Cockpit is a free, browser-based admin console for Linux servers. It shows live CPU, memory, and disk graphs, manages services and storage, reads the system journal, and gives you a full terminal, all from port 9090. On Rocky Linux 10, it is usually installed already, which means the real work is not installing it. The real work is turning it on, opening the firewall the right way, logging in without root, and locking it down so a management interface does not become your weakest point.
Quick Outline
- What Cockpit Gives You on a Rocky Linux Server 10
- How to Install and Configure Cockpit on Rocky Linux 10
- Troubleshooting Real Problems
- Conclusion
- Frequently Asked Questions
What Cockpit Gives You on a Rocky Linux Server 10
Cockpit talks to the same tools you would use over SSH. It reads logs through journald, manages networking through NetworkManager, controls services through systemd, and handles updates through PackageKit. Nothing in it replaces the command line. It simply puts those tools in one place, which helps when you are checking a server quickly, handing access to a teammate who prefers a dashboard, or managing storage visually.
One design choice is worth knowing about. Cockpit uses systemd socket activation, so the web service does not sit in memory all day. It starts when someone opens the page and exits again after the last session closes. That keeps the footprint small on a lean VPS.
How to Install and Configure Cockpit on Rocky Linux 10
Learn how to install and configure Cockpit on Rocky Linux 10 to manage your Linux server through a web-based interface without relying on command-line tools for every task. This step-by-step guide covers Cockpit installation, service activation, firewall configuration, and secure web access for monitoring system performance, services, storage, and logs.
Quick Answer
To install and configure Cockpit on Rocky Linux 10, install the Cockpit package using DNF, enable and start the Cockpit service, and configure the firewall to allow access on port 9090. Then, open https://your-server-ip:9090 in a web browser and log in with your Linux user credentials to manage system services, monitor performance, review logs, and configure storage through Cockpit’s web-based interface.
Step 1: Check Whether Cockpit Is Already Installed
Rocky Linux 10 images often include it. Check before installing anything:
| rpm -q cockpit |
|---|
If you get a package name and version back, skip ahead. If the package is missing, install it:
| sudo dnf install -y cockpit |
|---|
Step 2: Enable the Cockpit Socket
Enable the socket rather than the service, since the socket is what listens for connections:
| sudo systemctl enable –now cockpit.socket |
|---|
Confirm it is listening:
| sudo systemctl status cockpit.socket |
|---|
You want to see active (listening) with port 9090 in the output. Do not worry if cockpit.service shows as inactive. That is normal until someone connects.
Step 3: Open the Firewall Using the Cockpit Service
Rocky Linux runs firewalld by default. Use the predefined service instead of opening the raw port, because the service definition stays correct even if you change the port later:
|
sudo firewall-cmd –permanent –add-service=cockpit
sudo firewall-cmd –reload sudo firewall-cmd –list-services |
|---|
If you run this on a cloud VPS and the page still will not load, the block is probably outside the server. Check the provider’s security group or network firewall for port 9090 as well. This catches a surprising number of people who assume firewalld is the only gatekeeper.
Step 4: Log In Without Root
Open a browser and visit your server:
| https://your-server-ip:9090 |
|---|
Your browser will warn about the certificate because Cockpit generates a self-signed one on first start.
Log in with a regular user account. If you try root, Cockpit will reject it even with the correct password. That is deliberate, since the file /etc/cockpit/disallowed-users lists root by default.
Leave it that way. Create a normal administrator instead:
|
sudo useradd -m -G wheel adminuser
sudo passwd adminuser |
|---|
Members of the wheel group can gain administrative access inside Cockpit. If you log in and see a banner saying the console is in limited access mode, click Turn on administrative access and re-enter your password. That banner simply means the session has not been elevated yet, and it also appears when a user is not in wheel.
Step 5: Install the Modules You Actually Need
The base package covers the system overview, logs, services, terminal, and accounts. Everything else is a separate module, so install only what matches your server’s job:
| Module | What it adds |
|---|---|
| cockpit-storaged | Disk, LVM, software RAID, NFS, and iSCSI management |
| cockpit-podman | Run and inspect Podman containers |
| cockpit-machines | Create and manage KVM virtual machines (needs libvirt) |
| cockpit-networkmanager | Interface, bond, bridge, and VLAN configuration |
| cockpit-packagekit | Software updates from the browser |
| cockpit-selinux | Readable SELinux denial reports and fix suggestions |
Install a set in one command:
| sudo dnf install -y cockpit-storaged cockpit-podman cockpit-selinux |
|---|
Some of these may already be present, and dnf will tell you. For virtual machines, add libvirt and start it:
|
sudo dnf install -y cockpit-machines libvirt
sudo systemctl enable –now libvirtd |
|---|
The storage module pairs well with the volume management and iSCSI topics we covered in our other guides, since it lets you build and inspect LVM and RAID layouts without memorizing every flag.
Step 6: Change the Port (Only If You Need To)
You cannot change the port in cockpit.conf. Cockpit takes it from the systemd socket, and on SELinux systems the new port needs a label too. Do all three pieces together, or it will fail:
|
sudo semanage port -a -t websm_port_t -p tcp 9443
sudo firewall-cmd –permanent –service=cockpit –add-port=9443/tcp sudo firewall-cmd –reload |
|---|
In the editor that opens, add these lines, with the empty line first so the default is cleared:
|
[Socket]
ListenStream= ListenStream=9443 |
|---|
Then restart the socket:
| sudo systemctl restart cockpit.socket |
|---|
Troubleshooting Real Problems
Connection refused or timing out. Check that something is listening with sudo ss -tlnp | grep 9090, then check firewalld, then check your cloud provider’s rules, in that order.
Correct password; login still fails. The account is probably listed in /etc/cockpit/disallowed-users, or you are trying to root. Use a normal wheel user.
The browser still shows the old certificate. Cockpit only reloads certificates when the service restarts. Run sudo systemctl stop cockpit.service and reload the page.
Port change does nothing. One of the three pieces is missing. The SELinux label, the firewall rule, and the socket override all have to match.
Conclusion
Cockpit on Rocky Linux 10 is quick to get running, since it is often installed already and needs only the socket enabled and one firewall command. What separates a tidy setup from a risky one is everything after that. Log in with a normal wheel account, install only the modules your server needs, swap in a real certificate, set an idle timeout, and limit who can reach the port. Done that way, Cockpit becomes a dependable second view into your server rather than another exposed service to worry about.
Frequently Asked Questions
1. Is Cockpit installed by default on Rocky Linux 10?
Often, yes. Many Rocky Linux 10 images ship with Cockpit already present, so you only need to enable cockpit.socket. Run rpm -q cockpit to check, and install it with sudo dnf install -y cockpit if the package is missing.
2. What port does Cockpit use, and how do I open it?
Cockpit listens on TCP port 9090 by default. Open it in firewalld with sudo firewall-cmd –permanent –add-service=cockpit followed by a reload. On a cloud server, also allow the port in your provider’s security group.
3. Why can’t I log in to Cockpit as root?
Root is blocked on purpose through the /etc/cockpit/disallowed-users file. Log in with a regular user in the wheel group instead, then use the administrative access toggle inside Cockpit when you need elevated privileges.
4. Can Cockpit manage virtual machines and containers on Rocky Linux?
Yes, through add-on modules. Install cockpit-machines with libvirt for KVM virtual machines, and cockpit-podman for containers. Neither is part of the base package, so you add them only if you need them.
5. How do I make Cockpit stop showing the certificate warning?
Replace the self-signed certificate with a trusted one. Place a .cert file and a matching .key file in /etc/cockpit/ws-certs.d/, stop cockpit.service so it reloads, and the browser warning disappears as long as you visit the hostname the certificate was issued for.
Leave feedback about this