Cockpit on CentOS Stream 9: Enable, Restrict, Verify

The problem: managing a CentOS Stream 9 host without opening every door

You inherit a CentOS Stream 9 server and need to check journals, storage, and networking several times a day. Opening an SSH session for each check works, but it is not ideal when a teammate needs read-only visibility or when you want a quick overview without digging through command-line output. Cockpit is a systemd-backed web console packaged for CentOS Stream 9. It exposes services, logs, storage, networking, and a terminal through a browser on port 9090 with TLS. The catch is that Cockpit runs with privileged access, so exposing it carelessly creates a high-value target.

The practical takeaway: install Cockpit, enable its socket, restrict port 9090 to trusted sources with firewalld, and verify the listener before opening a browser. Prefer an SSH tunnel over exposing the console to any network you do not fully control.

Install and enable Cockpit on CentOS Stream 9

Run these commands on the CentOS Stream 9 host as root or with sudo. This example assumes firewalld is running and that you have not already installed Cockpit.

# Confirm the OS version before installing anything
cat /etc/centos-release

# Install the cockpit package
sudo dnf install -y cockpit

# Enable and start the socket-activated console
sudo systemctl enable --now cockpit.socket

cockpit.socket is socket-activated: systemd listens on port 9090 and starts the Cockpit service when a connection arrives. Because of that design, the service may not appear as a long-running process until you connect, but the socket itself should be enabled and active.

Expected checks:

• systemctl is-enabled cockpit.socket prints enabled.
• systemctl is-active cockpit.socket prints active.
• ss -ltnp | grep ':9090' shows a listener on port 9090, typically owned by systemd or cockpit-ws.

Risk: CentOS Stream is a rolling distribution. A future Stream update can change package behavior or default settings. Verify this procedure on a staging instance before applying it to production.

Decide how to expose port 9090

Do not open Cockpit to 0.0.0.0 without authentication, network restrictions, and TLS review. The default certificate is self-signed, so browsers will show a warning even when the connection is encrypted.

Two reasonable options:

• SSH tunnel (safest): From your workstation, run ssh -L 9090:localhost:9090 user@centos-stream-host. Then open https://localhost:9090 in your browser. No firewall change is required on the host.
• Firewalld rich rule for a trusted subnet: If your team needs direct browser access from a known network, allow only that subnet. Replace 192.168.1.0/24 with your trusted source.

# Run on the CentOS Stream 9 host with sudo
sudo firewall-cmd --permanent --add-rich-rule='rule family='"'"'ipv4'"'"' source address='"'"'192.168.1.0/24'"'"' port protocol='"'"'tcp'"'"' port='"'"'9090'"'"' accept'
sudo firewall-cmd --reload

Check the rule:

sudo firewall-cmd --permanent --query-rich-rule='rule family='"'"'ipv4'"'"' source address='"'"'192.168.1.0/24'"'"' port protocol='"'"'tcp'"'"' port='"'"'9090'"'"' accept'

Expect yes. If you prefer the built-in service shortcut, sudo firewall-cmd --add-service=cockpit opens port 9090 to everyone in the zone, which is less safe unless the zone itself is already restricted to trusted interfaces.

Verify from a client and check the result

From an allowed client, open https://hostname:9090, replacing hostname with the server's IP or DNS name. You should see a TLS certificate warning because Cockpit uses a self-signed certificate by default, followed by a Cockpit login page. A connection refusal means the socket is not listening or the firewall is blocking the port.

Final verification commands on the host:

rpm -q cockpit
systemctl is-enabled cockpit.socket
systemctl is-active cockpit.socket
ss -ltnp | grep ':9090'
sudo firewall-cmd --permanent --query-rich-rule='rule family='"'"'ipv4'"'"' source address='"'"'192.168.1.0/24'"'"' port protocol='"'"'tcp'"'"' port='"'"'9090'"'"' accept'

Limitations and rollback

Cockpit complements SSH key-based access, configuration management, and audit logging; it does not replace them. Default self-signed TLS should be replaced with a certificate from your internal CA or a public CA before teams rely on it daily.

Because installing the package, enabling the socket, and adding a firewall rule change system state, here is how to roll back:

sudo firewall-cmd --permanent --remove-rich-rule='rule family='"'"'ipv4'"'"' source address='"'"'192.168.1.0/24'"'"' port protocol='"'"'tcp'"'"' port='"'"'9090'"'"' accept'
sudo firewall-cmd --reload
sudo systemctl disable --now cockpit.socket
sudo dnf remove -y cockpit

After rollback, confirm ss -ltnp | grep ':9090' returns nothing and rpm -q cockpit reports that the package is not installed.

Closing

Cockpit is a useful day-to-day console for CentOS Stream 9 when it is treated as a privileged management interface and not a public service. Enable the socket, restrict port 9090 to trusted sources or an SSH tunnel, verify with systemctl and ss, and test on staging before rolling to production.