Bug 1495506

Summary: Can't access Cockpit UI on RHEL hosts
Product: Red Hat Enterprise Linux 7 Reporter: Sarvesh Pandit <sapandit>
Component: cockpitAssignee: Martin Pitt <mpitt>
Status: CLOSED INSUFFICIENT_DATA QA Contact: qe-baseos-daemons
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.4CC: dfediuck, mpitt, sapandit
Target Milestone: pre-dev-freeze   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-23 12:00:51 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sarvesh Pandit 2017-09-26 08:31:27 UTC 
Description of problem: Without adding 9090 port, Cockpit UI can't be accessed.

Version-Release number of selected component (if applicable):
cockpit-system-138-9.el7.noarch
cockpit-storaged-148-1.el7.noarch
cockpit-bridge-138-9.el7.x86_64
cockpit-ovirt-dashboard-0.10.8-2.2.ovirt41.el7ev.noarch
cockpit-ws-138-9.el7.x86_64
kernel-3.10.0-693.2.2.el7.x86_64

How reproducible: 100%

Steps to Reproduce:
1. Install RHEL 7.4 and subscribe RHV repos

2. Install cockpit-ovirt-dashboard:
# yum install cockpit-ovirt-dashboard

3. Enable and start cockpit socket:
# systemctl enable cockpit.socket
# systemctl start cockpit.socket

4. Access Cockpit UI

Actual results:
Can't access Cockpit UI via browser

Expected results:
Should be able to access Cockpit UI via browser

Additional info:
There is workaround:

# firewall-cmd --permanent --add-port=9090/tcp
success
# firewall-cmd --permanent --add-port=9090/udp
success
# firewall-cmd --reload
success

Ideally installing package or enabling service should take of adding port to firewall-policy but it is not happening. Either documentation link (https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.1/html/installation_guide/installing_cockpit_on_linux_hosts) has to be updated with steps or fix in package.
Comment 2 Peter 2017-09-26 12:35:45 UTC 
The package cockpit-ws adds 

/usr/lib/firewalld/services/cockpit.xml

and then in the post section runs

test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true

Can you run that command and see if maybe there is an error that the || true suppresses.
Comment 3 Sarvesh Pandit 2017-09-26 12:52:17 UTC 
It was beaker system. Now, I have applied the workaround and don't have fresh 7.4 host. Should I still try that command on that host?
Comment 4 Peter 2017-09-26 12:53:56 UTC 
You can, but might be more useful on a system that is actually showing the problem.
Comment 5 Sarvesh Pandit 2017-09-27 05:03:58 UTC 
Here is output:

# test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true
# echo $?
0

No error :(
Comment 6 Peter 2017-09-27 05:14:25 UTC 
Did you remove the || true? that makes sure it always returns 0. But if there was no error output it probably succeeded.
Comment 7 Sarvesh Pandit 2017-09-27 06:20:12 UTC 
I didn't remove.

Now, I have removed:

# test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet
# echo $?
1

These 9090 port were manually added:

# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: em1
  sources: 
  services: ssh dhcpv6-client
  ports: 9090/tcp 9090/udp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:
Comment 8 Martin Pitt 2018-01-22 12:11:51 UTC 
So to confirm, if you run `firewall-cmd --reload` it fails? (Please drop the --quiet). Does it show any output without the --quiet?

If that fails, the bug should be reassigned to firewalld.
Comment 9 Martin Pitt 2018-01-22 12:13:04 UTC 
> # test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet

Note: This doesn't work literally in a shell, as the `{_bindir}` is an rpm macro which is only valid in a spec file and changed during package build. So please just run "firewall-cmd ..." without the `test` command.
Comment 10 Sarvesh Pandit 2018-02-26 15:47:06 UTC 
Hello Martin,

Apology for delay in response.

I don't have that setup with me to try out.
Comment 11 Martin Pitt 2018-03-02 09:34:19 UTC 
Putting needsinfo back. "I don't have that setup with me" sounds like you still have access to it in general? If not, let's just close this bug. Thanks!
Comment 12 Sarvesh Pandit 2018-04-23 11:45:14 UTC 
Yes. you can close this bug, as don't have same setup.
Comment 13 Martin Pitt 2018-04-23 12:00:51 UTC 
OK, closing.