{"id":134252,"date":"2023-08-16T08:00:00","date_gmt":"2023-08-16T08:00:00","guid":{"rendered":"https:\/\/fedoramagazine.org\/?p=38635"},"modified":"2023-08-16T08:00:00","modified_gmt":"2023-08-16T08:00:00","slug":"using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them","status":"publish","type":"post","link":"https:\/\/sickgaming.net\/blog\/2023\/08\/16\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them\/","title":{"rendered":"Using Cockpit to graphically manage systems, without installing Cockpit on them!"},"content":{"rendered":"<p>It probably sounds too good to be true: the ability to manage remote systems using an easy to use, intuitive graphical interface \u2013 without the need to install extra software on the remote systems, enable additional services, or make any other changes on the remote systems. This functionality, however, is now available with a combination of the recently introduced Python bridge for Cockpit and the Cockpit Client Flatpak! This allows Cockpit to manage remote systems, assuming only SSH access and that Python is installed on the remote host. Read on for more information on how this works and how to get started.<\/p>\n<p> <span id=\"more-38635\"><\/span> <\/p>\n<p>If you are not familiar with Cockpit, it is described on the <a href=\"https:\/\/cockpit-project.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">project\u2019s web site<\/a> as a web-based graphical interface for servers. Cockpit is intended for everyone, especially those who are:<\/p>\n<ul>\n<li><strong>new to Linux <\/strong>(including Windows admins)<\/li>\n<li><strong>familiar with Linux <\/strong>and want an easy, graphical way to administer servers<\/li>\n<li><strong>expert admins<\/strong> who mainly use other tools but want an overview on individual systems<\/li>\n<\/ul>\n<p>You can easily and intuitively complete a variety of tasks from Cockpit. These including tasks such as:<\/p>\n<ul>\n<li> expanding the size of a filesystem<\/li>\n<li>creating a network bond<\/li>\n<li>modifying the firewall<\/li>\n<li>viewing log entries<\/li>\n<li>viewing real time and historical performance information<\/li>\n<li>managing Podman containers<\/li>\n<li>managing KVM virtual machines<\/li>\n<\/ul>\n<p>and many additional tasks.<\/p>\n<h2 class=\"wp-block-heading\">Objections to using Cockpit on systems<\/h2>\n<p>In the past, I\u2019ve heard two main objections to using Cockpit on systems:<\/p>\n<ol>\n<li>I don\u2019t want to run the Cockpit web server on my systems. Additional network services like this increase the attack surface. I don\u2019t want to open another port in the firewall. I don\u2019t want more HTTPS certificates in my environment to manage and maintain.<\/li>\n<li>I don\u2019t want to install additional packages on my systems. I don\u2019t even have access to install additional packages). The more packages installed, the larger my footprint is, and the more attack surface there is. For me to install additional packages in a production environment, I have to go through a change management process, etc. What a hassle!<\/li>\n<\/ol>\n<p>Let&#8217;s address these one at a time. For the first concern, you have actually had several options for connecting to Cockpit over SSH, without running the Cockpit web server, for quite some time. These options include:<\/p>\n<ul>\n<li>The ability to set up a bastion host, which is a host that has the Cockpit web server running on it.&nbsp; You can then connect to Cockpit on the bastion host using a web browser.&nbsp; From the Cockpit login screen on the bastion host you can use the <em>Connect to<\/em><strong> <\/strong>option to specify an alternate host to login to (refer to the <em>LoginTo<\/em> cockpit.conf configuration option).&nbsp; Another option is to authenticate to Cockpit on the bastion host, and use the <em>Add new host<\/em> option.&nbsp; In either case, the bastion Cockpit host will connect to these additional remote hosts over SSH (so only the bastion host in your environment needs to be running the Cockpit web server).<\/li>\n<li>You can use the Cockpit integration available with the upstream <a href=\"https:\/\/theforeman.org\/plugins\/foreman_remote_execution\/1.7\/index.html#3.6Cockpitintegration\" target=\"_blank\" rel=\"noreferrer noopener\">Foreman<\/a>, or downstream <a href=\"https:\/\/access.redhat.com\/documentation\/en-us\/red_hat_satellite\/6.13\/html-single\/managing_hosts\/index#Host_Management_and_Monitoring_Using_Cockpit_managing-hosts\" target=\"_blank\" rel=\"noreferrer noopener\">Red Hat Satellite<\/a>, to connect to Cockpit on systems in your environment over SSH.&nbsp;&nbsp;<\/li>\n<li>You can use the <a href=\"https:\/\/flathub.org\/apps\/org.cockpit_project.CockpitClient\" target=\"_blank\" rel=\"noreferrer noopener\">Cockpit Client Flatpak<\/a>, which will connect to systems over SSH.<\/li>\n<li>You can use the <a href=\"https:\/\/quay.io\/repository\/cockpit\/ws\" target=\"_blank\" rel=\"noreferrer noopener\">cockpit\/ws<\/a> container image. This is a containerized version of the Cockpit web server that acts as a containerized bastion host<\/li>\n<\/ul>\n<p>For more information on these options, refer to the<a href=\"https:\/\/www.redhat.com\/en\/blog\/connecting-rhel-web-console-part-1-ssh-access-methods\" target=\"_blank\" rel=\"noreferrer noopener\"> Connecting to the RHEL web console, part 1: SSH access methods<\/a> blog post. This blog post focuses on the downstream RHEL web console, however, the information also applies to the upstream Cockpit available in Fedora.\u00a0<\/p>\n<p>This brings me to the second concern, and the main focus of this article. This is the concern that I don\u2019t want to install additional packages on the remote systems I am managing.\u00a0 While there are several options for using the web console without the Cockpit web server, all of these options previously had a prerequisite that the remote systems needed to have at least the <em>cockpit-system<\/em> package installed.\u00a0 For example, previously if you tried to use the Cockpit Client Flatpak to connect to a remote system that didn\u2019t have Cockpit installed, you\u2019d see an error message stating that the remote system doesn\u2019t have <em>cockpit-bridge<\/em> installed.\u00a0<\/p>\n<p>The Cockpit team has replaced the previous Cockpit bridge (implemented using C) with a new bridge written in Python.\u00a0 For a technical overview of the function of the Cockpit bridge, and how the new Python bridge was implemented, refer to the recent <a href=\"https:\/\/www.youtube.com\/watch?v=ZAVUG6E0Xd4\" target=\"_blank\" rel=\"noreferrer noopener\">Monty Python\u2019s Flying Cockpit<\/a> DevConf presentation by Allison Karlitskaya and Martin Pitt.\u00a0<\/p>\n<p>This new Python bridge overcomes the previous limitation requiring Cockpit to be installed on the remote hosts.\u00a0\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Using the Cockpit Client Flatpak<\/h2>\n<p>With the Cockpit Client Flatpak application installed on a workstation, we can connect to remote systems over SSH and manage them using Cockpit.<\/p>\n<h3 class=\"wp-block-heading\">Installation<\/h3>\n<p>In the following example, I\u2019m using a Fedora 38 workstation. Install the Cockpit Client Flatpak by simply opening the GNOME Software application and searching for Cockpit. Note that you\u2019ll need to have Flathub enabled in GNOME Software.<\/p>\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-7.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"748\" src=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them.png\" alt=\"\" class=\"wp-image-38636\" \/><\/a><\/figure>\n<h3 class=\"wp-block-heading\">Using the Cockpit Client<\/h3>\n<p>Once installed, you\u2019ll see the following when opening the Cockpit Client:<\/p>\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-11.png\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"570\" src=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-1.png\" alt=\"\" class=\"wp-image-38637\" \/><\/a><\/figure>\n<p>You can type in a hostname or IP address that you would like to connect to. To authenticate as a user other than the user you are currently using, you can use the user@hostname syntax. A list of recent hosts that you\u2019ve connected to will appear, if this is not the first time using the Cockpit Client. In that case, you can simply click on a host name to reconnect<\/p>\n<p>If you have SSH key based authentication setup, you\u2019ll be logged in to the remote host using the key based authentication. With out SSH keys setup, you\u2019ll be prompted to authenticate with a password. In either case, if it is your first time connecting to the host over SSH, you\u2019ll be prompted to accept the host key fingerprint.<\/p>\n<p>As a special case, you can log into your currently running local session by connecting to <em>localhost<\/em>, without authentication.&nbsp;&nbsp;<\/p>\n<p>Once connected, you\u2019ll see the Cockpit Overview page:<\/p>\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-15.png\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"661\" src=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-2.png\" alt=\"\" class=\"wp-image-38638\" \/><\/a><figcaption class=\"wp-element-caption\">Cockpit overivew menu<\/figcaption><\/figure>\n<p>Select the <em>Terminal <\/em> menu item in Cockpit to show that the remote system that I\u2019m logged in to does not have any Cockpit packages installed:<\/p>\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-3.png\"><img decoding=\"async\" loading=\"lazy\" width=\"936\" height=\"283\" src=\"https:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2023\/08\/using-cockpit-to-graphically-manage-systems-without-installing-cockpit-on-them-3.png\" alt=\"\" class=\"wp-image-38639\" \/><\/a><figcaption class=\"wp-element-caption\">Cockpit Terminal view<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">Prerequisites for connecting to systems with Cockpit Client<\/h2>\n<p>There are several prerequisites for utilizing Cockpit Client to connect to a remote system. If you are familiar with managing remote hosts with Ansible, you\u2019ll likely already be familiar with the prerequisites. They are the same:<\/p>\n<ol>\n<li>You must have connectivity to the remote system over SSH.<\/li>\n<li>You must have a valid user account on the remote system that you can authenticate with.<\/li>\n<li>If you need the ability to complete privileged operations in Cockpit, the user account on the remote system will need sudo privileges.<\/li>\n<\/ol>\n<p>If you are connecting to a remote system that doesn\u2019t have Cockpit installed, there are a couple of additional prerequisites:<\/p>\n<ol>\n<li>Python 3.6 or later must be installed on the remote host. This is not usually an issue, with some exceptions, such as Fedora CoreOS which does not include Python by default.<\/li>\n<li>An older version of Cockpit Client can not be used to connect to a newer operating system version. For example, if I installed Cockpit Client on my Fedora 38 workstation today and never updated it, it may not work properly to manage a Fedora 39 or Fedora 40 server in the future.<\/li>\n<\/ol>\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n<p>Here are some frequently asked questions about this functionality:<\/p>\n<p><strong>Question:<\/strong> Cockpit is extendable via additional Applications.&nbsp; Which Cockpit applications are available if I use the Cockpit Client to connect to a remote system that doesn\u2019t have Cockpit installed?<\/p>\n<p><strong>Answer<\/strong>: Currently, Cockpit Client includes <\/p>\n<ul>\n<li><em>cockpit-machines <\/em>(virtual machine management) <\/li>\n<li><em>cockpit-podman<\/em> (Podman container management) <\/li>\n<li><em>cockpit-ostree <\/em>(used to manage rpm-ostree based systems)<\/li>\n<li><em>cockpit-storaged <\/em>(storage management)<\/li>\n<li><em>cockpit-sosreport<\/em> (for generating diagnostic reports)<\/li>\n<li><em>cockpit-selinux<\/em><strong> <\/strong>(for managing SELinux)<\/li>\n<li><em>cockpit-packagekit<\/em> (for managing software updates)<\/li>\n<li><em>cockpit-networkmanager<\/em><strong> <\/strong>(network management)<\/li>\n<li><em>cockpit-kdump<\/em> (kernel dump configuration)\u00a0 <\/li>\n<\/ul>\n<p>The Cockpit team is looking for feedback on what Cockpit applications you\u2019d like to see included in the Cockpit Client. Post a comment below with your feedback.\u00a0<\/p>\n<p><strong>Question<\/strong>:&nbsp; I connected to a remote system that doesn\u2019t have Cockpit installed, but I don\u2019t see Virtual Machines or one of the other applications listed in the menu.&nbsp; I thought you just said these were included in the Cockpit Client Flatpak?<\/p>\n<p><strong>Answer<\/strong>:\u00a0 When you login to a remote system that doesn\u2019t have Cockpit packages installed, you\u2019ll only see the menu options for underlying functionality available on the remote system.\u00a0 For example, you\u2019ll only see Virtual Machines in the Cockpit menu if the remote host has the <em>libvirt-dbus<\/em> package installed.\u00a0<\/p>\n<p><strong>Question<\/strong>: Can Cockpit applications available in the Cockpit Client be used with locally installed Cockpit applications on the remote host?\u00a0 In other words, if I need a Cockpit application not included in the Cockpit Client, can I install just that single package on the remote host?\u00a0\u00a0<\/p>\n<p><strong>Answer<\/strong>:\u00a0 No, you cannot mix and match applications included in the Cockpit Client flatpak and those installed locally on the remote host.\u00a0 For a remote host that has the<strong><em> <\/em><\/strong><em>cockpit-bridge<\/em> package installed, Cockpit Client will exclusively use the applications that are installed locally on the remote host.\u00a0 If the remote host does not have the <em>cockpit-bridge<\/em> package installed, Cockpit Client will exclusively use the applications bundled in the Cockpit Client Flatpak.\u00a0\u00a0<\/p>\n<p><strong>Question<\/strong>:&nbsp; Can I use Cockpit Client to connect to the local host?<\/p>\n<p><strong>Answer<\/strong>: Yes!\u00a0 Simply open Cockpit Client and type in <em>localhost<\/em> and you\u2019ll be able to manage the local host.\u00a0 You don\u2019t need to have any Cockpit packages installed on the local host if you use this method. You only need the Cockpit Client Flatpak.\u00a0\u00a0<\/p>\n<p><strong>Question:&nbsp; <\/strong>What Linux distributions can I connect to using the Cockpit Client?<\/p>\n<p><strong>Answer:\u00a0 <\/strong>Cockpit is compatible with a number of different Linux distributions.\u00a0 For more information, see the <a href=\"https:\/\/cockpit-project.org\/running.html\" target=\"_blank\" rel=\"noreferrer noopener\">Running Cockpi<\/a>t page.\u00a0 If connecting to a remote system that doesn\u2019t have Cockpit installed, keep in mind the previously mentioned requirements regarding not connecting to newer OS\u2019s from an older Cockpit Client.\u00a0\u00a0<\/p>\n<p><strong>Question<\/strong>:&nbsp; Does the Cockpit team have any future plans regarding this functionality?&nbsp;<\/p>\n<p><strong>Answer:\u00a0 <\/strong>The Cockpit team is planning on adding the ability to connect to remote hosts without Cockpit packages installed to the <a href=\"https:\/\/quay.io\/repository\/cockpit\/ws\" target=\"_blank\" rel=\"noreferrer noopener\">cockpit-ws container image<\/a>. See <a href=\"https:\/\/issues.redhat.com\/browse\/COCKPIT-954\" target=\"_blank\" rel=\"noreferrer noopener\">COCKPIT-954<\/a> ticket for more info.\u00a0\u00a0<\/p>\n<p>Have more questions not covered here? Ask them in the comments section below!<\/p>\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n<p>The new Python bridge, and the corresponding ability to use the Cockpit Client to connect to remote systems without installing Cockpit, makes it incredibly easy to use Cockpit in almost any circumstance.<\/p>\n<p>Try this out! It&#8217;s easy to do. Simply install the Cockpit Client Flatpak, and use it to connect to either your localhost or a remote system. Once you\u2019ve tried it, let us know what you think in the comments below.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It probably sounds too good to be true: the ability to manage remote systems using an easy to use, intuitive graphical interface \u2013 without the need to install extra software on the remote systems, enable additional services, or make any other changes on the remote systems. This functionality, however, is now available with a combination [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":134253,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[45,61,46,47],"class_list":["post-134252","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-fedora-os","tag-fedora","tag-fedora-project-community","tag-magazine","tag-news"],"_links":{"self":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/134252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/comments?post=134252"}],"version-history":[{"count":0,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/134252\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media\/134253"}],"wp:attachment":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media?parent=134252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/categories?post=134252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/tags?post=134252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}