0

New to virtualization and kvm and I have a problem when i try to create a virtual machine with spice:

virt-install --name Windows-7-x64 --ram 2048 --disk path=~/kvm/images/win7.img,size=50 --vcpus=1 --os-type windows --os-variant=win7 --graphics spice,port=5900,listen=0.0.0.0,password=test --video qxl --cdrom ~/Downloads/en_windows_7_professional_with_sp1_x64_dvd_u_676939.iso

ERROR unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf

I would assume that TLS have to be configured somehow but after having a look at qemu and uncommenting the lines for spice:

spice_tls = 1 spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice

Not sure how to configure TLS ??

Just a brief scenario i am trying to setup vm's on KVM with spice and access them from another computer whether it's linux or windows from virt-viewer.

A quick question as well how secure that connection over a LAN or WAN.

Thanks any help is appreciated.

Update:

I got around the problem by disabling the port 5900 then edit it in the template after the installation from this post: How to create KVM guest with SPICE graphics but TLS disabled using virt-install?

But i still believe that the connection is not over TLS so i would appreciate if someone explain this process.

Hint: For Centos users i could not connect to KVM from another machine with spice viewer until i opened port 5900 on the server through firewalld [Centos 7] or iptables [Centos 6] even if selinux is disabled.

5
  • Regarding the problem that you cannot connect from extern: Did you set spice_listen in /etc/libvirt/qemu.conf to anything else than the loopback IP? Check where the process listens to using netstat -ltnp.
    – Manuel Faux
    Apr 5, 2015 at 19:07
  • Why do you want TLS? Spice is an encrypted protocol with built in per channel encryption
    – dyasny
    Apr 6, 2015 at 2:37
  • @ManuelFaux Yes in the config file spice is listening to all public interfaces. Still didn't work until i opened a port in Centos firewall manually.
    – Mario
    Apr 6, 2015 at 4:45
  • @dyasny That was one of my questions is that connection is secure enough over LAN and especially WAN and for extra security and curiosity as well.
    – Mario
    Apr 6, 2015 at 4:49
  • @Mario: Sorry, I didn't recognize the word unit... Anyway, why is it astonishing that you need to open the firewall to allow incoming spice connections? That's what I expect from a firewall, to block all incoming connections which were not explicitly allowed.
    – Manuel Faux
    Apr 6, 2015 at 5:38

1 Answer 1

Reset to default
0

Since you haven't mentioned the 'cert key' used in tls encryption, I think you are using the 'plain spice' channel. And your are right , it is insecure, especially the 'input channel' can be risky if someone type 'password or credit card number' via spice console.

To encrypt with tls-spice, you need

And to your another question -- "A quick question as well how secure that connection over a LAN or WAN." , yes there is alternatives.

For example, 'ssh tunnel' is always an option in such scenario.

You can let qemu/spice only bind on 127.0.0.1, say 127.0.0.1:5900. On client,

first 'ssh -L 9000:127.0.0.1:5900 ${server}' to establish ssh tunnel,

then spicy -h 127.0.0.1 -p 9000 to connect spice via ssh tunnel.

2
  • Sorry for the late reply and Thanks that's exactly what i wanted to know ... i am pretty much not an expert in networking and linux world but still in the learning phase ... so this information was very helpful for me and after a bit of google search everything start to sync. Next step is to deploy the configuration and hopefully will work on my small home lab. Just a thing that is a bit frustrating while you learn there is no centralized place for a good documentation about KVM for me till now.
    – Mario
    Apr 10, 2015 at 13:54
  • "there is no centralized place for a good documentation about KVM" You are right, no centralized good documentation about KVM. KVM (more precisely, kvm/qemu/spice) is VM, and VM is just like normal computer,composed by many parts. Actually, here is very rough mapping 'kvm' -- cpu/memory 'qemu' -- motherboard, devices (Disk, network card) 'spice' -- display, especially optimized for the 'qxl virtual video card'. Since there is no centralized place for a good documentation about computer, so does KVM. :)
    – grizzlybears
    Apr 13, 2015 at 2:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .