15 ms·

Cockpit – Administer Linux servers via a web browser

377 points by rayascott 9y ago

deleted 9y ago
[deleted]
LaSombra 9y ago
I watched this year's Fosdem talk on Cockpit[0] and was seriously impressed. It looks like there is a contender for an easy-to-use Linux web admin. [0] https://www.youtube.com/watch?v=Oq6Vbwl-HqM https://www.youtube.com/watch?v=Oq6Vbwl-HqM
- maeln 9y ago
  There is also this talk from All Systems Go! [0] that goes in details about the architecture of cockpit :) . [0] https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_session_in_your_browser https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_s...
- fredsted 9y ago
  This one seems to have a bit better audio/video quality: https://www.youtube.com/watch?v=Tsa6BBAkTdo https://www.youtube.com/watch?v=Tsa6BBAkTdo
erric 9y ago
Its pretty, usable, friendly, however No one is going to use this to manage more then a few systems.
- alsadi 9y ago
  cockpit has cluster support for kubernetes http://cockpit-project.org/guide/133/feature-kubernetes.html http://cockpit-project.org/guide/133/feature-kubernetes.html https://www.youtube.com/watch?v=Fcfsu22RssU https://www.youtube.com/watch?v=Fcfsu22RssU
  - Rotareti 9y ago
    It looks neat and all, but I'm not sure why I should use this over Kubernetes internal Dashboard?
- jnsaff2 9y ago
  I'm sure someone is going to manage more than a few systems, the question is whether they should. To me cockpit is firmly in the Pet sector whereas the Cattle way of doing things is clearly the one that scales better.
  - jlgaddis 9y ago
    Not everyone has a large cattle farm. Some folks just have a couple pets to care for.
- jlgaddis 9y ago
  That's what Spacewalk [0] is (intended) for. [0]: https://spacewalkproject.github.io/ https://spacewalkproject.github.io/
- d1mo 9y ago
  If you need to manage a large and diverse infrastructure you should also consider Mist.io: https://github.com/mistio/mist.io https://github.com/mistio/mist.io Disclaimer: I'm one of the founders
  - structural 9y ago
    How's the open source version of mist.io these days? I remember evaluating it (and cockpit, among others) for managing a small isolated network of about two dozen machines in early 2017 and it seemed that the open source release had been somewhat ignored and wasn't really working at that point. Note that all of my work is on networks that are disconnected from the internet, so I ignore SaaS offerings or versions completely.
    - d1mo 9y ago
      I think it's worth a second try. We've been updating it quite regularly lately and we're about to release version 3.0.0 of the Community Edition, most likely next week. It introduces support for monitoring and alerting w/ Telegraf & InfluxDB, among other things. If you're anxious ( and somewhat brave ;) you can try installing it from the staging branch today. Also, there's a Mist.io Enteprise Edition nowadays that you can install on-premises. There's more info about that at https://mist.io https://mist.io
  - otterley 9y ago
    Is there a theory of operations available? Hard to judge its utility from the current README.
fazza99 9y ago
what was wrong with webmin? (ducks)
- thinkMOAR 9y ago
  https://nvd.nist.gov/vuln/search/results?adv_search=false&form_type=basic&results_type=overview&search_type=all&query=webmin https://nvd.nist.gov/vuln/search/results?adv_search=false&fo...
  - freehunter 9y ago
    Yeah, getting Webmin security right is possible but very challenging. Whenever I'm doing a security assessment at a client and I see traffic to/from servers on port 10000 I always make a note that there's probably some vulnerabilities there that our pentest guys will want to explore. I have no idea if Cockpit is any more secure, but Webmin does have its fair share of security issues.
    - thinkMOAR 9y ago
      Personally, no, i don't want a webserver managing my servers. But i surely hope not the same mistakes or security issues arise that happened for webmin.
- martinald 9y ago
  Or CPanel ;).
  - tyingq 9y ago
    Cpanel's licensing cost isn't trivial. https://cpanel.com/pricing/ https://cpanel.com/pricing/
    - comboy 9y ago
      Security is though.
- 9y ago
benevol 9y ago
How much of an added security risk does adding a web-based admin interface (to the usual ssh tunnel) represent?
- dthul 9y ago
  You could bind the web service to the loopback interface of the server. This way it cannot be accessed directly from the internet. Then you can use SSH port forwarding to access it from the web browser on your local machine.
  - smacktoward 9y ago
    How much overlap is there between the users who know how to do that and the users who need a Web-based control panel, though?
    - deleted 9y ago
      [deleted]
- number6 9y ago
  SSH has a lot of neat features that mitigate MITM, Eavesdropping, Bruteforcing etc. Where a Web-based Admin Interface should have SSL and maybe some protection against bruteforcing. Plus, you get all the vulns that come with the modern web
  - ynniv 9y ago
    Hopefully they're properly defending against XSS and not going to pull a Filet-o-Firewall [https://github.com/filetofirewall/fof https://github.com/filetofirewall/fof http://www.kb.cert.org/vuls/id/361684 http://www.kb.cert.org/vuls/id/361684]
  - andyrj 9y ago
    Add nginx/apache with client certificate authentication in front of this and most of those concerns go away. Plus this way you don't have to worry about exposing the port but you need to distribute your client keys before hand.
morganvachon 9y ago
For those who may wonder, it looks like this is GNU/Linux only, no support for BSD or any Linux distro that doesn't use systemd. That means no Alpine Linux and no OpenBSD/FreeBSD.
- pjmlp 9y ago
  Or Aix, HP-UX, SmartOS
- evol262 9y ago
  cockpit is not dependent on systemd. They don't ship sysvinit scripts, but there's no hard dependencies on systemd anywhere. I'd expect that the system logging may not be very nice without journald, but the vast majority of the interface runs over dbus or spawns processes on the server. It _is_ dependent on dbus.
  - ausjke 9y ago
    dubs means it will be linux only, maybe should write an agent that deals with dbus, meanwhile the agent can work with other OSes to provide info cockpit needs.
    - Conan_Kudo 9y ago
      dbus-daemon works on BSDs too. There as a Linux-specific implementation of D-Bus called "dbus-broker", but that's an implementation of D-Bus, and Cockpit doesn't care about that at all.
      - JdeBP 9y ago
        dbus-broker is in fact more specific than that. It does not function on all Linux operating systems, only the systemd ones. It too, like Cockpit here (as shown at https://news.ycombinator.com/item?id=16448768 https://news.ycombinator.com/item?id=16448768), talks directly to the idiosyncratic systemd process #1 API (rather than, say, using the "service" command to start services on demand). * https://github.com/bus1/dbus-broker/blob/07e43501e418c8066c775f3409268a8fd4a5903b/src/launch/main.c#L442 https://github.com/bus1/dbus-broker/blob/07e43501e418c8066c7...
maxaf 9y ago
Personally I'd much rather see a GUI that can help string together snippets of Terraform/CFN and Ansible/Chef/Puppet/Salt/whathaveyou. A visual IDE for infrastructure automation, if you will.
- dalore 9y ago
  Doesn't Ansible Tower do this (At least for ansible)?
  - maxaf 9y ago
    I haven't used it personally, but judging by the marketing video Tower is mostly an enterprise dashboard with some self-serve features that allow invocation of Ansible playbooks (or perhaps some larger unit of automation - I've no idea if they made something up just for Tower); but the playbooks would still need to be hand-coded elsewhere.
    - dalore 9y ago
      Ahh I thought you meant you got some playbooks/roles/modules written but you have a gui to say which are run where. More of a higher level. But I think I see what you mean and I like the idea. A low level GUI that lets you look up specific tasks in ansible and have it create the playbook for you at the end. That would be pretty cool and not that hard to write actually.
      - epicide 9y ago
        Combined with Ansible Galaxy, I think you get pretty close.
- ohples 9y ago
  Yeah I also wish there was some good Config Management IDEs. I think someone like InteliJ might be able to make a decent one.
  - 9y ago
dalore 9y ago
Would be nice if this was in a docker container I could just run.
- evol262 9y ago
  It is: https://hub.docker.com/r/cockpit/ws/ https://hub.docker.com/r/cockpit/ws/
  - dalore 9y ago
    It mentions atomic though. And nothing about docker on the install guide.
    - evol262 9y ago
      'atomic' is a wrapper. Just look at the dockerfile. Given how much cockpit wants to, y'know, manage the real system, running it in docker is senseless, and there's no reason to have it in the install guide. If you want it to actually manage your host, use the dockerfile.
hestefisk 9y ago
Linuxconf for Web anyone?
dmoreno 9y ago
Does it work on non fedora/redhat? Does it need an agent on managed systems? I'm developing a somewhat similar system[1], based purely on very easy to develop plugins, agentless, and integration with third parties where needed (Prometheus, for example).But without big corporate backup it is being difficult to keep the development pace. [1] https://github.com/serverboards/serverboards/ https://github.com/serverboards/serverboards/
- sifex 9y ago
  Seems to work just fine on Debian as well. http://cockpit-project.org/running.html http://cockpit-project.org/running.html
- jbreiding 9y ago
  If this is the same as this site talks about, https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html-single/getting_started_with_cockpit/index https://access.redhat.com/documentation/en-us/red_hat_enterp..., then it would seem to be a first class citizen.
- guhcampos 9y ago
  I've used it before on Ubuntu and it worked just fine. As far as I understand, Cockpit deals directly with Systemd and Docker, so any system based on Systemd should just work.
  - evol262 9y ago
    Again, Cockpit does not explicitly deal with systemd. Cockpit deals with dbus, and systemd is conveniently available there (hostnamectl, etc). storaged, networkmanager, and other functionality is not dependent on systemd, so it's really just the system journal, changing the hostname, and checking service status which would fail without systemd. Docker is not required at all either, though it's an option.
    - JdeBP 9y ago
      That is directly contradicted by Cockpit's own doco, which explicitly states that Cockpit uses the systemd APIs and that "use of alternate system APIs are not currently implemented". * http://cockpit-project.org/guide/latest/feature-systemd.html http://cockpit-project.org/guide/latest/feature-systemd.html It should of course be obvious that Cockpit does explicitly deal with systemd. Desktop Bus is a transport layer, and the important thing about it is what DBus servers are on the other side of the broker are being talked to. In the case of Cockpit they are things like systemd's own idiosyncratic API for process #1 ... * https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14300c39278fd60872bf406887723a/pkg/lib/service.js#L97 https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14... ... systemd's hostnamed server ... * https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14300c39278fd60872bf406887723a/pkg/lib/machines.js#L275 https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14... * https://www.freedesktop.org/wiki/Software/systemd/hostnamed/ https://www.freedesktop.org/wiki/Software/systemd/hostnamed/ ... and systemd's timedated server. * https://github.com/cockpit-project/cockpit/blob/dbd7f3a8487a229ff8ba0ff9189c2feab6285d1c/pkg/systemd/host.js#L68 https://github.com/cockpit-project/cockpit/blob/dbd7f3a8487a... * https://www.freedesktop.org/wiki/Software/systemd/timedated/ https://www.freedesktop.org/wiki/Software/systemd/timedated/ Cockpit also hardwires use of systemd's journalctl program. * http://cockpit-project.org/guide/latest/feature-journal.html http://cockpit-project.org/guide/latest/feature-journal.html * https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14300c39278fd60872bf406887723a/pkg/lib/journal.js#L101 https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14...
cateye 9y ago
How would Cockpit compare with http://vestacp.com/ http://vestacp.com/ ?
INTPenis 9y ago
I tried it on my fedora 26 last year and my impression is that it has a far way to go and a lot of problems to resolve on the way. It's nowhere near a complete server administration product that will let you avoid the terminal. Perhaps for simple tasks but I fail to see the purpose.
- snuxoll 9y ago
  Cockpit itself is trying to be a "platform of sorts for modules to hook into. oVirt, for example, will install a cockpit plugin during installation of a hypervisor node allowing you to manage the local host or global cluster maintenance state and see how many VM's are running on the system (I would argue this is of limited benefit since you could just login to the oVirt Admin portal to do the same thing, but hey). So, yes, you're right - a lot of work still needs to be done, but Cockpit itself seems to be an adequate base, just need to add support for managing commonly needed services at least at a rudimentary level though (MySQL/PostgreSQL, Apache/Nginx/lighttpd, Postfix/Dovecot/exim/cyrus, etc).
  - evol262 9y ago
    I'm the maintainer of the oVirt plugin. The real advantage of it is that it allows installation of hosted engine easily, and a 'single pane' overview of a host (oVirt Node status without using nodectl, etc) Since Cockpit wants to deal with dbus, the push is for other utilities (postfix, snmpd, etc) to publish relevant information over dbus, rather than teaching Cockpit the format of each and every configuration file on the system. I wrote the Tuned plugin for Cockpit, and I maintain the oVirt plugin. I gave a talk at Devconf about plugin development, which is extremely easy, but the Cockpit team is small. It's very easy to write plugins for it, but even easier if they expose dbus. That said, the cockpit API (http://cockpit-project.org/guide/latest/api-base1 http://cockpit-project.org/guide/latest/api-base1) makes handling files/processes from client-side Javascript in plugins simple. It's just that you'd need yet another config file parser...
    - snuxoll 9y ago
      Never realized it was even possible to do a hosted engine deployment via Cockpit, that's certainly useful (I've always just used hosted-engine --deploy from the command line because that's how I've done it since the 3.x days). Do you have a link to a video of the presentation?
kruffin 9y ago
Why does it require that the server has password logins enabled? This seems contrary to every "secure your server" guide I've seen and opens your server up to the password guessing game. It seems like a cool product, but that's a huge non-starter. The target server will need to have password based authentication enabled in sshd. When this is setup for the first time, Cockpit will ensure that the user connected to primary server has the same password on the secondary server.
- reacharavindh 9y ago
  Great value-add of reading HN comments! I will wait until they get rid of this crazy requirement to consider using it.
  - derimagia 9y ago
    Sounds like a lie to me. The web server can also be run from the cockpit/ws docker container. If you are running cockpit on an Atomic Host this will be the default. In this setup, cockpit establishes an SSH connection from the container to the underlying host, meaning that it is up to your SSH server to grant access. To login with a local account, sshd will need to be configured to allow password based authentication. Alternatively you can setup a Kerberos based SSO solution. AKA, it is up to your SSH server to grant access to the container.
- thechriswalker 9y ago
  I don't think it does. That quote is from the section explaining how to configure "Password" authentication. i.e. to use Password authentication, you must enable it on the target server. It then goes on to list how to use Kerberos or Public Key methods.
  - kruffin 9y ago
    You are right, I missed the one liner above this that stated it needed one of these methods: [password, kerberos, or public key]. However, it does sound like if you use the docker image that you need password logins on the primary machine unless you modify the docker image to add a public key. I may just be reading wrong again though. [Edit]: This diagram was really helpful: https://raw.githubusercontent.com/cockpit-project/cockpit/master/doc/cockpit-transport.png https://raw.githubusercontent.com/cockpit-project/cockpit/ma...
SlowBro 9y ago
Does it have an SSH terminal built right in the browser? Not clear from the screenshots or documentation. If not you could also use Gate One[1]. [1] http://liftoffsoftware.com/Products/GateOne http://liftoffsoftware.com/Products/GateOne
- Mashimo 9y ago
  Yes it does.
  - oblio 9y ago
    I wonder what library they use for it. The one used by VS Code seems to be nice and its developers active. Ah, found it: https://github.com/xtermjs/xterm.js https://github.com/xtermjs/xterm.js
nailer 9y ago
I just want to consolidate journald entries across multiple boxes with a nice wen based UI. Anyone used cockpit for this? Or another solution?
- chrisper 9y ago
  Splunk?
  - nailer 9y ago
    Seems like too much code. Like I just want journald, consolidation and search.
fchaverri 9y ago
What's different between this and Webmin?
- roddux 9y ago
  This one is shiny and new! /s
- digi_owl 9y ago
  This one seems to be tied to systemd...
  - PrimHelios 9y ago
    Only for the journal and hostname functionalities, it should work fine for everything else without systemd.
    - JdeBP 9y ago
      ... and systemd timedated and systemd's idiosyncratic process #1 API. Its own doco also states that it targets systemd and does not implement use of other APIs. * https://news.ycombinator.com/item?id=16448768 https://news.ycombinator.com/item?id=16448768
      - PrimHelios 9y ago
        Thank you for the correction!
- DannyB2 9y ago
  Even modern mental health care has difficulty helping people to achieve complete recovery from having programmed in Perl.
ausjke 9y ago
it is possible to make cockpit loosely coupling with dbus? so that you can add bsd, non-dbus-Linux-devices(e.g. openwrt) to it?
dten 9y ago
This is cool, but there's no information on how to set it up. Am I missing something?
- phren0logy 9y ago
  I recently spun up a Debian 18.04 server to play with the beta. Installing it on that system was as easy as: sudo apt install cockpit
  - dten 9y ago
    ah, thanks (that should probably be in the documentation somewhere)
- DannyB2 9y ago
  I tried it this morning. On Linux Mint. The Docs pages suggest it is widely supported. I just did an apt-get install, then https://localhost:9090 https://localhost:9090 (Actually, I used the "Software Center" in the GUI.) and coolness!
digi_owl 9y ago
1. Anyone remember Webmin? 2. Seems to rely heavily on Systemd being present...
laveur 9y ago
This looks really awesome but the thing that i feel is missing from the website is simply what is it capable of doing? Like I want a list of features that it is capable of so I can evaluate whether or not I may have use for it.
rscupper 9y ago
Cockpit looks cool, but I'm using the new Jupyter Lab as a pretty awesome Python remote web shell. Access to a terminal, file explorer, and editor covers most everything I need and being able to run Python/Shell code in cells has covered most everything else.
happyhotpocket 9y ago
Maybe I'm just missing something but where is the name of the package? How do I install this? Is it an `apt-get install cockpit`? I don't see that written anywhere obvious.
- burdzwastaken 9y ago
  click your distribution (I assume Ubuntu?) here to reveal the way to install it http://cockpit-project.org/running.html http://cockpit-project.org/running.html. if you are running Ubuntu seems to require backports for anything below 17.04 though.
  - jniles 9y ago
    I also had this question and it took me about 5 minutes to figure out that you needed to click to reveal. It's fancy, but not at all practical. Hopefully someone updates it to just a flat list.
- tombrossman 9y ago
  > Is it an `apt-get install cockpit`? Yes. Assuming a debian-based distro, try "apt-cache search cockpit" and it comes right up. To see the available version try "apt-cache madison cockpit" which returns (on my Ubuntu 16.04 desktop) "cockpit | 161-1~ubuntu16.04.1 | ..."
sgeisler 9y ago
I've just watched a presentation [0] linked by someone else in this thread and am quite impressed by the architecture and UX shown. But it seems to me that Cockpit is more about monitoring and doing ad-hoc changes and not permanent configuration. I base that assumption on the fact that for example there are multiple places where one can configure network interfaces in debian and there is no cli tool or api to persist network configuration created with ip (at least to my knowledge). I can imagine parsing and editing fstab automatically and 100% correctly to be tricky too. On the other hand enabling or disabling systemd services is permanent by default and there are probably more cli tools that automatically persist changes done through them. Can anybody more familiar to Cockpit shed some light on the persistence of most of the configuration options? [0] https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_session_in_your_browser https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_s...
- evol262 9y ago
  Cockpit uses hostnamed, networkmanager, and other services for configuration, not 'ip' or 'hostname'. Everything you can see is persistent.
  - sgeisler 9y ago
    Thank you very much for clearing this up. Since I'm not familiar with networkmanager in combination with other config: what happens if I configure some network interface using Cockpit that is already defined in /etc/network/interfaces.d/*? Will it just throw an error or could it bring my system into a broken/undefined state so that it wouldn't be reachable after the next reboot? If the latter is the case it would probably be unwise to install/use Cockpit on an already configured system.
    - evol262 9y ago
      NetworkManager handles the config file management on its own. Debian appears to require a flag to enable this on its own: https://wiki.debian.org/NetworkManager#Enabling_Interface_Management https://wiki.debian.org/NetworkManager#Enabling_Interface_Ma... If it's enabled, networkmanager will parse out the files and present them over dbus, nmcli, etc. Changes with nmcli, gnome-network (which also uses NM), or other tooling will update the config files. The same ones in /etc/network/interfaces.d/ So, hypothetically: auto eth0 iface eth0 inet static address 192.168.40.112 netmask 255.255.255.0 gateway 192.168.40.1 dns-nameservers 8.8.8.8 NM/Cockpit will show all of this information. If you change the address to 192.168.40.113, the config file will be updated (but otherwise unchanged), and the address will change on the running interface. If it's not enabled, Cockpit will not see the interfaces at all.
themtutty 9y ago
@authors The "Try it out" page shows nothing about where to get Cockpit or how to configure and run it. #plsfix
- gtfierro 9y ago
  It could definitely be clearer, but if you click on the name of the operating systems on that page, they'll produce a little dialog that tells you how to run Cockpit.
- nreece 9y ago
  sudo apt-get install cockpit
cztomsik 9y ago
This is great! I've noticed you're using jquery (and that's fine) so what is YOUR opinion about current state of js? Are you considering any js framework? And if so, which one would it be and why?
throwawaymanbot 9y ago
Its kind of annoying this is on Ubuntu by default from 17.10 onwards. Badly configured internet facing servers... now have a GUI.

377 points by rayascott 9y ago

deleted 9y ago

[deleted]

I watched this year's Fosdem talk on Cockpit[0] and was seriously impressed. It looks like there is a contender for an easy-to-use Linux web admin. [0] https://www.youtube.com/watch?v=Oq6Vbwl-HqM https://www.youtube.com/watch?v=Oq6Vbwl-HqM

maeln 9y ago
There is also this talk from All Systems Go! [0] that goes in details about the architecture of cockpit :) . [0] https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_session_in_your_browser https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_s...
fredsted 9y ago
This one seems to have a bit better audio/video quality: https://www.youtube.com/watch?v=Tsa6BBAkTdo https://www.youtube.com/watch?v=Tsa6BBAkTdo

erric 9y ago

Its pretty, usable, friendly, however No one is going to use this to manage more then a few systems.

alsadi 9y ago
cockpit has cluster support for kubernetes http://cockpit-project.org/guide/133/feature-kubernetes.html http://cockpit-project.org/guide/133/feature-kubernetes.html https://www.youtube.com/watch?v=Fcfsu22RssU https://www.youtube.com/watch?v=Fcfsu22RssU
- Rotareti 9y ago
  It looks neat and all, but I'm not sure why I should use this over Kubernetes internal Dashboard?
jnsaff2 9y ago
I'm sure someone is going to manage more than a few systems, the question is whether they should. To me cockpit is firmly in the Pet sector whereas the Cattle way of doing things is clearly the one that scales better.
- jlgaddis 9y ago
  Not everyone has a large cattle farm. Some folks just have a couple pets to care for.
jlgaddis 9y ago
That's what Spacewalk [0] is (intended) for. [0]: https://spacewalkproject.github.io/ https://spacewalkproject.github.io/
d1mo 9y ago
If you need to manage a large and diverse infrastructure you should also consider Mist.io: https://github.com/mistio/mist.io https://github.com/mistio/mist.io Disclaimer: I'm one of the founders
- structural 9y ago
  How's the open source version of mist.io these days? I remember evaluating it (and cockpit, among others) for managing a small isolated network of about two dozen machines in early 2017 and it seemed that the open source release had been somewhat ignored and wasn't really working at that point. Note that all of my work is on networks that are disconnected from the internet, so I ignore SaaS offerings or versions completely.
  - d1mo 9y ago
    I think it's worth a second try. We've been updating it quite regularly lately and we're about to release version 3.0.0 of the Community Edition, most likely next week. It introduces support for monitoring and alerting w/ Telegraf & InfluxDB, among other things. If you're anxious ( and somewhat brave ;) you can try installing it from the staging branch today. Also, there's a Mist.io Enteprise Edition nowadays that you can install on-premises. There's more info about that at https://mist.io https://mist.io
- otterley 9y ago
  Is there a theory of operations available? Hard to judge its utility from the current README.

fazza99 9y ago

what was wrong with webmin? (ducks)

thinkMOAR 9y ago
https://nvd.nist.gov/vuln/search/results?adv_search=false&form_type=basic&results_type=overview&search_type=all&query=webmin https://nvd.nist.gov/vuln/search/results?adv_search=false&fo...
- freehunter 9y ago
  Yeah, getting Webmin security right is possible but very challenging. Whenever I'm doing a security assessment at a client and I see traffic to/from servers on port 10000 I always make a note that there's probably some vulnerabilities there that our pentest guys will want to explore. I have no idea if Cockpit is any more secure, but Webmin does have its fair share of security issues.
  - thinkMOAR 9y ago
    Personally, no, i don't want a webserver managing my servers. But i surely hope not the same mistakes or security issues arise that happened for webmin.
martinald 9y ago
Or CPanel ;).
- tyingq 9y ago
  Cpanel's licensing cost isn't trivial. https://cpanel.com/pricing/ https://cpanel.com/pricing/
  - comboy 9y ago
    Security is though.
9y ago

benevol 9y ago

How much of an added security risk does adding a web-based admin interface (to the usual ssh tunnel) represent?

dthul 9y ago
You could bind the web service to the loopback interface of the server. This way it cannot be accessed directly from the internet. Then you can use SSH port forwarding to access it from the web browser on your local machine.
- smacktoward 9y ago
  How much overlap is there between the users who know how to do that and the users who need a Web-based control panel, though?
  - deleted 9y ago
    [deleted]
number6 9y ago
SSH has a lot of neat features that mitigate MITM, Eavesdropping, Bruteforcing etc. Where a Web-based Admin Interface should have SSL and maybe some protection against bruteforcing. Plus, you get all the vulns that come with the modern web
- ynniv 9y ago
  Hopefully they're properly defending against XSS and not going to pull a Filet-o-Firewall [https://github.com/filetofirewall/fof https://github.com/filetofirewall/fof http://www.kb.cert.org/vuls/id/361684 http://www.kb.cert.org/vuls/id/361684]
- andyrj 9y ago
  Add nginx/apache with client certificate authentication in front of this and most of those concerns go away. Plus this way you don't have to worry about exposing the port but you need to distribute your client keys before hand.

morganvachon 9y ago

For those who may wonder, it looks like this is GNU/Linux only, no support for BSD or any Linux distro that doesn't use systemd. That means no Alpine Linux and no OpenBSD/FreeBSD.

pjmlp 9y ago
Or Aix, HP-UX, SmartOS
evol262 9y ago
cockpit is not dependent on systemd. They don't ship sysvinit scripts, but there's no hard dependencies on systemd anywhere. I'd expect that the system logging may not be very nice without journald, but the vast majority of the interface runs over dbus or spawns processes on the server. It _is_ dependent on dbus.
- ausjke 9y ago
  dubs means it will be linux only, maybe should write an agent that deals with dbus, meanwhile the agent can work with other OSes to provide info cockpit needs.
  - Conan_Kudo 9y ago
    dbus-daemon works on BSDs too. There as a Linux-specific implementation of D-Bus called "dbus-broker", but that's an implementation of D-Bus, and Cockpit doesn't care about that at all.
    - JdeBP 9y ago
      dbus-broker is in fact more specific than that. It does not function on all Linux operating systems, only the systemd ones. It too, like Cockpit here (as shown at https://news.ycombinator.com/item?id=16448768 https://news.ycombinator.com/item?id=16448768), talks directly to the idiosyncratic systemd process #1 API (rather than, say, using the "service" command to start services on demand). * https://github.com/bus1/dbus-broker/blob/07e43501e418c8066c775f3409268a8fd4a5903b/src/launch/main.c#L442 https://github.com/bus1/dbus-broker/blob/07e43501e418c8066c7...

maxaf 9y ago

Personally I'd much rather see a GUI that can help string together snippets of Terraform/CFN and Ansible/Chef/Puppet/Salt/whathaveyou. A visual IDE for infrastructure automation, if you will.

dalore 9y ago
Doesn't Ansible Tower do this (At least for ansible)?
- maxaf 9y ago
  I haven't used it personally, but judging by the marketing video Tower is mostly an enterprise dashboard with some self-serve features that allow invocation of Ansible playbooks (or perhaps some larger unit of automation - I've no idea if they made something up just for Tower); but the playbooks would still need to be hand-coded elsewhere.
  - dalore 9y ago
    Ahh I thought you meant you got some playbooks/roles/modules written but you have a gui to say which are run where. More of a higher level. But I think I see what you mean and I like the idea. A low level GUI that lets you look up specific tasks in ansible and have it create the playbook for you at the end. That would be pretty cool and not that hard to write actually.
    - epicide 9y ago
      Combined with Ansible Galaxy, I think you get pretty close.
ohples 9y ago
Yeah I also wish there was some good Config Management IDEs. I think someone like InteliJ might be able to make a decent one.
- 9y ago

dalore 9y ago

Would be nice if this was in a docker container I could just run.

evol262 9y ago
It is: https://hub.docker.com/r/cockpit/ws/ https://hub.docker.com/r/cockpit/ws/
- dalore 9y ago
  It mentions atomic though. And nothing about docker on the install guide.
  - evol262 9y ago
    'atomic' is a wrapper. Just look at the dockerfile. Given how much cockpit wants to, y'know, manage the real system, running it in docker is senseless, and there's no reason to have it in the install guide. If you want it to actually manage your host, use the dockerfile.

hestefisk 9y ago

Linuxconf for Web anyone?

dmoreno 9y ago

Does it work on non fedora/redhat? Does it need an agent on managed systems? I'm developing a somewhat similar system[1], based purely on very easy to develop plugins, agentless, and integration with third parties where needed (Prometheus, for example).But without big corporate backup it is being difficult to keep the development pace. [1] https://github.com/serverboards/serverboards/ https://github.com/serverboards/serverboards/

sifex 9y ago
Seems to work just fine on Debian as well. http://cockpit-project.org/running.html http://cockpit-project.org/running.html
jbreiding 9y ago
If this is the same as this site talks about, https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_atomic_host/7/html-single/getting_started_with_cockpit/index https://access.redhat.com/documentation/en-us/red_hat_enterp..., then it would seem to be a first class citizen.
guhcampos 9y ago
I've used it before on Ubuntu and it worked just fine. As far as I understand, Cockpit deals directly with Systemd and Docker, so any system based on Systemd should just work.
- evol262 9y ago
  Again, Cockpit does not explicitly deal with systemd. Cockpit deals with dbus, and systemd is conveniently available there (hostnamectl, etc). storaged, networkmanager, and other functionality is not dependent on systemd, so it's really just the system journal, changing the hostname, and checking service status which would fail without systemd. Docker is not required at all either, though it's an option.
  - JdeBP 9y ago
    That is directly contradicted by Cockpit's own doco, which explicitly states that Cockpit uses the systemd APIs and that "use of alternate system APIs are not currently implemented". * http://cockpit-project.org/guide/latest/feature-systemd.html http://cockpit-project.org/guide/latest/feature-systemd.html It should of course be obvious that Cockpit does explicitly deal with systemd. Desktop Bus is a transport layer, and the important thing about it is what DBus servers are on the other side of the broker are being talked to. In the case of Cockpit they are things like systemd's own idiosyncratic API for process #1 ... * https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14300c39278fd60872bf406887723a/pkg/lib/service.js#L97 https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14... ... systemd's hostnamed server ... * https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14300c39278fd60872bf406887723a/pkg/lib/machines.js#L275 https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14... * https://www.freedesktop.org/wiki/Software/systemd/hostnamed/ https://www.freedesktop.org/wiki/Software/systemd/hostnamed/ ... and systemd's timedated server. * https://github.com/cockpit-project/cockpit/blob/dbd7f3a8487a229ff8ba0ff9189c2feab6285d1c/pkg/systemd/host.js#L68 https://github.com/cockpit-project/cockpit/blob/dbd7f3a8487a... * https://www.freedesktop.org/wiki/Software/systemd/timedated/ https://www.freedesktop.org/wiki/Software/systemd/timedated/ Cockpit also hardwires use of systemd's journalctl program. * http://cockpit-project.org/guide/latest/feature-journal.html http://cockpit-project.org/guide/latest/feature-journal.html * https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14300c39278fd60872bf406887723a/pkg/lib/journal.js#L101 https://github.com/cockpit-project/cockpit/blob/0dd4ee7bac14...

cateye 9y ago

How would Cockpit compare with http://vestacp.com/ http://vestacp.com/ ?

INTPenis 9y ago

I tried it on my fedora 26 last year and my impression is that it has a far way to go and a lot of problems to resolve on the way. It's nowhere near a complete server administration product that will let you avoid the terminal. Perhaps for simple tasks but I fail to see the purpose.

snuxoll 9y ago
Cockpit itself is trying to be a "platform of sorts for modules to hook into. oVirt, for example, will install a cockpit plugin during installation of a hypervisor node allowing you to manage the local host or global cluster maintenance state and see how many VM's are running on the system (I would argue this is of limited benefit since you could just login to the oVirt Admin portal to do the same thing, but hey). So, yes, you're right - a lot of work still needs to be done, but Cockpit itself seems to be an adequate base, just need to add support for managing commonly needed services at least at a rudimentary level though (MySQL/PostgreSQL, Apache/Nginx/lighttpd, Postfix/Dovecot/exim/cyrus, etc).
- evol262 9y ago
  I'm the maintainer of the oVirt plugin. The real advantage of it is that it allows installation of hosted engine easily, and a 'single pane' overview of a host (oVirt Node status without using nodectl, etc) Since Cockpit wants to deal with dbus, the push is for other utilities (postfix, snmpd, etc) to publish relevant information over dbus, rather than teaching Cockpit the format of each and every configuration file on the system. I wrote the Tuned plugin for Cockpit, and I maintain the oVirt plugin. I gave a talk at Devconf about plugin development, which is extremely easy, but the Cockpit team is small. It's very easy to write plugins for it, but even easier if they expose dbus. That said, the cockpit API (http://cockpit-project.org/guide/latest/api-base1 http://cockpit-project.org/guide/latest/api-base1) makes handling files/processes from client-side Javascript in plugins simple. It's just that you'd need yet another config file parser...
  - snuxoll 9y ago
    Never realized it was even possible to do a hosted engine deployment via Cockpit, that's certainly useful (I've always just used hosted-engine --deploy from the command line because that's how I've done it since the 3.x days). Do you have a link to a video of the presentation?

kruffin 9y ago

Why does it require that the server has password logins enabled? This seems contrary to every "secure your server" guide I've seen and opens your server up to the password guessing game. It seems like a cool product, but that's a huge non-starter. The target server will need to have password based authentication enabled in sshd. When this is setup for the first time, Cockpit will ensure that the user connected to primary server has the same password on the secondary server.

reacharavindh 9y ago
Great value-add of reading HN comments! I will wait until they get rid of this crazy requirement to consider using it.
- derimagia 9y ago
  Sounds like a lie to me. The web server can also be run from the cockpit/ws docker container. If you are running cockpit on an Atomic Host this will be the default. In this setup, cockpit establishes an SSH connection from the container to the underlying host, meaning that it is up to your SSH server to grant access. To login with a local account, sshd will need to be configured to allow password based authentication. Alternatively you can setup a Kerberos based SSO solution. AKA, it is up to your SSH server to grant access to the container.
thechriswalker 9y ago
I don't think it does. That quote is from the section explaining how to configure "Password" authentication. i.e. to use Password authentication, you must enable it on the target server. It then goes on to list how to use Kerberos or Public Key methods.
- kruffin 9y ago
  You are right, I missed the one liner above this that stated it needed one of these methods: [password, kerberos, or public key]. However, it does sound like if you use the docker image that you need password logins on the primary machine unless you modify the docker image to add a public key. I may just be reading wrong again though. [Edit]: This diagram was really helpful: https://raw.githubusercontent.com/cockpit-project/cockpit/master/doc/cockpit-transport.png https://raw.githubusercontent.com/cockpit-project/cockpit/ma...

SlowBro 9y ago

Does it have an SSH terminal built right in the browser? Not clear from the screenshots or documentation. If not you could also use Gate One[1]. [1] http://liftoffsoftware.com/Products/GateOne http://liftoffsoftware.com/Products/GateOne

Mashimo 9y ago
Yes it does.
- oblio 9y ago
  I wonder what library they use for it. The one used by VS Code seems to be nice and its developers active. Ah, found it: https://github.com/xtermjs/xterm.js https://github.com/xtermjs/xterm.js

nailer 9y ago

I just want to consolidate journald entries across multiple boxes with a nice wen based UI. Anyone used cockpit for this? Or another solution?

chrisper 9y ago
Splunk?
- nailer 9y ago
  Seems like too much code. Like I just want journald, consolidation and search.

fchaverri 9y ago

What's different between this and Webmin?

roddux 9y ago
This one is shiny and new! /s
digi_owl 9y ago
This one seems to be tied to systemd...
- PrimHelios 9y ago
  Only for the journal and hostname functionalities, it should work fine for everything else without systemd.
  - JdeBP 9y ago
    ... and systemd timedated and systemd's idiosyncratic process #1 API. Its own doco also states that it targets systemd and does not implement use of other APIs. * https://news.ycombinator.com/item?id=16448768 https://news.ycombinator.com/item?id=16448768
    - PrimHelios 9y ago
      Thank you for the correction!
DannyB2 9y ago
Even modern mental health care has difficulty helping people to achieve complete recovery from having programmed in Perl.

ausjke 9y ago

it is possible to make cockpit loosely coupling with dbus? so that you can add bsd, non-dbus-Linux-devices(e.g. openwrt) to it?

dten 9y ago

This is cool, but there's no information on how to set it up. Am I missing something?

phren0logy 9y ago
I recently spun up a Debian 18.04 server to play with the beta. Installing it on that system was as easy as: sudo apt install cockpit
- dten 9y ago
  ah, thanks (that should probably be in the documentation somewhere)
DannyB2 9y ago
I tried it this morning. On Linux Mint. The Docs pages suggest it is widely supported. I just did an apt-get install, then https://localhost:9090 https://localhost:9090 (Actually, I used the "Software Center" in the GUI.) and coolness!

digi_owl 9y ago

1. Anyone remember Webmin? 2. Seems to rely heavily on Systemd being present...

laveur 9y ago

This looks really awesome but the thing that i feel is missing from the website is simply what is it capable of doing? Like I want a list of features that it is capable of so I can evaluate whether or not I may have use for it.

rscupper 9y ago

Cockpit looks cool, but I'm using the new Jupyter Lab as a pretty awesome Python remote web shell. Access to a terminal, file explorer, and editor covers most everything I need and being able to run Python/Shell code in cells has covered most everything else.

happyhotpocket 9y ago

Maybe I'm just missing something but where is the name of the package? How do I install this? Is it an `apt-get install cockpit`? I don't see that written anywhere obvious.

burdzwastaken 9y ago
click your distribution (I assume Ubuntu?) here to reveal the way to install it http://cockpit-project.org/running.html http://cockpit-project.org/running.html. if you are running Ubuntu seems to require backports for anything below 17.04 though.
- jniles 9y ago
  I also had this question and it took me about 5 minutes to figure out that you needed to click to reveal. It's fancy, but not at all practical. Hopefully someone updates it to just a flat list.
tombrossman 9y ago
> Is it an `apt-get install cockpit`? Yes. Assuming a debian-based distro, try "apt-cache search cockpit" and it comes right up. To see the available version try "apt-cache madison cockpit" which returns (on my Ubuntu 16.04 desktop) "cockpit | 161-1~ubuntu16.04.1 | ..."

sgeisler 9y ago

I've just watched a presentation [0] linked by someone else in this thread and am quite impressed by the architecture and UX shown. But it seems to me that Cockpit is more about monitoring and doing ad-hoc changes and not permanent configuration. I base that assumption on the fact that for example there are multiple places where one can configure network interfaces in debian and there is no cli tool or api to persist network configuration created with ip (at least to my knowledge). I can imagine parsing and editing fstab automatically and 100% correctly to be tricky too. On the other hand enabling or disabling systemd services is permanent by default and there are probably more cli tools that automatically persist changes done through them. Can anybody more familiar to Cockpit shed some light on the persistence of most of the configuration options? [0] https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_session_in_your_browser https://media.ccc.de/v/ASG2017-99-cockpit_a_linux_sysadmin_s...

evol262 9y ago
Cockpit uses hostnamed, networkmanager, and other services for configuration, not 'ip' or 'hostname'. Everything you can see is persistent.
- sgeisler 9y ago
  Thank you very much for clearing this up. Since I'm not familiar with networkmanager in combination with other config: what happens if I configure some network interface using Cockpit that is already defined in /etc/network/interfaces.d/*? Will it just throw an error or could it bring my system into a broken/undefined state so that it wouldn't be reachable after the next reboot? If the latter is the case it would probably be unwise to install/use Cockpit on an already configured system.
  - evol262 9y ago
    NetworkManager handles the config file management on its own. Debian appears to require a flag to enable this on its own: https://wiki.debian.org/NetworkManager#Enabling_Interface_Management https://wiki.debian.org/NetworkManager#Enabling_Interface_Ma... If it's enabled, networkmanager will parse out the files and present them over dbus, nmcli, etc. Changes with nmcli, gnome-network (which also uses NM), or other tooling will update the config files. The same ones in /etc/network/interfaces.d/ So, hypothetically: auto eth0 iface eth0 inet static address 192.168.40.112 netmask 255.255.255.0 gateway 192.168.40.1 dns-nameservers 8.8.8.8 NM/Cockpit will show all of this information. If you change the address to 192.168.40.113, the config file will be updated (but otherwise unchanged), and the address will change on the running interface. If it's not enabled, Cockpit will not see the interfaces at all.

themtutty 9y ago

@authors The "Try it out" page shows nothing about where to get Cockpit or how to configure and run it. #plsfix

gtfierro 9y ago
It could definitely be clearer, but if you click on the name of the operating systems on that page, they'll produce a little dialog that tells you how to run Cockpit.
nreece 9y ago
sudo apt-get install cockpit

cztomsik 9y ago

This is great! I've noticed you're using jquery (and that's fine) so what is YOUR opinion about current state of js? Are you considering any js framework? And if so, which one would it be and why?

throwawaymanbot 9y ago

Its kind of annoying this is on Ubuntu by default from 17.10 onwards. Badly configured internet facing servers... now have a GUI.