0

New to virtualization and kvm and I have a problem when i try to create a virtual machine with spice:

virt-install --name Windows-7-x64 --ram 2048 --disk path=~/kvm/images/win7.img,size=50 --vcpus=1 --os-type windows --os-variant=win7 --graphics spice,port=5900,listen=0.0.0.0,password=test --video qxl --cdrom ~/Downloads/en_windows_7_professional_with_sp1_x64_dvd_u_676939.iso

ERROR unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf

I would assume that TLS have to be configured somehow but after having a look at qemu and uncommenting the lines for spice:

spice_tls = 1 spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice

Not sure how to configure TLS ??

Just a brief scenario i am trying to setup vm's on KVM with spice and access them from another computer whether it's linux or windows from virt-viewer.

A quick question as well how secure that connection over a LAN or WAN.

Thanks any help is appreciated.

Update:

I got around the problem by disabling the port 5900 then edit it in the template after the installation from this post: How to create KVM guest with SPICE graphics but TLS disabled using virt-install?

But i still believe that the connection is not over TLS so i would appreciate if someone explain this process.

Hint: For Centos users i could not connect to KVM from another machine with spice viewer until i opened port 5900 on the server through firewalld [Centos 7] or iptables [Centos 6] even if selinux is disabled.

  • Regarding the problem that you cannot connect from extern: Did you set spice_listen in /etc/libvirt/qemu.conf to anything else than the loopback IP? Check where the process listens to using netstat -ltnp. – Manuel Faux Apr 5 '15 at 19:07
  • Why do you want TLS? Spice is an encrypted protocol with built in per channel encryption – dyasny Apr 6 '15 at 2:37
  • @ManuelFaux Yes in the config file spice is listening to all public interfaces. Still didn't work until i opened a port in Centos firewall manually. – Mario Apr 6 '15 at 4:45
  • @dyasny That was one of my questions is that connection is secure enough over LAN and especially WAN and for extra security and curiosity as well. – Mario Apr 6 '15 at 4:49
  • @Mario: Sorry, I didn't recognize the word unit... Anyway, why is it astonishing that you need to open the firewall to allow incoming spice connections? That's what I expect from a firewall, to block all incoming connections which were not explicitly allowed. – Manuel Faux Apr 6 '15 at 5:38
0

Since you haven't mentioned the 'cert key' used in tls encryption, I think you are using the 'plain spice' channel. And your are right , it is insecure, especially the 'input channel' can be risky if someone type 'password or credit card number' via spice console.

To encrypt with tls-spice, you need

And to your another question -- "A quick question as well how secure that connection over a LAN or WAN." , yes there is alternatives.

For example, 'ssh tunnel' is always an option in such scenario.

You can let qemu/spice only bind on 127.0.0.1, say 127.0.0.1:5900. On client,

first 'ssh -L 9000:127.0.0.1:5900 ${server}' to establish ssh tunnel,

then spicy -h 127.0.0.1 -p 9000 to connect spice via ssh tunnel.

  • Sorry for the late reply and Thanks that's exactly what i wanted to know ... i am pretty much not an expert in networking and linux world but still in the learning phase ... so this information was very helpful for me and after a bit of google search everything start to sync. Next step is to deploy the configuration and hopefully will work on my small home lab. Just a thing that is a bit frustrating while you learn there is no centralized place for a good documentation about KVM for me till now. – Mario Apr 10 '15 at 13:54
  • "there is no centralized place for a good documentation about KVM" You are right, no centralized good documentation about KVM. KVM (more precisely, kvm/qemu/spice) is VM, and VM is just like normal computer,composed by many parts. Actually, here is very rough mapping 'kvm' -- cpu/memory 'qemu' -- motherboard, devices (Disk, network card) 'spice' -- display, especially optimized for the 'qxl virtual video card'. Since there is no centralized place for a good documentation about computer, so does KVM. :) – grizzlybears Apr 13 '15 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.