Server Authentication & Isolated Architecture
An engineering guide to connecting remote Linux infrastructure using IP & Password, SSH Key Pairs, and sandboxed telemetry.
Browser Enclave
WebCrypto engine handles client-side key parsing and payload framing. Sensitive bytes reside strictly in volatile heap memory.
Blind Socket Relay
Low-latency ephemeral proxy streams raw SSH packets. No payload decryption, no telemetry interception, zero packet caching.
OpenSSH Daemon
Your server's standard port 22 daemon. Processes authentication natively via Linux PAM without third-party agents.
IP & Password Authentication
Direct root or sudo credentials over standard SSH. When bootstrapping a fresh server from Hetzner, DigitalOcean, AWS Lightsail, Linode, or Vultr, cloud providers immediately assign a public IP address and an initial root password.
Cockpit allows you to input these exact parameters directly into the browser. Within 200 milliseconds, an SSH handshake is negotiated directly with your machine's native OpenSSH daemon.
How Password Handshake Works
- 01Ephemeral Session Initialization: Your password is piped through an encrypted WebSocket channel directly into the OpenSSH RFC 4252 userauth exchange.
- 02Native Linux PAM Validation: OpenSSH on your server verifies the password against
/etc/shadowthrough standard PAM (Pluggable Authentication Modules). - 03Zero-Storage Guarantee: The password is never serialized into a database, Redis cache, log file, or cookies. Closing the browser tab destroys the memory allocation instantly.
SSH Key Pair Authentication
Ed25519 & RSA encrypted private key authentication. For production hosts where PasswordAuthentication no is enforced in /etc/ssh/sshd_config, Cockpit provides first-class cryptographic key-pair support.
Unlike traditional cloud panels that demand uploading your private key to their remote backend server, Cockpit handles private key signing in client-side WebCrypto RAM:
Client-Side Key Enclave
High-speed elliptic curve signatures (256-bit). Minimal memory footprint with maximal resistance against side-channel timing attacks.
Standard legacy format supported across all Linux distributions and enterprise hardware bastion servers.
Agentless by Default, Fully Isolated Agent When Needed
Most infrastructure panels force a rigid choice: either an unmonitored SSH script that breaks under load, or a bloated proprietary root daemon that permanently alters your host environment.
Cockpit bridges this with a dual-mode approach: agentless by default for instantaneous zero-install access, and our own purpose-built, fully isolated agent for specialized background tasks.
Agentless Native SSH
Used for ad-hoc terminal work, emergency access, and standard administration. Directly reads /proc and uses standard POSIX utilities over SSH. Zero disk artifacts left behind.
Cockpit Isolated Agent
Used when you need persistent background metrics, real-time process monitoring, or automated deployment triggers when your browser window is disconnected.
How Our Agent Maintains Total Isolation
- 01Sandboxed Container / Scoped Process: Runs in strict isolation (Docker/OIDC container or unprivileged systemd slice). It has zero access to host credentials or foreign directory trees.
- 02Outbound-Only Encrypted Tunnel: The agent never opens incoming listening ports on your server. It initiates an outbound mutual-TLS/WSS connection to Cockpit, preserving your firewall and security groups.
- 03Minimal Resource Envelope: Consumes under 15MB of RAM with sub-0.5% CPU utilization. It does not overwrite system binaries, shared libraries, or kernel configurations.
Any Linux Host: Cloud, VPS, & Bare Metal
Ubuntu, Debian, RHEL, CentOS, Rocky Linux, Arch Linux, Alpine, and cloud VMs. Because Cockpit does not compile kernel modules or bind to specific packaging ecosystems (APT, DNF, Pacman, APK), it runs identically across any distribution with an OpenSSH daemon.
Verifying on your server
Because Cockpit connects purely through OpenSSH, your Linux kernel logs the session through native PAM and systemd journal facilities. You can watch the connection live on your machine:
sshd[12480]: pam_unix(sshd:session): session opened for user root by (uid=0)
Experience visual Linux management
Connect any Linux server directly from your browser. Completely free forever, zero tracking, zero installation.