How to close port 9090 nicely

[craff]

The documentation says the server that are added to an external cockpit machine do not need to listen to the 9090 port. But I failed to configure a server with the port 9090 closed. May be the documentation should give a procedure for that.

[martinpitt]

The easiest and safest is to just not install the cockpit-ws package at all. Or systemctl disable --now cockpit.socket

[craff]

Unfortunately, on debian, cockpit depends on cockpit-ws may be this is an issued with the package and its systemd configuration? I did try systemctl disable, but I did not get everything working from the remove machine. I will retry.
Do we need to listen from 9090 on localhost for remote access ?

[martinpitt]

Not "unfortunately", that's by design. The "cockpit" package is just a meta-package that depends on everything, but it's fine to remove.

I did try systemctl disable, but I did not get everything working from the remove machine.

Please add some details what you mean by this.

Do we need to listen from 9090 on localhost for remote access ?

If you only talk to that machine from another machine's cockpit session through "Add host", cockpit's web server (port 9090) does not need to run at all. If you want to run it, but restrict it to localhost only, you can do that also: see https://cockpit-project.org/guide/latest/listen.html