How to Install Cockpit on Oracle Enterprise Linux 9: A Step-by-Step Guide

Introduction

Not everything needs to be done over SSH. Cockpit gives you a web console for a Linux box: services, storage, logs, network, a terminal if you want one. It’s genuinely useful for the routine checks, and for handing limited access to someone who should not be living in a shell. Here’s how to get it running on Oracle Enterprise Linux 9.

What is Cockpit?

Cockpit is a web-based server administration tool maintained by Red Hat. It reads the system’s actual state rather than keeping its own configuration, so anything you change through it is a normal systemd or firewalld change underneath. Nothing to undo if you stop using it, and nothing that will surprise you when you go back to the command line.

Prerequisites

A running Oracle Enterprise Linux 9 server
A user account with sudo privileges
Internet connection

Step 1: Update Your System

Worth doing before installing anything, if only so you know a later problem wasn’t already sitting there:


sudo dnf update -y

Step 2: Install Cockpit

It’s in the default OEL9 repositories, so there’s no repo to add:


sudo dnf install cockpit -y

Step 3: Enable and Start the Cockpit Service

Note that you enable the socket, not the service. Cockpit is socket-activated, so systemd listens on the port and only starts the web service when someone actually connects. Nothing sits in memory the rest of the time.


sudo systemctl enable --now cockpit.socket
Created symlink /etc/systemd/system/sockets.target.wants/cockpit.socket → /usr/lib/systemd/system/cockpit.socket.
sudo systemctl start cockpit.socket
sudo systemctl status cockpit.socket
● cockpit.socket - Cockpit Web Service Socket
     Loaded: loaded (/usr/lib/systemd/system/cockpit.socket; enabled; preset: disabled)
     Active: active (listening)

Step 4: Configure the Firewall

Cockpit listens on 9090. firewalld ships a service definition for it already, so you don’t need to open the port by number:


sudo systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)
     Active: active (running) 
sudo firewall-cmd --add-service=cockpit --permanent
success
sudo firewall-cmd --reload
success

Step 5: Access the Cockpit Web Interface

Open it in a browser. It’s HTTPS, and on a fresh install the certificate is self-signed, so expect a warning the first time:


https://<your-server-ip>:9090

Log in with your normal system account. Cockpit uses PAM, so it’s the same credentials you would use at the console, and sudo rights carry across.

Conclusion

That’s the whole install. Cockpit won’t replace the command line for anything complicated, and it’s not meant to, but for checking why a service died or what is filling a disk it’s quicker than reconstructing the same picture from four separate commands.

Final Tips

Don’t expose 9090 to the internet. Reach it over a VPN, or through an SSH tunnel, and leave the firewall rule scoped to your internal network.
Replace the self-signed certificate if more than one person will use it, otherwise everyone learns to click through browser warnings.
The optional packages are worth a look: cockpit-storaged for disks, cockpit-podman for containers, cockpit-machines for VMs.