(Posted few days ago on qemu group but no reactions) Do I understand correctly that ssl shoudl be configured independently for libvirt and each hypervisor? I asked because I configured libvirt connection as qemu+tls://bambus.kjonca/system?pkipath=... (and on bambus in /etc/libvirt/libvirtd.conf) I set key_file = ... cert_file = ... ca_file = ... But after connect and lauching (on bambus) vm I tried to snif traffic to bambus:5900 on client) and wireshark was able to detect "VNC" protocol (BTW not spice?), so I am confused. should I configure in /etc/libvirt/qemu.conf spice_tls option and certificates ? KJ
On 9/10/23 13:00, Kamil Jo?ca wrote:> (Posted few days ago on qemu group but no reactions) > > Do I understand correctly that ssl shoudl be configured independently > for libvirt and each hypervisor? > I asked because I configured libvirt connection as > > qemu+tls://bambus.kjonca/system?pkipath=...This is a libvirt connection. It specifies how libvirt APIs are passed between client and server.> > (and on bambus in /etc/libvirt/libvirtd.conf) I set > key_file = ... > cert_file = ... > ca_file = ... > > But after connect and lauching (on bambus) vm I tried to snif traffic to > bambus:5900 on client) and wireshark was able to detect "VNC"\This is graphical console connection. It's independent of libvirt connection (libvirt does not wrap this inside a libvirt connection). There were some discussions about this IIRC, but the problem is: while libvirt's RPC has support for streaming data between host and client, it does not allow multiplexing (i.e. packing multiple streams into a single channel). That's why it's not used for graphical console, which typically require more connections. BUT it can be used for "simpler" - serial consoles (virsh console).> protocol (BTW not spice?), so I am confused.Maybe you configured VNC for your guest?> should I configure in /etc/libvirt/qemu.conf > > spice_tls option and certificates ?Correct. This is the route you want to go. But since you configured your guest to use VNC then you want to set vnc_tls* in qemu.conf. Michal
On Sun, Sep 10, 2023 at 01:00:21PM +0200, Kamil Jo?ca wrote:>(Posted few days ago on qemu group but no reactions) > >Do I understand correctly that ssl shoudl be configured independently >for libvirt and each hypervisor?It depends what you are asking about. There are various connections, each of you can configure separately.>I asked because I configured libvirt connection as > >qemu+tls://bambus.kjonca/system?pkipath=... >This ^^ uses TLS to communicate between the libvirt client and server, e.g. virsh.>(and on bambus in /etc/libvirt/libvirtd.conf) I set >key_file = ... >cert_file = ... >ca_file = ... > >But after connect and lauching (on bambus) vm I tried to snif traffic to > bambus:5900 on client) and wireshark was able to detect "VNC"For VNC that is another connection which you need to configure separately. And that is because there might be various requirements for various use cases.> protocol (BTW not spice?), so I am confused. > should I configure in /etc/libvirt/qemu.conf >There is default_tls which should be enough to start, then you need to turn on tls usage for want. There's vnc_tls, spice_tls, vxhs_tls, nbd_tls, migrate_tls, backup_tls, and you can even configure different certificates for each of them.>spice_tls option and certificates ? >That, and also don't forget to configure the domain XML so that it uses what you want, probably something like: <graphics type='spice' tlsPort='-1'/> and then some, check the following for more details: https://libvirt.org/formatdomain.html#graphical-framebuffers>KJ >-------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 833 bytes Desc: not available URL: <http://listman.redhat.com/archives/libvirt-users/attachments/20230911/110cab96/attachment.sig>