Web console restriction

[Louis garcia]

My server has four interfaces and I am trying to restrict cockpit to only listen to one of them. I am running fedora 30 with cockpit 202.1. I added listen.conf to systemd as the docs says.
is web console buggy ?

$cat /etc/systemd/system/cockpit.socket.d/listen.conf
[Socket]
ListenStream=
ListenStream=172.16.0.1:9090

When I ssh in I get:
Web console: https://172.16.0.1:9090/ or https://24.51.220.122:9090/

But cockpit only listening on 172.16.0.1:
$ss -lntu
tcp           LISTEN         0              128                       172.16.0.1:9090                        0.0.0.0:*

$ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:ec:ac:cd:65:12 brd ff:ff:ff:ff:ff:ff
    inet 24.51.220.122/21 brd 24.51.223.255 scope global dynamic noprefixroute enp1s0
       valid_lft 77843sec preferred_lft 77843sec
3: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:ec:ac:cd:65:13 brd ff:ff:ff:ff:ff:ff
    inet 172.16.0.1/16 brd 172.16.255.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
4: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:ec:ac:cd:65:14 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global noprefixroute enp3s0
       valid_lft forever preferred_lft forever
5: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether 00:ec:ac:cd:65:15 brd ff:ff:ff:ff:ff:ff

[Martin Pitt]

Hello Louis,

Louis garcia [2019-09-12 21:34 -0000]:
> My server has four interfaces and I am trying to restrict cockpit to only listen to one of them. I am running fedora 30 with cockpit 202.1. I added listen.conf to systemd as the docs says.
> is web console buggy ?
>
> $cat /etc/systemd/system/cockpit.socket.d/listen.conf
> [Socket]
> ListenStream=
> ListenStream=172.16.0.1:9090
>
> When I ssh in I get:
> Web console: https://172.16.0.1:9090/ or https://24.51.220.122:9090/

That message is wrong indeed, it shouldn't add the default route. The actual
listening socket is fine. Can you please report this at

https://github.com/cockpit-project/cockpit/issues/new?assignees=&labels=...

Thanks!

Martin

[Louis garcia]

https://github.com/cockpit-project/cockpit/issues/12800