Introduction
Not everything needs to be done over SSH. Cockpit gives you a web console for a Linux box: services, storage, logs, network, a terminal if you want one. It’s genuinely useful for the routine checks, and for handing limited access to someone who should not be living in a shell. Here’s how to get it running on Oracle Enterprise Linux 9.
What is Cockpit?
Cockpit is a web-based server administration tool maintained by Red Hat. It reads the system’s actual state rather than keeping its own configuration, so anything you change through it is a normal systemd or firewalld change underneath. Nothing to undo if you stop using it, and nothing that will surprise you when you go back to the command line.
Prerequisites
- A running Oracle Enterprise Linux 9 server
- A user account with sudo privileges
- Internet connection
Step 1: Update Your System
Worth doing before installing anything, if only so you know a later problem wasn’t already sitting there:
sudo dnf update -y
Step 2: Install Cockpit
It’s in the default OEL9 repositories, so there’s no repo to add:
sudo dnf install cockpit -y
Step 3: Enable and Start the Cockpit Service
Note that you enable the socket, not the service. Cockpit is socket-activated, so systemd listens on the port and only starts the web service when someone actually connects. Nothing sits in memory the rest of the time.
sudo systemctl enable --now cockpit.socket Created symlink /etc/systemd/system/sockets.target.wants/cockpit.socket → /usr/lib/systemd/system/cockpit.socket. sudo systemctl start cockpit.socket sudo systemctl status cockpit.socket ● cockpit.socket - Cockpit Web Service Socket Loaded: loaded (/usr/lib/systemd/system/cockpit.socket; enabled; preset: disabled) Active: active (listening)
Step 4: Configure the Firewall
Cockpit listens on 9090. firewalld ships a service definition for it already, so you don’t need to open the port by number:
sudo systemctl status firewalld.service ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled) Active: active (running) sudo firewall-cmd --add-service=cockpit --permanent success sudo firewall-cmd --reload success
Step 5: Access the Cockpit Web Interface
Open it in a browser. It’s HTTPS, and on a fresh install the certificate is self-signed, so expect a warning the first time:
https://<your-server-ip>:9090
Log in with your normal system account. Cockpit uses PAM, so it’s the same credentials you would use at the console, and sudo rights carry across.
Conclusion
That’s the whole install. Cockpit won’t replace the command line for anything complicated, and it’s not meant to, but for checking why a service died or what is filling a disk it’s quicker than reconstructing the same picture from four separate commands.
Final Tips
- Don’t expose 9090 to the internet. Reach it over a VPN, or through an SSH tunnel, and leave the firewall rule scoped to your internal network.
- Replace the self-signed certificate if more than one person will use it, otherwise everyone learns to click through browser warnings.
- The optional packages are worth a look: cockpit-storaged for disks, cockpit-podman for containers, cockpit-machines for VMs.
