces which were part of the bridge can be inactive now. Therefore, you may need to activate them and set network parameters manually.

cockpit bridge delete settings

Chapter 11. Configuring VLANs in the web console

VLANs (Virtual LANs) are virtual networks created on a single physical Ethernet interface. Each VLAN is defined by an ID which represents a unique positive integer and works as a standalone interface.

Learn how to create VLANs in the RHEL web console.

Prerequisites

  • The RHEL 8 web console installed and enabled.

    For details, see Installing the web console.

  • Having a network interface in your system.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Open Networking.
  3. Click Add VLAN button.

    cockpit add vlan

  4. In the VLAN Settings dialog box, select the physical interface for which you want to create a VLAN.
  5. Enter the VLAN Id or just use the predefined number.
  6. In the Name field, you can see a predefined name consisted of the parent interface and VLAN Id. If it is not necessary, leave the name as it is.

    cockpit vlan settings

  7. Click Apply.

The new VLAN has been created and you need to click at the VLAN and configure the network settings.

cockpit vlans

Chapter 12. Configuring the web console listening port

Learn how to allow new ports or change the existing ports using the RHEL web console.

Prerequisites

12.1. Allowing a new port on a system with active SELinux

Enable the web console to listen on a selected port.

Prerequisites

Procedure

  • For ports that are not defined by any other part of SELinux, run:

    $ sudo semanage port -a -t websm_port_t -p tcp PORT_NUMBER
  • For ports that already are defined by other part of SELinux, run:

    $ sudo semanage port -m -t websm_port_t -p tcp PORT_NUMBER

The changes should take effect immediately.

12.2. Allowing a new port on a system with firewalld

Enable the web console to receive connections on a new port.

Prerequisites

  • The web console must be installed and accessible. For details, see Installing the web console.
  • The firewalld service must be running.

Procedure

  1. To add a new port number, run the following command:

    $ sudo firewall-cmd --permanent --service cockpit --add-port=PORT_NUMBER/tcp
  2. To remove the old port number from the cockpit service, run:

    $ sudo firewall-cmd --permanent --service cockpit --remove-port=OLD_PORT_NUMBER/tcp
Important

If you only run the firewall-cmd --service cockpit --add-port=PORT_NUMBER/tcp without the --permanent option, your change will be canceled with the next reload of firewalld or a system reboot.

12.3. Changing the web console port

Change default transmission control protocol (TCP) on port 9090 to a different one.

Prerequisites

Procedure

  1. Change the listening port with one of the following methods:

    1. Using the systemctl edit cockpit.socket command:

      1. Run the following command:

        $ sudo systemctl edit cockpit.socket

        This will open the /etc/systemd/system/cockpit.socket.d/override.conf file.

      2. Modify the content of override.conf or add a new content in the following format:

        [Socket]
        ListenStream=
        ListenStream=PORT_NUMBER
    2. Alternatively, add the above mentioned content to the /etc/systemd/system/cockpit.socket.d/listen.conf file.

      Create the cockpit.socket.d. directory and the listen.conf file if they do not exist yet.

  2. Run the following commands for changes to take effect:

    $ sudo systemctl daemon-reload
    $ sudo systemctl restart cockpit.socket

    If you used systemctl edit cockpit.socket in the previous step, running systemctl daemon-reload is not necessary.

Verification steps

  • To verify that the change was successful, try to connect to the web console with the new port.

Chapter 13. Managing firewall using the web console

A firewall is a way to protect machines from any unwanted traffic from outside. It enables users to control incoming network traffic on host machines by defining a set of firewall rules. These rules are used to sort the incoming traffic and either block it or allow through.

Prerequisites

13.1. Running firewall using the web console

This section describes where and how to run the RHEL 8 system firewall in the web console.

Note

The RHEL 8 web console configures the firewalld service.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Open the Networking section.
  3. In the Firewall section, click ON to run the firewall.

    cockpit fw

    If you do not see the Firewall box, log in to the web console with the administration privileges.

At this stage, your firewall is running.

To configure firewall rules, see Section 13.7, “Enabling services on the firewall using the web console”.

13.2. Stopping firewall using the web console

This section describes where and how to stop the RHEL 8 system firewall in the web console.

Note

The RHEL 8 web console configures the firewalld service.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Open the Networking section.
  3. In the Firewall section, click OFF to stop it.

    cockpit fw

    If you do not see the Firewall box, log in to the web console with the administration privileges.

At this stage, the firewall has been stopped and does not secure your system.

13.3. firewalld

firewalld is a firewall service daemon that provides a dynamic customizable host-based firewall with a D-Bus interface. Being dynamic, it enables creating, changing, and deleting the rules without the necessity to restart the firewall daemon each time the rules are changed.

firewalld uses the concepts of zones and services, that simplify the traffic management. Zones are predefined sets of rules. Network interfaces and sources can be assigned to a zone. The traffic allowed depends on the network your computer is connected to and the security level this network is assigned. Firewall services are predefined rules that cover all necessary settings to allow incoming traffic for a specific service and they apply within a zone.

Services use one or more ports or addresses for network communication. Firewalls filter communication based on ports. To allow network traffic for a service, its ports must be open. firewalld blocks all traffic on ports that are not explicitly set as open. Some zones, such as trusted, allow all traffic by default.

Additional resources

  • firewalld(1) man page

13.4. Zones

firewalld can be used to separate networks into different zones according to the level of trust that the user has decided to place on the interfaces and traffic within that network. A connection can only be part of one zone, but a zone can be used for many network connections.

NetworkManager notifies firewalld of the zone of an interface. You can assign zones to interfaces with:

  • NetworkManager
  • firewall-config tool
  • firewall-cmd command-line tool
  • The RHEL web console

The latter three can only edit the appropriate NetworkManager configuration files. If you change the zone of the interface using the web console, firewall-cmd or firewall-config, the request is forwarded to NetworkManager and is not handled by ⁠firewalld.

The predefined zones are stored in the /usr/lib/firewalld/zones/ directory and can be instantly applied to any available network interface. These files are copied to the /etc/firewalld/zones/ directory only after they are modified. The default settings of the predefined zones are as follows:

block
Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.
dmz
For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.
drop
Any incoming network packets are dropped without any notification. Only outgoing network connections are possible.
external
For use on external networks with masquerading enabled, especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.
home
For use at home when you mostly trust the other computers on the network. Only selected incoming connections are accepted.
internal
For use on internal networks when you mostly trust the other computers on the network. Only selected incoming connections are accepted.
public
For use in public areas where you do not trust other computers on the network. Only selected incoming connections are accepted.
trusted
All network connections are accepted.
work
For use at work where you mostly trust the other computers on the network. Only selected incoming connections are accepted.

One of these zones is set as the default zone. When interface connections are added to NetworkManager, they are assigned to the default zone. On installation, the default zone in firewalld is set to be the public zone. The default zone can be changed.

Note

The network zone names should be self-explanatory and to allow users to quickly make a reasonable decision. To avoid any security problems, review the default zone configuration and disable any unnecessary services according to your needs and risk assessments.

Additional resources

  • firewalld.zone(5) man page

13.5. Zones in the web console

Important

Firewall zones are new in the RHEL 8.1.0 Beta.

The Red Hat Enterprise Linux web console implements major features of the firewalld service and enables you to:

  • Add predefined firewall zones to a particular interface or range of IP addresses
  • Configure zones with selecting services into the list of enabled services
  • Disable a service by removing this service from the list of enabled service
  • Remove a zone from an interface

13.6. Enabling zones using the web console

The web console enables you to apply predefined and existing firewall zones on a particular interface or a range of IP addresses. This section describes how to enable a zone on an interface.

Prerequisites

Procedure

  1. Log in to the RHEL web console with administration privileges.

    For details, see Logging in to the web console.

  2. Click Networking.
  3. Click on the Firewall box title.

    cockpit fw

    If you do not see the Firewall box, log in to the web console with the administrator privileges.

  4. In the Firewall section, click Add Services.
  5. Click on the Add Zone button.
  6. In the Add Zone dialog box, select a zone from the Trust level scale.

    You can see here all zones predefined in the firewalld service.

  7. In the Interfaces part, select an interface or interfaces on which the selected zone is applied.
  8. In the Allowed Addresses part, you can select whether the zone is applied on:

    • the whole subnet
    • or a range of IP addresses in the following format:

      • 192.168.1.0
      • 192.168.1.0/24
      • 192.168.1.0/24, 192.168.1.0
  9. Click on the Add zone button.

    cockpit fw zones add

Verify the configuration in Active zones.

cockpit fw zones active

13.7. Enabling services on the firewall using the web console

By default, services are added to the default firewall zone. If you use more firewall zones on more network interfaces, you must select a zone first and then add the service with port.

The RHEL 8 web console displays predefined firewalld services and you can add them to active firewall zones.

Important

The RHEL 8 web console configures the firewalld service.

The web console does not allow generic firewalld rules which are not listed in the web console.

Prerequisites

Procedure

  1. Log in to the RHEL web console with administrator privileges.

    For details, see Logging in to the web console.

  2. Click Networking.
  3. Click on the Firewall box title.

    cockpit fw

    If you do not see the Firewall box, log in to the web console with the administrator privileges.

  4. In the Firewall section, click Add Services.

    cockpit add service

  5. In the Add Services dialog box, select a zone for which you want to add the service.

    The Add Services dialog box includes a list of active firewall zones only if the system includes multiple active zones.

    If the system uses just one (the default) zone, the dialog does not include zone settings.

  6. In the Add Services dialog box, find the service you want to enable on the firewall.
  7. Enable desired services.

    cockpit fw add jabber

  8. Click Add Services.

At this point, the RHEL 8 web console displays the service in the list of Allowed Services.

13.8. Configuring custom ports using the web console

The web console allows you to add:

This section describes how to add services with custom ports configured.

Prerequisites

Procedure

  1. Log in to the RHEL web console with administrator privileges.

    For details, see Logging in to the web console.

  2. Click Networking.
  3. Click on the Firewall box title.

    cockpit fw

    If you do not see the Firewall box, log in to the web console with the administration privileges.

  4. In the Firewall section, click Add Services.

    cockpit add service

  5. In the Add Services dialog box, select a zone for which you want to add the service.

    The Add Services dialog box includes a list of active firewall zones only if the system includes multiple active zones.

    If the system uses just one (the default) zone, the dialog does not include zone settings.

  6. In the Add Ports dialog box, click on the Custom Ports radio button.
  7. In the TCP and UDP fields, add ports according to examples. You can add ports in the following formats:

    • Port numbers such as 22
    • Range of port numbers such as 5900-5910
    • Aliases such as nfs, rsync
    Note

    You can add multiple values into each field. Values must be separated with the comma and without the space, for example: 8080,8081,http

  8. After adding the port number in the TCP and/or UDP fields, verify the service name in the Name field.

    The Name field displays the name of the service for which is this port reserved. You can rewrite the name if you are sure that this port is free to use and no server needs to communicate on this port.

  9. In the Name field, add a name for the service including defined ports.
  10. Click on the Add Ports button.

    cockpit ports define

To verify the settings, go to the Firewall page and find the service in the list of Allowed Services.

cockpit ports http

13.9. Disabling zones using the web console

This section describes how to disable a firewall zone in your firewall configuration using the web console.

Prerequisites

Procedure

  1. Log in to the RHEL web console with administrator privileges.

    For details, see Logging in to the web console.

  2. Click Networking.
  3. Click on the Firewall box title.

    cockpit fw

    If you do not see the Firewall box, log in to the web console with the administrator privileges.

  4. On the Active zones table, click on the Delete icon at the zone you want to remove.

    cockpit fw zones remove

The zone is now disabled and the interface does not include opened services and ports which were configured in the zone.

Chapter 14. Applying a generated Ansible playbook

When troubleshooting issues with SELinux, the web console is able to generate a shell script or an Ansible playbook that you can then export and apply for more machines.

Prerequisites

Procedure

  1. Click SELinux.
  2. Click "View the automation script" on the upper right side.

    A window with the generated script opens. You can navigate between a shell script and an Ansible playbook generation options tab.

    cockpit ansible playbook generated

  3. Click the Copy to clipboard button to select the script or playbook and apply it.

As a result, you have an automation script that you can apply to more machines.

Additional resources

Chapter 15. Managing partitions using the web console

Learn how to manage file systems on RHEL 8 using the web console.

For details about the available file systems, see the Overview of available file systems.

15.1. Displaying partitions formatted with file systems in the web console

The Storage section in the web console displays all available file systems in the Filesystems table.

This section navigates you to get to the list of partitions formatted with file systems displayed in the web console.

Prerequisites

  • The cockpit-storaged package is installed on your system.
  • The web console must be installed and accessible.

    For details, see Installing the web console.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Click on the Storage tab.

In the Filesystems table, you can see all available partitions formatted with file systems, its name, size and how much space is available on each partition.

cockpit filesystems tab

15.2. Creating partitions in the web console

To create a new partition:

  • Use an existing partition table
  • Create a partition

cockpit partitions

Prerequisites

  • The cockpit-storaged package is installed on your system.
  • The web console must be installed and accessible.

    For details, see Installing the web console.

  • An unformatted volume connected to the system visible in the Other Devices table of the Storage tab.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Click the Storage tab.
  3. In the Other Devices table, click a volume in which you want to create the partition.
  4. In the Content section, click the Create Partition button.
  5. In the Create partition dialog box, select the size of the new partition.
  6. In the Erase drop down menu, select:

    • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
    • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk, but it is more secure. Use this option if the disk includes any data and you need to overwrite it.
  7. In the Type drop down menu, select a file system:

    • XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.
    • ext4 file system supports:

      • Logical volumes
      • Switching physical drives online without outage
      • Growing a file system
      • Shrinking a file system

    Additional option is to enable encryption of partition done by LUKS (Linux Unified Key Setup), which allows you to encrypt the volume with a passphrase.

  8. In the Name field, enter the logical volume name.
  9. In the Mounting drop down menu, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

  10. In the Mount Point field, add the mount path.
  11. Select Mount at boot.
  12. Click the Create partition button.

    cockpit partition creating

    Formatting can take several minutes depending on the volume size and which formatting options are selected.

    After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.

To verify that the partition has been successfully added, switch to the Storage tab and check the Filesystems table.

cockpit filesystems part

15.3. Deleting partitions in the web console

This paragraph is the procedure module introduction: a short description of the procedure.

Prerequisites

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Click on the Storage tab.
  3. In the Filesystems table, select a volume in which you want to delete the partition.
  4. In the Content section, click on the partition you want to delete.

    cockpit filesystem list

  5. The partition rolls down and you can click on the Delete button.

    cockpit partition delete

    The partition must not be mounted and used.

To verify that the partition has been successfully removed, switch to the Storage tab and check the Content table.

15.4. Mounting and unmounting file systems in the web console

To be able to use partitions on RHEL systems, you need to mount a filesystem on the partition as a device.

Note

You also can unmount a file system and the RHEL system will stop using it. Unmounting the file system enables you to delete, remove, or re-format devices.

Prerequisites

  • The cockpit-storaged package is installed on your system.
  • The web console must be installed and accessible.

    For details, see Installing the web console.

  • If you want to unmount a file system, ensure that the system does not use any file, service, or application stored in the partition.

Procedure

  1. Log in to the RHEL web console.

    For details, see Logging in to the web console.

  2. Click on the Storage tab.
  3. In the Filesystems table, select a volume in which you want to delete the partition.
  4. In the Content section, click on the partition whose file system you want to mount or unmount.
  5. Click on the Mount or Unmount button.

    cockpit partitions mount

At this point, the file system has been mounted or unmounted according to your action.

Chapter 16. Managing NFS mounts in the web console

The RHEL 8 web console enables you to mount remote directories using the Network File System (NFS) protocol.

NFS makes it possible to reach and mount remote directories located on the network and work with the files as if the directory was located on your physical drive.

Prerequisites

  • The RHEL 8 web console has been installed.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.
  • NFS server name or IP address.
  • Path to the directory on the remote server.

16.1. Connecting NFS mounts in the web console

Connect a remote directory to your file system using NFS.

Prerequisites

  • NFS server name or IP address.
  • Path to the directory on the remote server.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Storage.
  3. Click + in the NFS mounts section.

    cockpit nfs plus

  4. In the New NFS Mount dialog box, enter the server or IP address of the remote server.
  5. In the Path on Server field, enter the path to the directory you want to mount.
  6. In the Local Mount Point field, enter the path where you want to find the directory in your local system.
  7. Select Mount at boot. This ensures that the directory will be reachable also after the restart of the local system.
  8. Optionally, select Mount read only if you do not want to change the content.

    cockpit new nfs mount

  9. Click Add.

At this point, you can open the mounted directory and verify that the content is accessible.

cockpit nfs mounted

To troubleshoot the connection, you can adjust it with the Custom Mount Options.

16.2. Customizing NFS mount options in the web console

Edit an existing NFS mount and add custom mount options.

Custom mount options can help you to troubleshoot the connection or change parameters of the NFS mount such as changing timeout limits or configuring authentication.

Prerequisites

  • NFS mount added.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Storage.
  3. Click on the NFS mount you want to adjust.
  4. If the remote directory is mounted, click Unmount.

    The directory must not be mounted during the custom mount options configuration. Otherwise the web console does not save the configuration and this will cause an error.

    cockpit nfs unmount

  5. Click Edit.

    cockpit nfs edit

  6. In the NFS Mount dialog box, select Custom mount option.
  7. Enter mount options separated by a comma. For example:

    • nfsvers=4 — the NFS protocol version number
    • soft — type of recovery after an NFS request times out
    • sec=krb5 — files on the NFS server can be secured by Kerberos authentication. Both the NFS client and server have to support Kerberos authentication.

    cockpit nfs custom option

    For a complete list of the NFS mount options, enter man nfs in the command line.

  8. Click Apply.
  9. Click Mount.

Now you can open the mounted directory and verify that the content is accessible.

cockpit nfs mounted

Chapter 17. Managing Redundant Arrays of Independent Disks in the web console

Redundant Arrays of Independent Disks (RAID) represents a way how to arrange more disks into one storage. RAID protects data stored in the disks against disk failure.

RAID uses the following data distribution strategies:

  • Mirroring — data are copied to two different locations. If one disk fails, you have a copy and your data is not lost.
  • Striping — data are evenly distributed among disks.

Level of protection depends on the RAID level.

The RHEL web console supports the following RAID levels:

  • RAID 0 (Stripe)
  • RAID 1 (Mirror)
  • RAID 4 (Dedicated parity)
  • RAID 5 (Distributed parity)
  • RAID 6 (Double Distributed Parity)
  • RAID 10 (Stripe of Mirrors)

Before you can use disks in RAID, you need to:

  • Create a RAID.
  • Format it with file system.
  • Mount the RAID to the server.

Prerequisites

17.1. Creating RAID in the web console

Configure RAID in the RHEL 8 web console.

Prerequisites

  • Physical disks connected to the system. Each RAID level requires different amount of disks.

Procedure

  1. Open the RHEL 8 web console.
  2. Click Storage.
  3. Click the + icon in the RAID Devices box.

    cockpit raid add

  4. In the Create RAID Device dialog box, enter a name for a new RAID.
  5. In the RAID Level drop-down list, select a level of RAID you want to use.
  6. In the Chunk Size drop-down list, leave the predefined value as it is.

    The Chunk Size value specifies how large is each block for data writing. If the chunk size is 512 KiB, the system writes the first 512 KiB to the first disk, the second 512 KiB is written to the second disk, and the third chunk will be written to the third disk. If you have three disks in your RAID, the fourth 512 KiB will be written to the first disk again.

  7. Select disks you want to use for RAID.

    cockpit raid create

  8. Click Create.

In the Storage section, you can see the new RAID in the RAID devices box and format it.

cockpit raid created

Now you have the following options how to format and mount the new RAID in the web console:

17.2. Formatting RAID in the web console

Format the new software RAID device created in the RHEL 8 web interface.

Prerequisites

  • Physical disks are connected and visible by RHEL 8.
  • RAID is created.
  • Consider the file system which will be used for the RAID.
  • Consider creating of a partitioning table.

Procedure

  1. Open the RHEL 8 web console.
  2. Click Storage.
  3. In the RAID devices box, choose the RAID you want to format by clicking on it.
  4. In the RAID details screen, scroll down to the Content part.
  5. Click to the newly created RAID.

    cockpit raid unrecognized

  6. Click the Format button.
  7. In the Erase drop-down list, select:

    • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
    • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk. Use this option if the RAID includes any data and you need to rewrite it.
  8. In the Type drop-down list, select a XFS file system, if you do not have another strong preference.
  9. Enter a name of the file system.
  10. In the Mounting drop down list, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

  11. In the Mount Point field, add the mount path.
  12. Select Mount at boot. cockpit raid format
  13. Click the Format button.

    Formatting can take several minutes depending on the used formatting options and size of RAID.

    After successful finish, you can see the details of the formatted RAID on the Filesystem tab.

    cockpit raid formatted

  14. To use the RAID, click Mount.

At this point, the system uses mounted and formatted RAID.

17.3. Using the web console for creating a partition table on RAID

Format RAID with the partition table on the new software RAID device created in the RHEL 8 web interface.

RAID requires formatting as any other storage device. You have two options:

  • Format the RAID device without partitions
  • Create a partition table with partitions

Prerequisites

  • Physical disks are connected and visible by RHEL 8.
  • RAID is created.
  • Consider the file system used for the RAID.
  • Consider creating a partitioning table.

Procedure

  1. Open the RHEL 8 web console.
  2. Click Storage.
  3. In the RAID devices box, select the RAID you want to edit.
  4. In the RAID details screen, scroll down to the Content part.
  5. Click to the newly created RAID.

    cockpit raid unrecognized

  6. Click the Create partition table button.
  7. In the Erase drop-down list, select:

    • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
    • Overwrite existing data with zeros — the RHEL web console rewrites the whole RAID with zeros. This option is slower because the program has to go through the whole RAID. Use this option if RAID includes any data and you need to rewrite it.
  8. In the Partitioning drop-down list, select:

    • Compatible with modern system and hard disks > 2TB (GPT) — GUID Partition Table is a modern recommended partitioning system for large RAIDs with more than four partitions.
    • Compatible with all systems and devices (MBR) — Master Boot Record works with disks up to 2 TB in size. MBR also support four primary partitions max.

      cockpit raid partition table

  9. Click Format.

At this point, the partitioning table has been created and you can create partitions.

For creating partitions, see Using the web console for creating partitions on RAID.

17.4. Using the web console for creating partitions on RAID

Create a partition in the existing partition table.

Prerequisites

Procedure

  1. Open the RHEL 8 web console.
  2. Click Storage.
  3. In the RAID devices box, click to the RAID you want to edit.
  4. In the RAID details screen, scroll down to the Content part.
  5. Click to the newly created RAID.
  6. Click Create Partition.
  7. In the Create partition dialog box, set up the size of the first partition.
  8. In the Erase drop-down list, select:

    • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
    • Overwrite existing data with zeros — the RHEL web console rewrites the whole RAID with zeros. This option is slower because the program have to go through the whole RAID. Use this option if RAID includes any data and you need to rewrite it.
  9. In the Type drop-down list, select a XFS file system, if you do not have another strong preference.
  10. Enter any name for the file system. Do not use spaces in the name.
  11. In the Mounting drop down list, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

  12. In the Mount Point field, add the mount path.
  13. Select Mount at boot.
  14. Click Create partition.

    cockpit raid partition create

Formatting can take several minutes depending on used formatting options and size of RAID.

After successful finish, you can continue with creating other partitions.

At this point, the system uses mounted and formatted RAID.

17.5. Using the web console for creating a volume group on top of RAID

Build a volume group from software RAID.

Prerequisites

  • RAID device, which is not formatted and mounted.

Procedure

  1. Open the RHEL 8 web console.
  2. Click Storage.
  3. Click the + icon in the Volume Groups box.
  4. In the Create Volume Group dialog box, enter a name for the new volume group.
  5. In the Disks list, select a RAID device.

    If you do not see the RAID in the list, unmount the RAID from the system. The RAID device must not be used by the RHEL 8 system.

    cockpit raid vg

  6. Click Create.

The new volume group has been created and you can continue with creating a logical volume.

cockpit raid vg created

Chapter 18. Using the web console for configuring LVM logical volumes

Red Hat Enterprise Linux 8 supports the LVM logical volume manager. When you install a Red Hat Enterprise Linux 8, it will be installed on LVM automatically created during the installation.

cockpit lvm rhel

The screenshot shows you a clean installation of the RHEL 8 system with two logical volumes in the RHEL 8 web console automatically created during the installation.

To find out more about logical volumes, follow the sections describing:

Prerequisites

  • The RHEL 8 web console has been installed.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.
  • Physical drives, RAID devices, or any other type of block device from which you can create the logical volume.

18.1. Logical Volume Manager in the web console

The RHEL 8 web console provides a graphical interface to create LVM volume groups and logical volumes.

Volume groups create a layer between physical and logical volumes. It makes you possible to add or remove physical volumes without influencing logical volume itself. Volume groups appear as one drive with capacity consisting of capacities of all physical drives included in the group.

You can join physical drives into volume groups in the web console.

Logical volumes act as a single physical drive and it is built on top of a volume group in your system.

Main advantages of logical volumes are:

  • Better flexibility than the partitioning system used on your physical drive.
  • Ability to connect more physical drives into one volume.
  • Possibility of expanding (growing) or reducing (shrinking) capacity of the volume on-line, without restart.
  • Ability to create snapshots.

Additional resources

18.2. Creating volume groups in the web console

Create volume groups from one or more physical drives or other storage devices.

Logical volumes are created from volume groups. Each volume group can include multiple logical volumes.

For details, see Volume groups.

Prerequisites

  • Physical drives or other types of storage devices from which you want to create volume groups.

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Storage.
  3. Click the + icon in the Volume Groups box.

    cockpit adding volume groups

  4. In the Name field, enter a name of a group without spaces.
  5. Select the drives you want to combine to create the volume group.

    cockpit create volume group

    It might happen that you cannot see devices as you expected. The RHEL web console displays only unused block devices. Used devices means, for example:

    • Devices formatted with a file system
    • Physical volumes in another volume group
    • Physical volumes being a member of another software RAID device

      If you do not see the device, format it to be empty and unused.

  6. Click Create.

The web console adds the volume group in the Volume Groups section. After clicking the group, you can create logical volumes that are allocated from that volume group.

cockpit volume group

18.3. Creating logical volumes in the web console

Create LVM logical volumes.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Storage.
  3. Click the volume group in which you want to create logical volumes.
  4. Click Create new Logical Volume.
  5. In the Name field, enter a name for the new logical volume without spaces.
  6. In the Purpose drop down menu, select Block device for filesystems.

    This configuration enables you to create a logical volume with the maximum volume size which is equal to the sum of the capacities of all drives included in the volume group.

    cockpit lv block dev

  7. Define the size of the logical volume. Consider:

    • How much space the system using this logical volume will need.
    • How many logical volumes you want to create.

    You do not have to use the whole space. If necessary, you can grow the logical volume later.

    cockpit lv size

  8. Click Create.

To verify the settings, click your logical volume and check the details.

cockpit lv details

At this stage, the logical volume has been created and you need to create and mount a file system with the formatting process.

18.4. Formatting logical volumes in the web console

Logical volumes act as physical drives. To use them, you need to format them with a file system.

Warning

Formatting logical volumes will erase all data on the volume.

The file system you select determines the configuration parameters you can use for logical volumes. For example, some the XFS file system does not support shrinking volumes. For details, see Resizing logical volumes in the web console.

The following steps describe the procedure to format logical volumes.

Prerequisites

Procedure

  1. Log in to the RHEL web console.
  2. Click Storage.
  3. Click the volume group in which the logical volume is placed.
  4. Click the logical volume.
  5. Click on the Unrecognized Data tab.

    cockpit lv details

  6. Click Format.
  7. In the Erase drop down menu, select:

    • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
    • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program have to go through the whole disk. Use this option if the disk includes any data and you need to overwrite it.
  8. In the Type drop down menu, select a file system:

    • XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.

      XFS does not support reducing the size of a volume formatted with an XFS file system

    • ext4 file system supports:

      • Logical volumes
      • Switching physical drives online without outage
      • Growing a file system
      • Shrinking a file system

    You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.

  9. In the Name field, enter the logical volume name.
  10. In the Mounting drop down menu, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

  11. In the Mount Point field, add the mount path.
  12. Select Mount at boot.

    cockpit lv format

  13. Click Format.

    Formatting can take several minutes depending on the volume size and which formatting options are selected.

    After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.

    cockpit lv formatted

  14. To use the logical volume, click Mount.

At this point, the system can use mounted and formatted logical volume.

18.5. Resizing logical volumes in the web console

Learn how to extend or reduce logical volumes in the RHEL 8 web console.

Whether you can resize a logical volume depends on which file system you are using. Most file systems enable you to extend (grow) the volume online (without outage).

You can also reduce (shrink) the size of logical volumes, if the logical volume contains a file system which supports shrinking. It should be available, for example, in the ext3/ext4 file systems.

Warning

You cannot reduce volumes that contains GFS2 or XFS filesystem.

Prerequisites

  • Existing logical volume containing a file system which supports resizing logical volumes.

Procedure

The following steps provide the procedure for growing a logical volume without taking the volume offline:

  1. Log in to the RHEL web console.
  2. Click Storage.
  3. Click the volume group in which the logical volume is placed.
  4. Click the logical volume.
  5. On the Volume tab, click Grow.
  6. In the Grow Logical Volume dialog box, adjust volume space.

    cockpit lv grow

  7. Click Grow.

LVM grows the logical volume without system outage.

Chapter 19. Using the web console for configuring thin logical volumes

Thinly-provisioned logical volumes enable you to allocate more space for designated applications or servers than how much space logical volumes actually contain.

For details, see Thinly-provisioned logical volumes (thin volumes).

The following sections describe:

Prerequisites

  • The RHEL 8 web console has been installed.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.
  • Physical drives or other types of storage devices from which you want to create volume groups.

19.1. Creating pools for thin logical volumes in the web console

Create a pool for thinly provisioned volumes.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Storage.
  3. Click the volume group in which you want to create thin volumes.
  4. Click Create new Logical Volume.
  5. In the Name field, enter a name for the new pool of thin volumes without spaces.
  6. In the Purpose drop down menu, select Pool for thinly provisioned volumes. This configuration enables you to create the thin volume.

    cockpit lv thin pool add

  7. Define the size of the pool of thin volumes. Consider:

    • How many thin volumes you will need in this pool?
    • What is the expected size of each thin volume?

    You do not have to use the whole space. If necessary, you can grow the pool later.

    cockpit lv thin pool size

  8. Click Create.

    The pool for thin volumes has been created and you can add thin volumes.

19.2. Creating thin logical volumes in the web console

Create a thin logical volume in the pool. The pool can include multiple thin volumes and each thin volume can be as large as the pool for thin volumes itself.

Important

Using thin volumes requires regular checkup of actual free physical space of the logical volume.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Storage.
  3. Click the volume group in which you want to create thin volumes.
  4. Click the desired pool.
  5. Click Create Thin Volume.

    cockpit lv pool tab

  6. In the Create Thin Volume dialog box, enter a name for the thin volume without spaces.
  7. Define the size of the thin volume.

    cockpit lv thin size

  8. Click Create.

At this stage, the thin logical volume has been created and you need to format it.

19.3. Formatting logical volumes in the web console

Logical volumes act as physical drives. To use them, you need to format them with a file system.

Warning

Formatting logical volumes will erase all data on the volume.

The file system you select determines the configuration parameters you can use for logical volumes. For example, some the XFS file system does not support shrinking volumes. For details, see Resizing logical volumes in the web console.

The following steps describe the procedure to format logical volumes.

Prerequisites

Procedure

  1. Log in to the RHEL web console.
  2. Click Storage.
  3. Click the volume group in which the logical volume is placed.
  4. Click the logical volume.
  5. Click on the Unrecognized Data tab.

    cockpit lv details

  6. Click Format.
  7. In the Erase drop down menu, select:

    • Don’t overwrite existing data — the RHEL web console rewrites only the disk header. Advantage of this option is speed of formatting.
    • Overwrite existing data with zeros — the RHEL web console rewrites the whole disk with zeros. This option is slower because the program have to go through the whole disk. Use this option if the disk includes any data and you need to overwrite it.
  8. In the Type drop down menu, select a file system:

    • XFS file system supports large logical volumes, switching physical drives online without outage, and growing an existing file system. Leave this file system selected if you do not have a different strong preference.

      XFS does not support reducing the size of a volume formatted with an XFS file system

    • ext4 file system supports:

      • Logical volumes
      • Switching physical drives online without outage
      • Growing a file system
      • Shrinking a file system

    You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.

  9. In the Name field, enter the logical volume name.
  10. In the Mounting drop down menu, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

  11. In the Mount Point field, add the mount path.
  12. Select Mount at boot.

    cockpit lv format

  13. Click Format.

    Formatting can take several minutes depending on the volume size and which formatting options are selected.

    After the formatting has completed successfully, you can see the details of the formatted logical volume on the Filesystem tab.

    cockpit lv formatted

  14. To use the logical volume, click Mount.

At this point, the system can use mounted and formatted logical volume.

Chapter 20. Using the web console for changing physical drives in volume groups

Change the drive in a volume group using the RHEL 8 web console.

The change of physical drives consists of the following procedures:

Prerequisites

  • The RHEL 8 web console has been installed.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.
  • A new physical drive for replacing the old or broken one.
  • The configuration expects that physical drives are organized in a volume group.

20.1. Adding physical drives to volume groups in the web console

The RHEL 8 web console enables you to add a new physical drive or other type of volume to the existing logical volume.

Prerequisites

  • A volume group must be created.
  • A new drive connected to the machine.

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Storage.
  3. In the Volume Groups box, click the volume group in which you want to add a physical volume.
  4. In the Physical Volumes box, click the + icon.

    cockpit lv disk add

  5. In the Add Disks dialog box, select the preferred drive and click Add.

    cockpit lv disk selected

As a result, the RHEL 8 web console adds the physical volume. You can see it in the Physical Volumes section, and the logical volume can immediately start to write on the drive.

20.2. Removing physical drives from volume groups in the web console

If a logical volume includes multiple physical drives, you can remove one of the physical drives online.

The system moves automatically all data from the drive to be removed to other drives during the removal process. Notice that it can take some time.

The web console also verifies, if there is enough space for removing the physical drive.

Prerequisites

  • A volume group with more than one physical drive connected.

Procedure

The following steps describe how to remove a drive from the volume group without causing outage in the RHEL web console.

  1. Log in to the RHEL 8 web console.
  2. Click Storage.
  3. Click the volume group in which you have the logical volume.
  4. In the Physical Volumes section, locate the preferred volume.
  5. Click the - icon.

    The RHEL 8 web console verifies, if the logical volume has enough free space for removing the disk. If not, you cannot remove the disk and it is necessary to add another disk first. For details, see Adding physical drives to logical volumes in the web console.

    cockpit lv disk remove

As results, the RHEL 8 web console removes the physical volume from the created logical volume without causing an outage.

Chapter 21. Using the web console for managing Virtual Data Optimizer volumes

Configure the Virtual Data Optimizer (VDO) using the RHEL 8 web console.

You will learn how to:

  • Create VDO volumes
  • Format VDO volumes
  • Extend VDO volumes

Prerequisites

  • The RHEL 8 web console is installed and accessible.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.

21.1. VDO volumes in the web console

Red Hat Enterprise Linux 8 supports Virtual Data Optimizer (VDO).

VDO is a block virtualization technology that combines:

Compression
For details, see Enabling or disabling compression in VDO.
Deduplication
For details, see Enabling or disabling deduplication in VDO.
Thin provisioning
For details, see Thinly-provisioned logical volumes (thin volumes).

Using these technologies, VDO:

  • Saves storage space inline
  • Compresses files
  • Eliminates duplications
  • Enables you to allocate more virtual space than how much the physical or logical storage provides
  • Enables you to extend the virtual storage by growing

VDO can be created on top of many types of storage. In the RHEL 8 web console, you can configure VDO on top of:

  • LVM

    Note

    It is not possible to configure VDO on top of thinly-provisioned volumes.

  • Physical volume
  • Software RAID

For details about placement of VDO in the Storage Stack, see System Requirements.

Additional resources

21.2. Creating VDO volumes in the web console

Create a VDO volume in the RHEL web console.

Prerequisites

  • Physical drives, LVMs, or RAID from which you want to create VDO.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Storage.
  3. Click the + icon in the VDO Devices box.

    cockpit adding vdo

  4. In the Name field, enter a name of a VDO volume without spaces.
  5. Select the drive that you want to use.
  6. In the Logical Size bar, set up the size of the VDO volume. You can extend it more than ten times, but consider for what purpose you are creating the VDO volume:

    • For active VMs or container storage, use logical size that is ten times the physical size of the volume.
    • For object storage, use logical size that is three times the physical size of the volume.

    For details, see Deploying VDO.

  7. In the Index Memory bar, allocate memory for the VDO volume.

    For details about VDO system requirements, see System Requirements.

  8. Select the Compression option. This option can efficiently reduce various file formats.

    For details, see Enabling or disabling compression in VDO.

  9. Select the Deduplication option.

    This option reduces the consumption of storage resources by eliminating multiple copies of duplicate blocks. For details, see Enabling or disabling deduplication in VDO.

  10. [Optional] If you want to use the VDO volume with applications that need a 512 bytes block size, select Use 512 Byte emulation. This reduces the performance of the VDO volume, but should be very rarely needed. If in doubt, leave it off.
  11. Click Create.

    cockpit create vdo dialog

If the process of creating the VDO volume succeeds, you can see the new VDO volume in the Storage section and format it with a file system.

cockpit vdo created

21.3. Formatting VDO volumes in the web console

VDO volumes act as physical drives. To use them, you need to format them with a file system.

Warning

Formatting VDO will erase all data on the volume.

The following steps describe the procedure to format VDO volumes.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Storage.
  3. Click the VDO volume.
  4. Click on the Unrecognized Data tab.
  5. Click Format.

    cockpit vdo format

  6. In the Erase drop down menu, select:

    Don’t overwrite existing data
    The RHEL web console rewrites only the disk header. The advantage of this option is the speed of formatting.
    Overwrite existing data with zeros
    The RHEL web console rewrites the whole disk with zeros. This option is slower because the program has to go through the whole disk. Use this option if the disk includes any data and you need to rewrite them.
  7. In the Type drop down menu, select a filesystem:

    • The XFS file system supports large logical volumes, switching physical drives online without outage, and growing. Leave this file system selected if you do not have a different strong preference.

      XFS does not support shrinking volumes. Therefore, you will not be able to reduce volume formatted with XFS.

    • The ext4 file system supports logical volumes, switching physical drives online without outage, growing, and shrinking.

    You can also select a version with the LUKS (Linux Unified Key Setup) encryption, which allows you to encrypt the volume with a passphrase.

  8. In the Name field, enter the logical volume name.
  9. In the Mounting drop down menu, select Custom.

    The Default option does not ensure that the file system will be mounted on the next boot.

  10. In the Mount Point field, add the mount path.
  11. Select Mount at boot.

    cockpit lv format

  12. Click Format.

    Formatting can take several minutes depending on the used formatting options and the volume size.

    After a successful finish, you can see the details of the formatted VDO volume on the Filesystem tab.

    cockpit vdo formatted

  13. To use the VDO volume, click Mount.

At this point, the system uses the mounted and formatted VDO volume.

21.4. Extending VDO volumes in the web console

Extend VDO volumes in the RHEL 8 web console.

Prerequisites

  • The cockpit-storaged package is installed on your system.
  • The VDO volume created.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Storage.
  3. Click your VDO volume in the VDO Devices box.

    cockpit vdo created

  4. In the VDO volume details, click the Grow button.
  5. In the Grow logical size of VDO dialog box, extend the logical size of the VDO volume.

    cockpit vdo grow done

    Original size of the logical volume from the screenshot was 6 GB. As you can see, the RHEL web console enables you to grow the volume to more than ten times the size and it works correctly because of the compression and deduplication.

  6. Click Grow.

If the process of growing VDO succeeds, you can see the new size in the VDO volume details.

cockpit vdo grow details

Chapter 22. Locking data with LUKS password in the RHEL web console

In the web console’s Storage tab, you can now create, lock, unlock, resize, and otherwise configure encrypted devices using the LUKS (Linux Unified Key Setup) version 2 format.

This new version of LUKS offers:

  • More flexible unlocking policies
  • Stronger cryptography
  • Better compatibility with future changes

Prerequisites

  • The RHEL 8 web console has been installed.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.

22.1. LUKS disk encryption

The Linux Unified Key Setup-on-disk-format (LUKS) enables you to encrypt block devices and it provides a set of tools that simplifies managing the encrypted devices. LUKS allows multiple user keys to decrypt a master key, which is used for the bulk encryption of the partition.

RHEL utilizes LUKS to perform block device encryption. By default, the option to encrypt the block device is unchecked during the installation. If you select the option to encrypt your disk, the system prompts you for a passphrase every time you boot the computer. This passphrase “unlocks” the bulk encryption key that decrypts your partition. If you choose to modify the default partition table, you can choose which partitions you want to encrypt. This is set in the partition table settings.

What LUKS does

  • LUKS encrypts entire block devices and is therefore well-suited for protecting contents of mobile devices such as removable storage media or laptop disk drives.
  • The underlying contents of the encrypted block device are arbitrary, which makes it useful for encrypting swap devices. This can also be useful with certain databases that use specially formatted block devices for data storage.
  • LUKS uses the existing device mapper kernel subsystem.
  • LUKS provides passphrase strengthening which protects against dictionary attacks.
  • LUKS devices contain multiple key slots, allowing users to add backup keys or passphrases.

What LUKS does not do

  • Disk-encryption solutions like LUKS protect the data only when your system is off. Once the system is on and LUKS has decrypted the disk, the files on that disk are available to anyone who would normally have access to them.
  • LUKS is not well-suited for scenarios that require many users to have distinct access keys to the same device. The LUKS1 format provides eight key slots, LUKS2 up to 32 key slots.
  • LUKS is not well-suited for applications requiring file-level encryption.

Ciphers

The default cipher used for LUKS is aes-xts-plain64. The default key size for LUKS is 512 bits. The default key size for LUKS with Anaconda (XTS mode) is 512 bits. Ciphers that are available are:

  • AES - Advanced Encryption Standard - FIPS PUB 197
  • Twofish (a 128-bit block cipher)
  • Serpent

22.2. Configuring the LUKS passphrase in the web console

If you want to add encryption to an existing logical volume on your system, you can only do so through formatting the volume.

Prerequisites

  • The web console must be installed and accessible.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.
  • Available existing logical volume without encryption.

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Storage.
  3. Select the storage device you want to format.
  4. Click the menu icon and select Format option.
  5. Select the Encrypt data box to activate encryption on your storage device.

    cockpit encryption

  6. Set and confirm your new passphrase.
  7. [Optional] Modify further encryption options.
  8. Finalize formatting settings.
  9. Click Format.

22.3. Changing the LUKS passphrase in the web console

Change a LUKS passphrase on an encrypted disk or partition in the web console.

Prerequisites

  • The web console must be installed and accessible.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.

Procedure

  1. Log in to the web console.

    For details, see Logging in to the web console.

  2. Click Storage
  3. In the Drives table, select the disk with encrypted data.
  4. In Content, select the encrypted partition.
  5. Click Encryption.
  6. In the Keys table, click the pen icon.

    cockpit luks change

  7. In the Change passphrase dialog window:

    1. Enter your current passphrase.
    2. Enter your new passphrase.
    3. Confirm your new passphrase.

      cockpit change passphrase menu

  8. Click Save

Chapter 23. Configuring automated unlocking using a Tang key in the web console

Configure automated unlocking of a LUKS-encrypted storage device using a key provided by a Tang server.

Prerequisites

  • The RHEL 8 web console has been installed.

    For details, see Installing the web console.

  • The cockpit-storaged package is installed on your system.
  • The cockpit.socket service is running at port 9090.
  • The clevis, tang, and clevis-dracut packages are installed.
  • A Tang server is running.

Procedure

  1. Open the RHEL web console by entering the following address in a web browser:

    https://localhost:9090

    Replace the localhost part by the remote server’s host name or IP address when you connect to a remote system.

  2. Provide your credentials and click Storage. Select an encrypted device and click Encryption in the Content part:
  3. Click + in the Keys section to add a Tang key:

    RHEL web console: Encryption
  4. Provide the address of your Tang server and a password that unlocks the LUKS-encrypted device. Click Add to confirm:

    RHEL web console: Add Tang key
  5. The following dialog window provides a command to verify that the key hash matches. RHEL 8.2 introduced the tang-show-keys script, and you can obtain the key hash using the following command on the Tang server running on the port 7500:

    # tang-show-keys 7500
    3ZWS6-cDrCG61UPJS2BMmPU4I54

    On RHEL 8.1 and earlier, obtain the key hash using the following command:

    # curl -s localhost:7500/adv | jose fmt -j- -g payload -y -o- | jose jwk use -i- -r -u verify -o- | jose jwk thp -i-
    3ZWS6-cDrCG61UPJS2BMmPU4I54
  6. Click Trust key when the key hashes in the web console and in the output of previously listed commands are the same:

    RHEL web console: Verify Tang key
  7. To enable the early boot system to process the disk binding, click Terminal at the bottom of the left navigation bar and enter the following commands:

    # yum install clevis-dracut
    # dracut -fv --regenerate-all

Verification steps

  1. Check that the newly added Tang key is now listed in the Keys section with the Keyserver type:

    RHEL web console: A keyserver key is listed
  2. Verify that the bindings are available for the early boot, for example:

    # lsinitrd | grep clevis
    clevis
    clevis-pin-sss
    clevis-pin-tang
    clevis-pin-tpm2
    -rwxr-xr-x   1 root     root         1600 Feb 11 16:30 usr/bin/clevis
    -rwxr-xr-x   1 root     root         1654 Feb 11 16:30 usr/bin/clevis-decrypt
    ...
    -rwxr-xr-x   2 root     root           45 Feb 11 16:30 usr/lib/dracut/hooks/initqueue/settled/60-clevis-hook.sh
    -rwxr-xr-x   1 root     root         2257 Feb 11 16:30 usr/libexec/clevis-luks-askpass

Additional resources

Chapter 24. Managing software updates in the web console

Lear how to manage software updates in the RHEL 8 web console and ways to automate them.

The Software Updates module in the web console is based on the yum utility. For more information about updating sofware with yum, see the Checking for updates and updating packages section.

24.1. Managing manual software updates in the web console

This section describes how to manually update your software using the web console.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Software Updates.

    The list of available updates refreshes automatically if the last check happened more than 24 hours ago. To trigger a refresh, click the Check for Updates button.

  3. Apply updates.

    1. To install all available updates, click the Install all updates button.

      cockpit install all updates

    2. If you have security updates available, you can install them separately by clicking the Install Security Updates button.

      cockpit install security updates

      You can watch the update log while the update is running.

  4. After the system applies updates, you get a recommendation to restart your system.

    We recommend this especially if the update included a new kernel or system services that you do not want to restart individually.

  5. Click Ignore to cancel the restart, or Restart Now to proceed with restarting your system.

    After the system restart, log in to the web console and go to the Software Updates page to verify that the update has been successful.

24.2. Managing automatic software updates in the web console

In the web console, you can choose to apply all updates, or security updates and also manage periodicity and time of your automatic updates.

Prerequisites

Procedure

  1. Log in to RHEL 8 web console.

    For details, see Logging in to the web console.

  2. Click Software Updates.
  3. If you want to automatically apply only security updates, click on the Apply all updates drop-down menu and select Apply security updates.
  4. To modify day of the automatic update, click on the every day drop-down menu and select a specific day.
  5. To modify time of the automatic update, click on the 6:00 drop-down menu and select a specific time.

    cockpit automatic updates

  6. If you want to disable automatic software updates, click on switch next to Automatic Updates to move it to disabled position.

    cockpit disabled auto updates

Chapter 25. Managing subscriptions in the web console

Manage your subscription for Red Hat Enterprise Linux 8 from the web console.

To get a subscription for your Red Hat Enterprise Linux, you need to have an account in the Red Hat Customer Portal or an activation key.

This chapter covers:

  • Subscription management in the RHEL 8 web console.
  • Registering subscriptions for your system in the web console with the Red Hat user name and password.
  • Registering subscriptions with the activation key.

Prerequisites

  • Purchased subscriptions.
  • The system subjected to subscription has to be connected to the Internet because the web console needs to communicate with the Red Hat Customer Portal.

25.1. Subscription management in the web console

The RHEL 8 web console provides an interface for using Red Hat Subscription Manager installed on your local system.

The Subscription Manager connects to the Red Hat Customer Portal and verifies all available:

  • Active subscriptions
  • Expired subscriptions
  • Renewed subscriptions

If you want to renew the subscription or get a different one in Red Hat Customer Portal, you do not have to update the Subscription Manager data manually. The Subscription Manager synchronizes data with Red Hat Customer Portal automatically.

25.2. Registering subscriptions with credentials in the web console

Use the following steps to register a newly installed Red Hat Enterprise Linux using the RHEL 8 web console.

Prerequisites

  • A valid user account on the Red Hat Customer Portal.

    See the Create a Red Hat Login page.

  • Active subscription for your RHEL system.

Procedure

  1. Type subscription in the search field and press the Enter key.

    cockpit subscription icon

    Alternatively, you can log in to the RHEL 8 web console. For details, see Logging in to the web console.

  2. In the polkit authentication dialog for privileged tasks, add the password belonging to the user name displayed in the dialog.

    cockpit subscription password

  3. Click Authenticate.
  4. In the Subscriptions dialog box, click Register.

    cockpit subscription notregistered

  5. Enter your Customer Portal credentials.

    cockpit subscription register cred

  6. Enter the name of your organization.

    If you have more than one account on the Red Hat Customer Portal, you have to add the organization name or organization ID. To get the org ID, go to your Red Hat contact point.

  7. Click the Register button.

At this point, your Red Hat Enterprise Linux 8 system has been successfully registered.

cockpit subscription registered

25.3. Registering subscriptions with activation keys in the web console

To register a subscription for Red Hat Enterprise Linux,

Prerequisites

  • If you do not have a user account in the portal, your vendor provides you with the activation key.

Procedure

  1. Type subscription in the search field and press the Enter key.

    cockpit subscription icon

    Alternatively, you can log in to the RHEL 8 web console. For details, see Logging in to the web console.

  2. In the authentication dialog, add the system username and password you created during the system installation.

    cockpit subscription password

  3. Click Authenticate.
  4. In the Subscriptions dialog box, click Register.

    cockpit subscription notregistered

  5. Enter the activation key in the registration form.
  6. Enter the name of your organization.

    You need to add the organization name or organization ID, if you have more than one account in the Red Hat Customer Portal.

    To get the org ID, go to your Red Hat contact point.

    cockpit subscription register key

  7. Click the Register button.

At this point, your RHEL 8 system has been successfully registered.

cockpit subscription registered

Chapter 26. Configuring kdump in the web console

Setup and test the kdump configuration in the RHEL 8 web console.

The web console is part of a default installation of Red Hat Enterprise Linux 8 and enables or disables the kdump service at boot time. Further, the web console conveniently enables you to configure the reserved memory for kdump; or to select the vmcore saving location in an uncompressed or compressed format.

Prerequisites

26.1. Configuring kdump memory usage and target location in web console

The procedure below shows you how to use the Kernel Dump tab in the Red Hat Enterprise Linux web console interface to configure the amount of memory that is reserved for the kdump kernel. The procedure also describes how to specify the target location of the vmcore dump file and how to test your configuration.

Prerequisites

Procedure

  1. Open the Kernel Dump tab and start the kdump service.
  2. Configure the kdump memory usage through the command line.
  3. Click the link next to the Crash dump location option.

    web console initial screen
  4. Select the Local Filesystem option from the drop-down and specify the directory you want to save the dump in.

    web console crashdump target
    • Alternatively, select the Remote over SSH option from the drop-down to send the vmcore to a remote machine using the SSH protocol.

      Fill the Server, ssh key, and Directory fields with the remote machine address, ssh key location, and a target directory.

    • Another choice is to select the Remote over NFS option from the drop-down and fill the Mount field to send the vmcore to a remote machine using the NFS protocol.

      Note

      Tick the Compression check box to reduce the size of the vmcore file.

  5. Test your configuration by crashing the kernel.

    web console test kdump config
    Warning

    This step disrupts execution of the kernel and results in a system crash and loss of data.

Additional resources

Chapter 27. Managing virtual machines in the web console

Manage your virtual machines in a RHEL 8 web console and learn about the virtualization management capabilities.

To manage virtual machines in a graphical interface on a RHEL 8 host, you can use the Virtual Machines pane in the RHEL 8 web console.

web console overview

27.1. Overview of virtual machine management using the web console

The RHEL 8 web console is a web-based interface for system administration. As one of its features, the web console provides a graphical view of virtual machines (VMs) on the host system, and makes it possible to create, access, and configure these VMs.

Note that to use the web console to manage your VMs on RHEL 8, you must first install a web console plug-in for virtualization.

Next steps

27.2. Setting up the web console to manage virtual machines

Before using the RHEL 8 web console to manage virtual machines (VMs), you must install the web console virtual machine plug-in on the host.

Prerequisites

  • Ensure that the web console is installed and enabled on your machine.

    # systemctl status cockpit.socket
    cockpit.socket - Cockpit Web Service Socket
    Loaded: loaded (/usr/lib/systemd/system/cockpit.socket
    [...]

    If this command returns Unit cockpit.socket could not be found, follow the Installing the web console document to enable the web console.

Procedure

  • Install the cockpit-machines plug-in.

    # yum install cockpit-machines

Verification

  • If the installation is successful, Virtual Machines appears in the web console side menu.

    cockpit vms info

Additional resources

27.3. Virtual machine management features available in the web console

Using the RHEL 8 web console, you can perform the following actions to manage the virtual machines (VMs) on your system.

Table 27.1. VM tasks that can be performed in the RHEL 8 web console

TaskFor details, see:

Create a VM and install it with a guest operating system

Creating virtual machines and installing guest operating systems using the web console

Delete a VM.

Deleting virtual machines using the web console.

Start, shut down, and restart the VM

Starting virtual machines using the web console and Shutting down and restarting virtual machines using the web console

Connect to and interact with a VM using a variety of consoles

Interacting with virtual machines using the web console

View a variety of information about the VM

Viewing virtual machine information using the web console

Adjust the host memory allocated to a VM

Adding and removing virtual machine memory using the web console

Manage network connections for the VM

Using the web console for managing virtual machine network interfaces

Manage the VM storage available on the host and attach virtual disks to the VM

Managing storage for virtual machines using the web console

Configure the virtual CPU settings of the VM

Managing virtual CPUs using the web console

27.4. Differences between virtualization features in Virtual Machine Manager and the web console

The Virtual Machine Manager (virt-manager) application is supported in RHEL 8, but has been deprecated. The web console is intended to become its replacement in a subsequent major release. It is, therefore, recommended that you get familiar with the web console for managing virtualization in a GUI.

However, in RHEL 8, some VM management tasks can only be performed in virt-manager or the command line. The following table highlights the features that are available in virt-manager but not available in the RHEL 8.0 web console.

If a feature is available in a later minor version of RHEL 8, the minimum RHEL 8 version appears in the Support in web console introduced column.

Table 27.2. VM managemennt tasks that cannot be performed using the web console in RHEL 8.0

TaskSupport in web console introducedAlternative method using CLI

Setting a virtual machine to start when the host boots

RHEL 8.1

virsh autostart

Suspending a virtual machine

RHEL 8.1

virsh suspend

Resuming a suspended virtual machine

RHEL 8.1

virsh resume

Creating file-system directory storage pools

RHEL 8.1

virsh pool-define-as

Creating NFS storage pools

RHEL 8.1

virsh pool-define-as

Creating physical disk device storage pools

RHEL 8.1

virsh pool-define-as

Creating LVM volume group storage pools

RHEL 8.1

virsh pool-define-as

Creating partition-based storage pools

CURRENTLY UNAVAILABLE

virsh pool-define-as

Creating GlusterFS-based storage pools

CURRENTLY UNAVAILABLE

virsh pool-define-as

Creating vHBA-based storage pools with SCSI devices

CURRENTLY UNAVAILABLE

virsh pool-define-as

Creating Multipath-based storage pools

CURRENTLY UNAVAILABLE

virsh pool-define-as

Creating RBD-based storage pools

CURRENTLY UNAVAILABLE

virsh pool-define-as

Creating a new storage volume

RHEL 8.1

virsh vol-create

Adding a new virtual network

RHEL 8.1

virsh net-create or virsh net-define

Deleting a virtual network

RHEL 8.1

virsh net-undefine

Creating a bridge from a host machine’s interface to a virtual machine

CURRENTLY UNAVAILABLE

virsh iface-bridge

Creating a snapshot

CURRENTLY UNAVAILABLE

virsh snapshot-create-as

Reverting to a snapshot

CURRENTLY UNAVAILABLE

virsh snapshot-revert

Deleting a snapshot

CURRENTLY UNAVAILABLE

virsh snapshot-delete

Cloning a virtual machine

CURRENTLY UNAVAILABLE

virt-clone

Migrating a virtual machine to another host machine

CURRENTLY UNAVAILABLE

virsh migrate

Additional resources

Chapter 28. Managing remote systems in the web console

Connect to the remote systems and manage them in the RHEL 8 web console.

The following chapter describes:

  • The optimal topology of connected systems.
  • What is the Dashboard.
  • How to add and remove remote systems.
  • When, why and how to use SSH keys to for remote system authentication.

Prerequisites

  • Opened the SSH service on remote systems.

28.1. Remote system manager in the web console

Using the RHEL 8 web console to manage remote systems in the network requires considering the topology of connected servers.

For optimal security, Red Hat recommends the following connection setup:

  • Use one system with the web console as a bastion host. The bastion host is a system with opened HTTPS port.
  • All other systems communicate through SSH.

With the web interface running on the bastion host, you can reach all other systems through the SSH protocol using port 22 in the default configuration.

RHEL Cockpit ManagingSystems 484190 0119

28.2. Adding remote hosts to the web console

This section helps you to connect other systems with a user name and password to the Dashboard located in the web console.

The Dashboard is a tool designed for remote server management, where you can add, connect, or remove remote systems.

The Dashboard displays graphs and status for each of the remote systems.

You can add up to 20 remote systems in the Dashboard.

cockpit dashboard

Prerequisites

  • The cockpit-dashboard package installed in the system where the web interface is running:

    $ sudo yum install cockpit-dashboard

    The cockpit-dashboard package extends the RHEL 8 web console with the remote system management.

  • You need to be logged into the web console with administration privileges.

    For details, see Logging in to the web console.

Procedure

  1. In the RHEL 8 web console, go to Dashboard.
  2. In the Dashboard, click the Add Server icon.

    cockpit add server icon

  3. In the Add Machine to Dashboard dialog box, enter the host name or IP address of the remote system.
  4. (Optional) Click the Color field to change the color of the system in Dashboard.
  5. Click Add.
  6. In the Log in to <servername> dialog box, enter the credentials for the remote system.

    You can use any user account of the remote system. Howerver, if you use credetials of a user account without administration privileges, you will not be able to perform administration tasks.

    If you use the same credentials as for your local system, the web console will authenticate remote systems automatically every time you log in. However, using the same credentials on more machines could be a potential security risk.

    cockpit add server passwd

  7. Click Log In.

If the login succeeds the Dashboard adds a new item in the list. To verify the connection, click the system to see all the details in the web console.

Note

The web console does not save passwords used to log in to remote systems which means that you have to log in again after each system restart. To open the login dialog, click the Troubleshoot button placed on the main screen of the disconnected remote system.

cockpit cannot connect screen

28.3. Removing remote hosts from the web console

This section guides you on removing other systems from a dashboard located in the web console.

Prerequisites

Procedure

  1. Log in to the RHEL 8 web console.
  2. Click Dashboard.
  3. Click the Edit Server icon.

    cockpit edit server icon

  4. To remove the server from the Dashboard, click the red Remove icon.

    cockpit remove server

As a result, the server is removed from Dashboard.

28.4. Setting up SSH for remote management in the web console

The RHEL 8 web console supports authentication with SSH keys. This has the following advantages:

  • Increasing security of the communication between servers.
  • Avoiding entering credentials repeatedly.
Important

Using SSH keys works only for read only access or for password-less sudo because the authentication happens without a password. To perform administrative tasks, use your system account credentials with administrative privileges.

To configure authentication with SSH keys in the web console:

  • Copy the public key into the connected remote system.
  • Set the path to the private key in the system, on which the RHEL 8 web console is running.
  • Log out from the web console and log in again to ensure the authentication change.

Prerequisites

  • SSH key stored in the system with running web console. If you do not have any, use the following command:

    $ ssh-keygen
  • Password to the generated SSH key.
  • The contents of the ~/.ssh/id_rsa.pub file copied in the clipboard.

Procedure

To copy the public SSH key into a remote system:

  1. Open the web console.
  2. Click Dashboard.
  3. Select the remote system where you want to add the public key.
  4. In the system settings, go to Accounts.
  5. Select the user account to which you want to assign the public key.
  6. In the Authorized Public SSH Keys settings, click the + button.

    cockpit account

  7. In the Add public key dialog box, paste the public key you have in the clipboard.
  8. Click Add key.

At this point, you can see the new public key assigned to the user account.

cockpit ssh pub key

To set the path to the private SSH key:

  1. Go to upper right corner settings.
  2. In the drop down menu, select Authentication.

    cockpit ssh auth

  3. Verify that the web console uses the correct path to the private key you want to use.

    By default, the web console uses the following paths for private keys:

    ~/.ssh/id_rsa
    ~/.ssh/id_dsa
    ~/.ssh/id_ed25519
    ~/.ssh/id_ecdsa

    To use a different key, add the path manually.

  4. Enable the key with the On/Off button.

    Enabling the key opens a password dialog.

  5. Enter the SSH key password.

    cockpit add key password

  6. Click Unlock Key.

    On Details tab, you can verify the certificate owner and the fingerprint.

  7. Click Close.

The RHEL 8 web console uses now SSH keys on both sides. However, systems still use the original credentials.

To change the authentication settings:

  1. Log out yourself from the web console.

    After the logging back in the web console, red triangle icon appears before the remote system.

  2. Click the system trying to connect to the web console.

    You can see two buttons in the screen. Reconnect and Troubleshoot.

  3. Click the Troubleshoot button.

    Login dialog appears.

    cockpit add server using available credentials

  4. In the Authentication drop down menu, select Using available credentials.

The web console creates a new connection secured with SSH keys. It works for the web console login as well as for a terminal access.

Chapter 29. Configuring Single Sign-On for the RHEL 8 web console in the IdM domain

Learn how to use Single Sign-on (SSO) authentication provided by Identity Management (IdM) in the RHEL 8 web console.

Advantages:

  • IdM domain administrators can use the RHEL 8 web console to manage local machines.
  • Users with a Kerberos ticket in the IdM domain do not need to provide login credentials to access the web console.
  • All hosts known to the IdM domain are accessible via SSH from the local instance of the RHEL 8 web console.
  • Certificate configuration is not necessary. The console’s web server automatically switches to a certificate issued by the IdM certificate authority and accepted by browsers.

This chapter covers the following steps to configure SSO for logging into the the RHEL web console:

  1. Add machines to the IdM domain using the RHEL 8 web console.

    For details, see Section 29.1, “Joining a RHEL 8 system to an IdM domain using the web console”.

  2. If you want to use Kerberos for authentication, you need to obtain a Kerberos ticket on your machine.

    For details, see Section 29.2, “Logging in to the web console using Kerberos authentication”.

  3. Allow administrators on the IdM master server to run any command on any host.

    For details, see Section 29.3, “Enabling admin sudo access to domain administrators on the IdM server”.

Prerequisites

29.1. Joining a RHEL 8 system to an IdM domain using the web console

You can use the web console to join the Red Hat Enterprise Linux 8 system to the Identity Management (IdM) domain.

Prerequisites

  • The IdM domain is running and reachable from the client you want to join.
  • You have the IdM domain administrator credentials.

Procedure

  1. Log into the RHEL web console.

    For details, see Logging in to the web console.

  2. Open the System tab.
  3. Click Join Domain.

    idm cockpit join domain

  4. In the Join a Domain dialog box, enter the host name of the IdM server in the Domain Address field.
  5. In the Authentication drop down list, select if you want to use a password or a one-time password for authentication.

    idm cockpit join psswd

  6. In the Domain Administrator Name field, enter the user name of the IdM administration account.
  7. In the password field, add the password or one-time password according to what you selected in the Authentication drop down list earlier.
  8. Click Join.

    idm cockpit join

Verification steps

  1. If the RHEL 8 web console did not display an error, the system has been joined to the IdM domain and you can see the domain name in the System screen.
  2. To verify that the user is a member of the domain, click the Terminal page and type the id command:

    $ id
    euid=548800004(example_user) gid=548800004(example_user) groups=548800004(example_user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

29.2. Logging in to the web console using Kerberos authentication

The following procedure describes steps on how to set up the RHEL 8 system to use Kerberos authentication.

Important

With SSO you usually do not have any administrative privileges in the web console. This only works if you configured passwordless sudo. The web console does not interactively ask for a sudo password.

Prerequisites

Procedure

Log in to the RHEL web console with the following address: https://dns_name:9090.

At this point, you are successfully connected to the RHEL web console and you can start with configuration.

idm cockpit logging done

29.3. Enabling admin sudo access to domain administrators on the IdM server

The following procedure describes steps on how to allow domain administrators to run any command on any host in the Identity Management (IdM) domain.

To accomplish this, enable sudo access to the admins user group created automatically during the IdM server installation.

All users added to the admins group will have sudo access if you run ipa-advise script on the group.

Prerequisites

  • The server runs IdM 4.7.1 or later.

Procedure

  1. Connect to the IdM server.
  2. Run the ipa-advise script:

    $ ipa-advise enable-admins-sudo | sh -ex

If the console did not display an error, the admins group have admin permissions on all machines in the IdM domain.

Chapter 30. Configuring smart card authentication with the web console for centrally managed users

Configure smart card authentication in the RHEL 8 web console for users who are centrally managed by:

  • Identity Management
  • Active Directory which is connected in the cross-forest trust with Identity Management
Important
Smart card authentication does not elevate administrative privileges yet and the web console opens in the web browser in the read-only mode.
You can run administrative commands in the built-in terminal with `sudo`.

Prerequisites

  • The system for which you want to use the smart card authentication must be a member of an Active Directory or Identity Management domain.

    For details about joining the RHEL 8 system into a domain using the web console, see Joining a RHEL 8 system to an IdM domain using the web console.

  • The certificate used for the smart card authentication must be associated with a particular user in Identity Management or Active Directory.

    For more details about associating a certificate with the user in Identity Management, see Adding a certificate to a user entry in IdM.

30.1. Smart card authentication for centrally managed users

A smart card is a physical device, which can provide personal authentication using certificates stored on the card. Personal authentication means that you can use smart cards in the same way as user passwords.

You can store user credentials on the smart card in the form of a private key and a certificate. Special software and hardware is used to access them. You insert the smart card into a reader or a USB socket and supply the PIN code for the smart card instead of providing your password.

Identity Management (IdM) supports smart card authentication with:

Note

If you want to start to use smart card authentication, see the hardware requirements: Smart Card support in RHEL8.

30.2. Installing tools for managing and using smart cards

To configure your smart card, you need tools which can generate certificates and store them on a smart card.

You must:

  • Install the gnutls-utils package which helps you to manage certificates.
  • Install the opensc package which provides a set of libraries and utilities to work with smart cards.
  • Start the pcscd service which communicates with the smart card reader.

Procedure

  1. Install the opensc and gnutls-utils packages:

    # dnf -y install opensc gnutls-utils
  2. Start the pcscd service.

    # systemctl start pcscd

Verify that the pcscd service is up and running.

30.3. Storing a certificate on a smart card

This section describes smart card configuration with the pkcs15-init tool, which helps you to configure:

  • Erasing your smart card
  • Setting new PINs and optional PIN Unblocking Keys (PUKs)
  • Creating a new slot on the smart card
  • Storing the certificate, private key, and public key in the slot
  • Locking the smart card settings (some smart cards require this type of finalization)

Prerequisites

  • The opensc package, which includes the pkcs15-init tool is installed.

    For details, see Installing tools for managing and using smart cards.

  • The card is inserted in the reader and connected to the computer.
  • You have the private key, public key, and certificate to store on the smart card. In this procedure, testuser.key, testuserpublic.key, and testuser.crt are the names used for the private key, public key, and the certificate.
  • Your current smart card user PIN and Security Officer PIN (SO-PIN)

Procedure

  1. Erase your smart card and authenticate yourself with your PIN:

    $ pkcs15-init --erase-card --use-default-transport-keys
    Using reader with a card: Reader name
    PIN [Security Officer PIN] required.
    Please enter PIN [Security Officer PIN]:

    The card has been erased.

  2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

    $ pkcs15-init --create-pkcs15 --use-default-transport-keys \
        --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
    Using reader with a card: Reader name

    The pcks15-init tool creates a new slot on the smart card.

  3. Set the label and the authentication ID for the slot:

    $ pkcs15-init --store-pin --label testuser \
        --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
    Using reader with a card: Reader name

    The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

  4. Store and label the private key in the new slot on the smart card:

    $ pkcs15-init --store-private-key testuser.key --label testuser_key \
        --auth-id 01 --id 01 --pin 963214
    Using reader with a card: Reader name
    Note

    The value you specify for --id must be the same when storing your private key, and certificate. If you do not specify a value for --id, a more complicated value is calculated by the tool and it is therefore easier to define your own value.

  5. Store and label the certificate in the new slot on the smart card:

    $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \
        --auth-id 01 --id 01 --format pem --pin 963214
    Using reader with a card: Reader name
  6. (Optional) Store and label the public key in the new slot on the smart card:

    $ pkcs15-init --store-public-key testuserpublic.key
        --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
    Using reader with a card: Reader name
    Note

    If the public key corresponds to a private key and/or certificate, you should specify the same ID as that private key and/or certificate.

  7. (Optional) Some smart cards require you to finalize the card by locking the settings:

    $ pkcs15-init -F

    At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

30.4. Enabling smart card authentication for the web console

To be able to use smart card authentication in the web console, enable smart card authentication in the cockpit.conf file.

Additionally, you can disable password authentication in the same file.

Prerequisites

Procedure

  1. Log in to the RHEL web console with administrator privileges.

    For details, see Logging in to the web console.

  2. Click Terminal.
  3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

    [WebService]
    ClientCertAuthentication = yes
  4. Optionally, disable password based authentication in cockpit.conf with:

    [Basic]
    action = none

    This configuration disables password authentication and you must always use the smart card.

  5. Restart the web console to make sure that the cockpit.service accepts the change:

    # systemctl restart cockpit

30.5. Logging in to the web console with smart cards

You can use smart cards to log in to the web console.

Prerequisites

  • A valid certificate stored in your smart card that is associated to a user account created in a Active Directory or Identity Management domain.
  • PIN to unlock the smart card.
  • The smart card has been put into the reader.

Procedure

  1. Open your web browser and add the web console’s address in the address bar.

    The browser asks you to add the PIN protecting the certificate stored on the smart card.

  2. In the Password Required dialog box, enter PIN and click OK.
  3. In the User Identification Request dialog box, select the certificate stored in the smart card.
  4. Select Remember this decision.

    The system does not open this window next time.

  5. Click OK.

You are now connected and the web console displays its content.

30.6. Limiting user sessions and memory to prevent a DoS attack

Certificate authentication is protected by separating and isolating instances of the cockpit-ws web server against attackers who wants to impersonate another user. However, this introduces a potential Denial of Service (DoS) attack: A remote attacker could create a large number of certificates and send a large number of HTTPS requests to cockpit-ws each using a different certificate.

To prevent this DoS, the collective resources of these web server instances are limited. By default, limits to the number of connections and to memory usage are set to 200 threads and a 75% (soft) / 90% (hard) memory limit.

The following procedure describes resource protection by limiting the number of connections and memory.

Procedure

  1. In the terminal, open the system-cockpithttps.slice configuration file:

    # systemctl edit system-cockpithttps.slice
  2. Limit the TasksMax to 100 and CPUQuota to 30%:

    [Slice]
    # change existing value
    TasksMax=100
    # add new restriction
    CPUQuota=30%
  3. To apply the changes, restart the system:

    # systemctl daemon-reload
    # systemctl stop cockpit

Now, the new memory and user session limits protect the cockpit-ws web server from DoS attacks.

30.7. Additional resources

Legal Notice

Copyright © 2020 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.