cockpit remote-access
Generated reference for cockpit remote-access, including its syntax, options, results, and constraints from the canonical cockpit CLI source.
This reference is generated from the same canonical source distributed as cockpit CLI help. See Cockpit CLI for concepts and safe operating guidance.
Manage local Remote Access configuration and runtime together.
cockpit remote-access status [--verbose]
cockpit remote-access configure [--port <1024-65535>] [--scope tailscale|local] [--https true|false] [--confirm-local-network]
cockpit remote-access enable [--confirm-local-network]
cockpit remote-access disable --confirm
cockpit remote-access pairing-code [--regenerate]
cockpit remote-access certificate status|generate
cockpit remote-access tailscale status
Configuration is rejected while the server is running. Local-network scope requires --confirm-local-network for both configuration and every enable, and --scope local cannot be combined with --https true: the pair returns constraint_violated because HTTPS depends on a Tailscale certificate. Disabling requires --confirm because it ends every connected session and persists standalone mode, which cannot be undone from a remote device. Enable, pairing-code regeneration, certificate generation, and configuration of an install whose persisted mode is already server force membership verification. Status, disable, certificate status, Tailscale status, and configuration of a standalone install do not.
Pairing-code regeneration requires Remote Access to be running. Reading the pairing code while it is stopped returns code: null; regeneration instead returns remote_access_not_running so a no-op is never reported as success.
Authentication and membership failures stop a running server and persist standalone mode. A temporarily unavailable membership verifier preserves a running server and its persisted mode. Status never exposes session IDs, tokens, user agents, or authorized token sets.