Detections
Analytics

2.1.3 Ensure cockpit web services are not in use

Information

cockpit Web services provide the ability to remotely administer the system via a web browser.

Unless there is a local site approved requirement for remote web based administration on the system, cockpit web server packages should be removed to reduce the potential attack surface.

Solution

Run the following commands to stop cockpit.socket, and cockpit.service, and remove the cockpit-ws package:

# systemctl stop cockpit.socket cockpit.service
# dnf remove cockpit-ws

- OR -

- IF - a package is installed and is required for dependencies:

Run the following commands to stop and mask cockpit.socket, and cockpit.service :

# systemctl stop cockpit.socket cockpit.service
# systemctl mask cockpit.socket cockpit.service

Impact:

Removal of cockpit web service packages will remove the ability for remote web administration of that system.

- IF - the cockpit web services package is required for a dependency, any related service or socket should be stopped and masked.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 62e896008be22c7fec661e34296d08c5ec867d47c100bf60793980c3099279cf