Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cockpit – Integrated, glanceable, web-based interface for servers

cockpit-project.org

Post reply on HN
Print view View original

101–110 of 130 posts

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#101

Post by effie »

numpad0 wrote: post #50
luplex wrote: post #35

Is there a reason why successfully running software on a server is so much harder than running software on your phone? I don't think it needs to be this way. Someone needs to figure out server software for consumers. Just like PCs became more accessible, so should servers! Edit: Brainstorming here: specifically, I'd like a more accessible UI, automatic updates, sensible defaults on all apps, an easier way to get star…

Because you don’t run your own apps on your phone, it’s some developer’s app on a phone paid by you

This. You want control? You do the work. On a phone, the only easy part is being a user/consumer.

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#102

Post by robbyt »

It looks like this is written in Javascript with C backend components. I would never trust giving root to a web service written in C.

If anyone deploys this, make sure to bind only to localhost, and use an ssh tunnel to access it remotely, otherwise you're opening a massive attack surface.

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#103

Post by lmns »

chousuke wrote: post #92
tinco wrote: post #89

Earlier quoted context omitted.

Tried it on ubuntu, it also has weirdness there. The whole tool is definitely rough around the edges. I would never use it to actually change machines though. Definitely Ansible over SSH is the way to go there. I've mixed feelings about controlling the machines through cockpit. In theory there shouldn't be any difference between SSH and HTTPS on the security of the protocol side, but it definitely feels iffy to have…

I have to admit the Cockpit architecture is not entirely clear to me, but at least it seems to allow using SSH as a remote transport, so you don't actually need to install the web stuff on all servers. GUIs are great for discoverability and observation, but they always make my life harder when I actually need to manage change in a system. As simple as it is, there's so far nothing that beats plain old text as the sou…

You could have the best of both worlds and only modify the state of your system through a well defined API and then serialize the change in some kind of config file if and only if the change was successful (rollback to the last good state otherwise).

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#104

Post by jpswade »

I’ve actually been investigating cPanel alternatives as it’s become expensive and I think customers should have choice.

I find it interesting that I didn’t come across this one in all of my research I did last week or so, even though it’s backed by Redhat.

I actually think although we’re in a time of striving for serverless, there will always be a market for self hosting, be it niche.

Not everyone is building a huge SaaS platform but wants to run more than just a blog or website.

I don’t think this is the answer though. I think what these type of servers need is a standardised layer to interact with them, an API, something like how we have EPP for domains.

Because as we know, frontend will change so fast. The underlying hardware and OS changes too. Now seems like the right time to invent a new level of abstraction.

I’m not aware of anything that exists like this.

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#105

Post by m4lvin »

luplex wrote: post #35

Is there a reason why successfully running software on a server is so much harder than running software on your phone? I don't think it needs to be this way. Someone needs to figure out server software for consumers. Just like PCs became more accessible, so should servers! Edit: Brainstorming here: specifically, I'd like a more accessible UI, automatic updates, sensible defaults on all apps, an easier way to get star…

Besides cloudron and sandstorm, yunohost is another alternative for this: https://yunohost.org/

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#106

Post by m4rtink »

rapsey wrote: post #78

This is pretty cool but honestly why is this written in c. For no reason you are increasing the attack surface of your users.

Sure, security of a piece of software is always fully dependent on the programming language it is written on. /s

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#107

Post by mbreese »

effie wrote: post #96
qbasic_forever wrote: post #55

Earlier quoted context omitted.

I think you're asking a perfectly valid question. IMHO authentication is still an enormous mess and new standards like OAuth did nothing to improve it on the server side. On your phone app store there's a strong and trusted source of identity coming from Apple or Google. They know who you are, what you're allowed to do, etc. and can delegate that authority to your apps. On the server though... welcome to the wild wes…

It seems to me you are making it needlessly complicated (LDAP...). There are many tools for authenticated access to server with minimal cost in terms of administration. TLS+Letsencrypt+Basic HTTP auth, SSH, OpenVPN, Wireguard, etc.

If you’re using N+1 servers that have multiple users, then you definitely want some kind of centralized user management. It doesn’t matter how you connect to the server (ssh, etc). Those won’t solve the problem of keeping user account information in sync between the servers. You still need some way to keep account information (username, password, public keys) consistent between the servers.

That’s what the GP post was comparing to.

I use LDAP to manage access to multiple servers and it’s more work to setup than /etc/passwd, but much easier to keep things in sync.

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#108

Post by e12e »

effie wrote: post #100
e12e wrote: post #37

Earlier quoted context omitted.

It's not a trivial thing - docker and sandstorm.io might be two examples of making some decent headway here. Just today I set up a postgres and ms sql server for testing - pretty much identically, running out of their own named docker containers (for those not aware, it's even more similar than it sounds, ms sql runs on Linux now).

Why do you want to run MS SQL on Linux? What will you do when the db gets locked or crashes? You call Microsoft and wait?

For development - I was waiting for a dba to sort access to the new prod server, and needed to check that the current app build was minimally working correctly talking to an ms sql instance. It might be interesting to run in CI as well.

Running any rdbms in production in docker isn't a great idea. But for dev and test it can be great.

For my use case, we deploy mostly to traditional setup (dedicated sql server) - but I could also see it useful for prototyping deployment to mssql in azure cloud.

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#109

Post by freedomben »

Cockpit is super cool. I've been using it for personal stuff for years now, especially since it's trivial to enable and use.

I even use it in production for monitoring small sites/apps. The graphs for CPU/Mem/Network/Disk are really great, and I can leave them open in a tab on my browser. I run one fairly popular blog that as a web machine and a db machine, and it's great for that.

That said I don't use it for "serious production" where I have more than a couple of machines simply because at that scale I prefer cattle to pets and I prefer aggregation.

I also find myself strongly preferring SSH and the CLI, likely because I'm very familiar with all that and have been doing that for decades.

I've never heard of security issues with Cockpit, but I do firewall it off from everyone but my own IP (or a few others if they are involved). It's pretty easy to do:

    # Get your IP address from home or work:  curl -s 'https://api.ipify.org'
    MY_IP=

    firewall-cmd --zone-public --permanent --remove-service=cockpit
    firewall-cmd --zone=public --permanent \
      --add-rich-rule="rule family=\"ipv4\" source address=\"${MY_IP}\" port protocol=\"tcp\" port=\"9090\" accept"
    firewall-cmd --reload
Here's a gist of it: https://gist.github.com/FreedomBen/0aabe5493ba02d1c9bb33fea2...

Re: Cockpit – Integrated, glanceable, web-based interface for servers

#110

Post by rapsey »

m4rtink wrote: post #106
rapsey wrote: post #78

This is pretty cool but honestly why is this written in c. For no reason you are increasing the attack surface of your users.

Sure, security of a piece of software is always fully dependent on the programming language it is written on. /s

Name a popular C lib that has not had memory safety issues.
Post reply on HN