so bind cockpit to 127.0.0.1 and use ssh port forwarding?

You could also have a more strict password policy but I don't know that I'd ever want to expose something like cockpit to the raw Internet.