---
canonical: "https://agi-labo.com/en/tools/cockpit/docs/cockpit-cli/reference/remote-access"
title: "cockpit remote-access"
description: "Generated reference for cockpit remote-access, including its syntax, options, results, and constraints from the canonical cockpit CLI source."
section: "Reference"
order: 118
pageType: reference
lastVerifiedVersion: 4.61.0
lastVerifiedAt: "2026-08-27"
draft: false
surfaces:
  - cli
operatingSystems:
  - windows
  - macos
  - linux
plans:
  - guest
  - member
navigation: false
---

This reference is generated from the same canonical source distributed as cockpit CLI help. See [Cockpit CLI](/en/tools/cockpit/docs/cockpit-cli) for concepts and safe operating guidance.

Manage local Remote Access configuration and runtime together.

```bash
cockpit remote-access status [--verbose]
cockpit remote-access configure [--port <1024-65535>] [--scope tailscale|local] [--https true|false] [--confirm-local-network]
cockpit remote-access enable [--confirm-local-network]
cockpit remote-access disable --confirm
cockpit remote-access pairing-code [--regenerate]
cockpit remote-access certificate status|generate
cockpit remote-access tailscale status
```

Configuration is rejected while the server is running. Local-network scope requires `--confirm-local-network` for both configuration and every enable, and `--scope local` cannot be combined with `--https true`: the pair returns `constraint_violated` because HTTPS depends on a Tailscale certificate. Disabling requires `--confirm` because it ends every connected session and persists standalone mode, which cannot be undone from a remote device. Enable, pairing-code regeneration, certificate generation, and configuration of an install whose persisted mode is already `server` force membership verification. Status, disable, certificate status, Tailscale status, and configuration of a standalone install do not.

Pairing-code regeneration requires Remote Access to be running. Reading the pairing code while it is stopped returns `code: null`; regeneration instead returns `remote_access_not_running` so a no-op is never reported as success.

Authentication and membership failures stop a running server and persist standalone mode. A temporarily unavailable membership verifier preserves a running server and its persisted mode. Status never exposes session IDs, tokens, user agents, or authorized token sets.