Chapter 5. Configuring smart card authentication with the web console for centrally managed users

Procedure

1. Log in to the RHEL 10 web console.
2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

4. Optional: Disable password-based authentication in cockpit.conf with:

   [Basic]
   action = none

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

Procedure

1. Log in to the RHEL 10 web console.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

Procedure

1. Configure constraint delegation rules to list which hosts the ticket can access.

   • Create the following example delegation:

     • Enter the following commands to add a list of target machines a particular rule can access:

       # ipa servicedelegationtarget-add cockpit-target

       # ipa servicedelegationtarget-add-member cockpit-target \ --principals=host/host.example.com@EXAMPLE.COM \ --principals=host/remote.example.com@EXAMPLE.COM

     • To enable the web console sessions (HTTP/principal) to access that host list, use the following commands:

       # ipa servicedelegationrule-add cockpit-delegation

       # ipa servicedelegationrule-add-member cockpit-delegation \ --principals=HTTP/host.example.com@EXAMPLE.COM

       # ipa servicedelegationrule-add-target cockpit-delegation \ --servicedelegationtargets=cockpit-target

2. Enable GSS authentication in the corresponding services:

   1. For sudo, enable the pam_sss_gss module in the /etc/sssd/sssd.conf file:

      1. As root, add an entry for your domain to the /etc/sssd/sssd.conf configuration file.

         [domain/example.com]
         pam_gssapi_services = sudo, sudo-i

      2. Enable the module in the /etc/pam.d/sudo file on the first line.

         auth sufficient pam_sss_gss.so

   2. For SSH, update the GSSAPIAuthentication option in the /etc/ssh/sshd_config file to yes.

      Warning

      The delegated S4U ticket is not forwarded to remote SSH hosts when connecting to them from the web console. Authenticating to sudo on a remote host with your ticket will not work.

Verification

1. Log in to the web console using a smart card.
2. Click the Limited access button.
3. Authenticate using your smart card.
4. Alternatively: Try to connect to a different host with SSH.

Procedure

1. On the command line, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

3. To apply the changes, restart the system:

   # systemctl daemon-reload

   # systemctl stop cockpit