Add ability to disable "Other Options > Connect to"

[sparticvs]

Page: Login

This now displays "Other options > Connect to", which while I can see the value, is not something I want on my Cockpit instance - it makes it so that someone could bypass my 2FA setup, which I don't like. I'd like to be able to disable this option, even if it was just part of the config file.

[martinpitt]

Basically the same as in https://bugzilla.redhat.com/show_bug.cgi?id=2018741 . My proposed solution was to change the RequireHost option into a three-state: RemoteHost=require|allow|no.

[sparticvs]

@martinpitt thanks for the comment, I honestly didn't even look at BZ. I like your suggestion. My question is would it prohibit just on the login page or would it be across the platform entirely (meaning after logging in, would it prevent you from connecting to other hosts in VMs that are on the private networks?) [If you'd prefer, I can also move the conversation over there].

[martinpitt]

I didn't plan for the RemoteHost option to affect connecting to other hosts in a running Cockpit session. IMHO this does not make sense both conceptually and technically -- once you have a running session on the initial machine (with the login page), you can always run "ssh" directly (via the Cockpit API, if necessary on the browser console). That option should only affect the login page itself.

Does that match your expectations?

[sparticvs]

Perfect, that aligns with what I am hoping for.

[tholeb]

Hello, it seems there is an option for that in the config: WebService > LoginTo:

According to the documentation:

When set to true the Connect to option on the login screen is visible and allows logging into another server. If this option is not specified then it will be automatically detected based on whether the cockpit-ssh process is available or not.

You can just add this to your /etc/cockpit/cockpit.conf:

[WebService]
LoginTo = false # Prevent the user to log into another server

Does it helps ?

[sparticvs]

@tholeb - that is exactly what I'm looking for. Thanks!