7 ms·

Is anyone actually using this on production servers? A web user/password login with sudo powers sounds... risky. Yet managing the server through a web interfac

• szszrk 2y ago
  It's not that different from having the same user/password accessible via ssh. It's best to not have direct access to important machines anyway, and go for a bastion or similar service. But... you can switch to Kerberos SSO, or setup smart cards login instead. You can also use it kind of like a jump host and do ssh keys I to secondary server. I find it cool to give nice way to access in environments where ssh is not allowed by default, but https is. It's sometimes easier to setup proxies/reverse proxies in corporate forest instead of opting for direct ash access.
  • sneak 2y ago
    I think most people who are serious have disabled ssh password authentication.
  • rmbyrro 2y ago
    Wait, who's using SSH pass auth? Folks, private keys. Change your SSH port and use an SSH tarpit on port 22.
    • FergusArgyll 2y ago
      How necessary is it to change ssh ports? You can't really spray/brute force a private key
      • rmbyrro 2y ago
        It's not "necessary", but, when combined with a tarpit on port 22: 1. You can monitor if your private key is compromised and automatically rotate it. 2. It's fun to mess around with hackers and script kidies.
    • twosdai 2y ago
      The tarpit on 22 is amazing. I love looking at all the access logs every fee months and seeing connection attempts that last minutes.
  • worksonmine 2y ago
    > user/password accessible via ssh This is the first thing you should disable as soon as your public key is on the server.
• ammo1662 2y ago
  It depends on how you run your services. We tested it before, however it is not quite good in our case. Most of our services are running in a K8S cluster. The servers are just something we run the K8S node. If we need to patch the system, we just “drain” the node, update and add it back. So, if you do not need to directly operate the server, it will not be necessary.
• davet91 2y ago
  You don't have to run the web interface on the server. You can use Cockpit Client (from flathub) to connect with SSH.
• omnimus 2y ago
  You could also make Cocpit accesible only through VPN. Tailscale (and others) make it pretty easy.
• rmbyrro 2y ago
  It's not risky. For anything serious that can be an attractive target, it's a matter of time before getting doomed.
  • aspyct 2y ago
    That's not a reason to make it faster...
• op00to 2y ago
  Cockpit leverages the PAM stack, so you can have any authentication methodology you like.
• znpy 2y ago
  Not production servers, but I use it on my home server running RHEL (and RockyLinux in the future). I'm okay with using it instead of the shell because I know how to do stuff via the shell but I just got lazy.