How to Install Cockpit on Debian

Cockpit is a web-based server management interface that makes it easy to administer your Linux servers through a browser. This guide covers installation on Debian systems.

What is Cockpit?

Cockpit is a lightweight, web-based administration tool that allows you to:

• Monitor system resources and performance
• Manage services and containers
• Configure networking
• Update software packages
• Access the terminal through your browser
• And much more!

Requirements

• Debian 10 (Buster) or later
• Root or sudo access
• A POSIX compatible shell like bash

Note: If you're using a shell like fish, temporarily run bash -i before executing these commands.

Installation Steps

Step 1: Enable Backports Repository (Recommended)

To get the latest version of Cockpit, it's recommended to enable the backports repository.

Run the following commands as root or with sudo:

. /etc/os-release
echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" > \
  /etc/apt/sources.list.d/backports.list
apt update

Step 2: Install Cockpit

Install Cockpit from the backports repository:

apt install -t ${VERSION_CODENAME}-backports cockpit

Important: When updating Cockpit-related packages and any dependencies in the future, make sure to use -t ${VERSION_CODENAME}-backports as shown above, so backports are included.

Step 3: Enable Cockpit

Enable and start the Cockpit socket:

systemctl enable --now cockpit.socket

Step 4: Open Firewall (if applicable)

If you're running a firewall, you may need to open port 9090:

firewall-cmd --add-service=cockpit
firewall-cmd --add-service=cockpit --permanent

Or if you're using UFW:

ufw allow 9090/tcp

Accessing Cockpit

Once installed, you can access Cockpit by pointing your web browser to:

https://ip-address-of-machine:9090

Example:

https://192.168.1.100:9090

Login Credentials

Important: Root login is disabled by default in Cockpit for security reasons. You must use a regular user account to log in.

If you don't have a regular user account yet, create one before accessing Cockpit:

# Create a new user (replace 'username' with your desired username)
adduser username

# Add the user to the sudo group for administrative privileges
usermod -aG sudo username

Once you have a regular user account, use that account's credentials to log in to Cockpit. Users with sudo privileges will have full administrative access through the web interface.

Recommended Browsers

Cockpit works best with:

• Mozilla Firefox (version 82 or later)
• Google Chrome (version 88 or later)
• Microsoft Edge (version 88 or later)
• Apple Safari (version 14.5 or later)

Security Note: Always use the latest version of your browser for security reasons.

Updating Cockpit

To update Cockpit to the latest version from backports:

. /etc/os-release
apt update
apt install -t ${VERSION_CODENAME}-backports cockpit

Additional Applications

After installing Cockpit, you can install additional modules to extend its functionality:

apt install -t ${VERSION_CODENAME}-backports cockpit-machines    # Virtual machine management
apt install -t ${VERSION_CODENAME}-backports cockpit-podman      # Container management
apt install -t ${VERSION_CODENAME}-backports cockpit-packagekit  # Software updates
apt install -t ${VERSION_CODENAME}-backports cockpit-networkmanager  # Network configuration

Troubleshooting

Can't Access Cockpit Web Interface

• Verify the service is running: systemctl status cockpit.socket
• Check if port 9090 is open: ss -tlnp | grep 9090
• Ensure your firewall allows connections on port 9090
• Try accessing from https://localhost:9090 on the server itself

SSL Certificate Warning

The first time you access Cockpit, your browser may show a security warning about the SSL certificate. This is normal because Cockpit uses a self-signed certificate by default. You can safely proceed or configure your own SSL certificate.

Login Issues

• Verify your username and password are correct
• Ensure the user account exists on the system: id username
• Check if PAM authentication is working: journalctl -u cockpit

Security Considerations

• Cockpit uses your system's PAM authentication
• All communication is encrypted via HTTPS
• Consider using SSH key authentication instead of passwords
• Regularly update Cockpit and your system for security patches
• Use a firewall to restrict access to port 9090 to trusted networks only

Uninstalling Cockpit

If you need to remove Cockpit:

systemctl disable --now cockpit.socket
apt remove cockpit
apt autoremove