Add option to disable web portal

[10leej]

Page:Web portal

Basically I have cockpit installed on the webserver, and I want to use it, but I only want to access it via a connected instance from my homelab. So for security hardening I want to disable the web portal on the webserver.
I know the importance of complicated passwords and do run fail2ban and monitor login attempts. But ultimately I'd prefer to just disable the web portal on localhost:9090 since I already connect to cockpit via a local instance.
I did not see an option to do this in the documentation listed in here

https://cockpit-project.org/guide/latest/

[martinpitt]

I'd recommend not installing/removing cockpit-ws completely from that critical server, and only have the cockpit webserver on some less critical or better isolated machine -- like your laptop/workstation. You can then add your server as a "remote" machine in the left menu, or directly log into it from the login page. See https://cockpit-project.org/guide/latest/authentication.html#secondary-auth

Alternatively, use the firewall to restrict access to port 9090.

[10leej]

the problem with that is the in both rhel and debian all the cockpit tools list lists cockpit-ws as a dependency and removing that makes the respective package managers complain a lot when doing basic system maintenance. I'd rather cockpit-ws be able to be disabled to avoid that bit of annoyance.
I guess I can restrict port 9090, but IMO just being able to disable cockpit-ws in /etc/cockpit/cockpit.conf would be the better option to better reduce attack surface, as well as freeing up system resources. Not that it's a heavy application to begin with, I just dont see why we'd dedicate cpu/memory cycles to something that would be non functional.

[martinpitt]

Only the full "cockpit" metapackage depends on cockpit-ws. It is perfectly fine to only install cockpit-system, cockpit-networkmanager, etc., but not the cockpit metapackage and cockpit-ws.

That said, you can of course leave cockpit-ws installed, but just diable it:

sudo systemctl disable --now cockpit.socket

Then it's just "dead bits" on the hard disk. 😁

I just dont see why we'd dedicate cpu/memory cycles to something that would be non functional.

This never happens. cockpit's web server is socket activated, and quits itself (cockpit.service) when it is idle. The only thing that keeps running is cockpit.socket, which is trivial.