Hi<div><br></div><div>Package and OS</div><div>------------------------------</div><div><p id="yui_3_5_1_1_1352744068131_1659" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">
Ubuntu 12.10</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">qemu-kvm-spice:<br>
Installed: 1.2.0-2012.09-0ubuntu1<br> Candidate: 1.2.0-2012.09-0ubuntu1<br> Version table:<br> *** 1.2.0-2012.09-0ubuntu1 0<br> 500 <a rel="nofollow" href="http://gb.archive.ubuntu.com/ubuntu/" style="color:rgb(0,51,170);text-decoration:none">http://gb.archive.ubuntu.com/ubuntu/</a> quantal/universe amd64 Packages<br>
100 /var/lib/dpkg/status</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">
<br></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);line-height:18px;background-color:rgb(255,255,255)"><font face="arial, helvetica, sans-serif">Key Creation</font></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);line-height:18px;background-color:rgb(255,255,255)">
<span style="font-family:'Ubuntu Mono',monospace;font-size:12px">-------------------------</span></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;background-color:rgb(255,255,255)"></p><p id="yui_3_5_1_1_1352744068131_1687" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">
<br></p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">openssl genrsa -des3 -out ca-key.pem 1024<br>
openssl req -new -x509 -days 1095 -key ca-key.pem -out ca-cert.pem -utf8 -subj "/C=IL/L=Raanana/O=Red Hat/CN=my CA"<br>openssl genrsa -out server-key.pem 1024<br>openssl req -new -key server-key.pem -out server-key.csr -utf8 -subj "/C=IL/L=Raanana/O=Red Hat/CN=my server"<br>
openssl x509 -req -days 1095 -in server-key.csr -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem<br>openssl rsa -in server-key.pem -out server-key.pem.insecure<br>mv server-key.pem server-key.pem.secure<br>
mv server-key.pem.insecure server-key.pem</p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">
<br></p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><font face="arial, helvetica, sans-serif">qemu.conf</font></p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">
--------------</p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><br>
</p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">qemu.conf configuration was attempted as default, and specified using an uncommented path "/etc/pki/libvirt-spice"</p>
<p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><br></p><p id="yui_3_5_1_1_1352744068131_1678" style="color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">
spice_tls = 1</p><p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"></p><p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em">
</p><p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><font color="#333333" face="Ubuntu Mono, monospace"><span style="font-size:12px;line-height:18px"># default it to keep them in /etc/pki/libvirt-spice. This directory</span></font></p>
<p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><font color="#333333" face="Ubuntu Mono, monospace"><span style="font-size:12px;line-height:18px"># must contain</span></font></p>
<p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><font color="#333333" face="Ubuntu Mono, monospace"><span style="font-size:12px;line-height:18px">...</span></font></p>
<p></p><p></p><p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><font color="#333333" face="Ubuntu Mono, monospace"><span style="font-size:12px;line-height:18px">#spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice" (using the default path)</span></font></p>
<p id="yui_3_5_1_1_1352744068131_1678" style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em"><span style="font-size:12px;line-height:18px;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace">spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice" (specifiying the path directly)</span></p>
<p></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)"><br></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);line-height:18px;background-color:rgb(255,255,255)">
<font face="arial, helvetica, sans-serif">Permissions</font></p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">
-------------</p><p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">Permissions were tested set as default (assumed root or my account) and</p>
<p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">sudo chown libvirt-qemu /etc/pki/libvirt-spice/</p>
<p style="margin:0px 0px 1.2em;padding:0px;width:auto;max-width:45em;color:rgb(51,51,51);font-family:'Ubuntu Mono',monospace;font-size:12px;line-height:18px;background-color:rgb(255,255,255)">sudo chown libvirt-qemu /etc/pki/libvirt-spice/<filenames of files></p>
<div><br></div>Error Reported</div><div>-------------------------</div><div><br></div><div><font face="courier new, monospace">sudo nano /var/log/libvirt/qemu/VM11.log</font></div><div><br></div><div><div>qemu: terminating on signal 15 from pid 1417</div>
<div>2012-11-12 18:11:24.586+0000: shutting down</div><div>2012-11-12 18:11:29.698+0000: starting up</div><div>LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin QEMU_AUDIO_DRV=spice /usr/bin/kvm -name VM11 -S -M pc-1.2 -cpu Opteron_G3,+ibs,+osvw,+3dnowprefetch,+cr8legacy,+extapic,+cmp_legacy,+3dnow,+3dnowext,+pdpe1gb,+fxsr_opt,+mmxext,+ht,+vme -enable-kvm -m 2048 -smp 1,sockets=1,cores=1,threads=1 -uuid 35a6984d-0b77-da48-770e-a8fb0c7c284d -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/VM11.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=localtime -no-shutdown -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/var/lib/libvirt/local/fixed-pool0/buildsvr-disk0,if=none,id=drive-virtio-disk0,format=raw,cache=writeback -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=3 -drive file=/var/lib/libvirt/local/dynamic-pool0/buildsvr-disk1,if=none,id=drive-virtio-disk1,format=raw,cache=writethrough -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x6,drive=drive-virtio-disk1,id=virtio-disk1,bootindex=4 -drive if=none,id=drive-ide0-0-0,readonly=on,format=raw -device ide-cd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=2 -drive file=/var/lib/libvirt/local/fixed-pool0/buildsvr-media,if=none,id=drive-ide0-0-1,readonly=on,format=raw -device ide-cd,bus=ide.0,unit=1,drive=drive-ide0-0-1,id=ide0-0-1,bootindex=1 -netdev tap,fd=21,id=hostnet0,vhost=on,vhostfd=22 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=00:16:3e:1a:b3:4c,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -device usb-tablet,id=input0 -spice port=5908,tls-port=5918,addr=0.0.0.0,agent-mouse=on,disable-ticketing,x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=display,plaintext-channel=inputs,plaintext-channel=cursor,plaintext-channel=playback,plaintext-channel=record,plaintext-channel=usbredir,image-compression=auto_glz,streaming-video=filter -k en-gb -vga qxl -global qxl-vga.vram_size=33554432 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5</div>
<div>char device redirected to /dev/pts/1</div><div>((null):1916): Spice-Warning **: reds.c:3307:reds_init_ssl: Could not load certificates from /etc/pki/libvirt-spice/server-cert.pem</div><div>((null):1916): Spice-Warning **: reds.c:3317:reds_init_ssl: Could not use private key file</div>
<div>((null):1916): Spice-Warning **: reds.c:3325:reds_init_ssl: Could not use CA file /etc/pki/libvirt-spice/ca-cert.pem</div><div><br></div><div><br></div><div>Certificates</div><div>--------------------</div><div>I was able to open and read the files using the various commands similar to sudo openssl x509 -noout -text -in ca-cert.pem</div>
<div><br></div><div>I did wonder if it is rejecting the CA as some security feature, I hope this is of use.</div><div>I chose libvirt-qemu, as this is the account closed to the Red Hat/Fedora account name used "qemu"</div>
<div><br></div><div><br></div><div>Creation</div><div>---------------</div><div><br></div><div>creation was via an XML definition followed by calling virsh define <path>, virsh start VM11</div><div><br></div><div>I have tried to keep most files inside the libvirt tree to try to avoid permission errors, the configuration has two volume pools, specified inside /var/lib/libvirt/local/<pool-name> (which are mounted to other drives, and operate without problem)</div>
<div><br></div><div>The volumes used are vmdk volumes (for performance reasons) one inside each pool, for fixed allocation and sparse type allocation), not that this matters but it gives you an idea of what the setup is like.</div>
<div><br></div><div><br></div><div><br></div><div>Location content</div><div><br></div><div><div><br></div><div>jodic@squealer:/etc/pki/libvirt-spice$ dir</div><div>ca-cert.pem server-cert.pem server-key.pem</div><div>ca-key.pem server-key.csr server-key.pem.secure</div>
</div><div><br></div><div>I could try using a location without the qemu tree to try to rule out some permission problems. I'll go through it again in a little bit</div><div><br></div><div><br></div><div><br></div><div class="gmail_quote">
On Mon, Nov 12, 2012 at 6:11 PM, David Jaša <span dir="ltr"><<a href="mailto:djasa@redhat.com" target="_blank">djasa@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Before reporting a bug, could we rule out misconfiguration possiblity<br>
entirely?<br>
<br>
1) do you use libvirt?<br>
2) if so, do you use system session or per-user session?<br>
3) could you look at qemu command line? If you use libvirt, you'll find it in /var/log/libvirt/qemu/VM_NAME.log<br>
4) at the libvirt command file, is there '... -spice ...,x509-(dir|ca...|server),... ' entry?<br>
5) if the x509 directive is x509-dir, does "qemu-kvm -spice tls-port=12345,x509-dir=DIR,disable-ticketing" command throw the same error?<br>
(the same goes for per-file x509 options)<br>
6) if it is indeed a problem, is it permission issue or are the files empty or are they invalid?<br>
<br>
(...)<br>
<br>
David<br>
<br>
<br>
Jodi Curtis píše v Po 12. 11. 2012 v 17:55 +0000:<br>
<div class="HOEnZb"><div class="h5">> Hi<br>
><br>
><br>
> I've used the directory correctly on qemu.conf, I've seen these<br>
> problems relating to Red Hat/oVirt, where it wasn't set despite being<br>
> set in qemu.conf, so I will probably file a bug report with Ubuntu on<br>
> this one.<br>
><br>
><br>
> The red-hat solution isn't valid for Ubuntu.<br>
><br>
><br>
> Thanks<br>
><br>
> On Mon, Nov 12, 2012 at 5:49 PM, David Jaša <<a href="mailto:djasa@redhat.com">djasa@redhat.com</a>> wrote:<br>
> Jodi Curtis píše v Po 12. 11. 2012 v 17:31 +0000:<br>
> > Hi<br>
> ><br>
> ><br>
> > Thanks, I found the method in the end, my current problem is<br>
> related<br>
> > to a problem with Ubuntu/SSL/Spice, so not really your<br>
> software, I<br>
> > have asked for help from a Linux admin, but its detailed<br>
> below for the<br>
> > record, I've gone through the key making proces twice, and<br>
> rebooted,<br>
> > obviously paths have been checked and qemu.conf has been set<br>
> as<br>
> > required<br>
> ><br>
> ><br>
> > ((null):2176): Spice-Warning **: reds.c:3307:reds_init_ssl:<br>
> Could not<br>
> > load certificates from server-cert.pem<br>
> > ((null):2176): Spice-Warning **: reds.c:3317:reds_init_ssl:<br>
> Could not<br>
> > use private key file<br>
> > ((null):2176): Spice-Warning **: reds.c:3325:reds_init_ssl:<br>
> Could not<br>
> > use CA file<br>
><br>
><br>
> Assuming that your cert/key files are correct and in place,<br>
> this looks<br>
> like incorrect x509-dir option of qemu cli or<br>
> spice_tls_x509_cert_dir<br>
> directive of /etc/libvirt/qemu.conf pointing to a wrong<br>
> directory. Just<br>
> a configuration issue.<br>
><br>
> David<br>
><br>
> ><br>
> ><br>
> > There is very little obvious on the internet, so am trying<br>
> to identify<br>
> > if its a common SSL or config problem, or if I should file a<br>
> bug<br>
> > report with Ubuntu kvm-spice<br>
> ><br>
> ><br>
> > Jodi<br>
> ><br>
> ><br>
> > On Mon, Nov 12, 2012 at 12:12 PM, David Jaša<br>
> <<a href="mailto:djasa@redhat.com">djasa@redhat.com</a>> wrote:<br>
> > Hi Jodi,<br>
> ><br>
> > You can find full tls-enabled remote-viewer<br>
> invocation in this<br>
> > oVirt<br>
> > wiki page:<br>
> ><br>
> <a href="http://wiki.ovirt.org/wiki/How_to_Connect_to_SPICE_Console_Without_Portal" target="_blank">http://wiki.ovirt.org/wiki/How_to_Connect_to_SPICE_Console_Without_Portal</a><br>
> ><br>
> > David<br>
> ><br>
> ><br>
> > Jodi Curtis píše v Ne 11. 11. 2012 v 23:28 +0000:<br>
> > > Hi<br>
> > ><br>
> > ><br>
> > > I'm having trouble connecting to a spice server<br>
> with tls<br>
> > enabled<br>
> > > through virt-viewer on windows, I have tls<br>
> configured and a<br>
> > > ca-cert.pem file, but I don't know where to put<br>
> it, or what<br>
> > to use<br>
> > ><br>
> > ><br>
> > > I have tried various combinations of<br>
> > spice://192.168.2.140:590x<br>
> > ><br>
> > ><br>
> > > I have tried adding +ssh or +tls, I have tried<br>
> adding the<br>
> > ca-cert.pem<br>
> > > file to the location used by the spicec page that<br>
> covers how<br>
> > to set up<br>
> > > tls, and I have tried adding my username before<br>
> the IP.<br>
> > ><br>
> > > I have tried connecting to both ports.<br>
> > ><br>
> > ><br>
> > > Any help on what it should be, or if there is an<br>
> alternative<br>
> > to<br>
> > > virt-viewer on windows that I need to use for the<br>
> secure<br>
> > connection.<br>
> > ><br>
> > ><br>
> > > Thanks<br>
> ><br>
> > > _______________________________________________<br>
> > > Spice-devel mailing list<br>
> > > <a href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a><br>
> > ><br>
> <a href="http://lists.freedesktop.org/mailman/listinfo/spice-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a><br>
> ><br>
> > --<br>
> ><br>
> > David Jaša, RHCE<br>
> ><br>
> > SPICE QE based in Brno<br>
> > GPG Key: 22C33E24<br>
> > Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00<br>
> 22C3 3E24<br>
> ><br>
> ><br>
> ><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > Spice-devel mailing list<br>
> > <a href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a><br>
> > <a href="http://lists.freedesktop.org/mailman/listinfo/spice-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a><br>
><br>
> --<br>
><br>
> David Jaša, RHCE<br>
><br>
> SPICE QE based in Brno<br>
> GPG Key: 22C33E24<br>
> Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24<br>
><br>
><br>
><br>
><br>
><br>
><br>
<br>
--<br>
<br>
David Jaša, RHCE<br>
<br>
SPICE QE based in Brno<br>
GPG Key: 22C33E24<br>
Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24<br>
<br>
<br>
<br>
</div></div></blockquote></div><br></div>