Hi<div><br></div><div>I am still having problems connecting via SSL after resolving the apparmor.d problem with reading the key directory contents</div><div><br></div><div>I am not sure what the error is caused by, any help would be appreciated</div> <div><br></div><div>I can connect after commenting out the secure channel request </div><div><br></div><div>There is no port restrictions or firewall, and the attempt to connect has been tried on both secure and unsecure ports </div> <div>(I think the secure port is passed so the unsecure port is used for the initial connection though, it isn't a passed argument issue)</div><div><br></div><div>I have tried passing the ca file via the appropriate argument from remote-viewer</div> <div><br></div><div><div><br></div><div>Package and OS</div><div>------------------------------</div><div>Ubuntu 12.10</div><div><br></div><div>qemu-kvm-spice:</div><div> Installed: 1.2.0-2012.09-0ubuntu1</div><div> Candidate: 1.2.0-2012.09-0ubuntu1</div> <div> Version table:</div><div> *** 1.2.0-2012.09-0ubuntu1 0</div><div> 500 <a href="http://gb.archive.ubuntu.com/ubuntu/">http://gb.archive.ubuntu.com/ubuntu/</a> quantal/universe amd64 Packages</div><div> 100 /var/lib/dpkg/status</div> <div><br></div><div><br></div><div><br></div><div>/etc/hostname </div><div><br></div><div>squealer</div><div><br></div><div>/etc/hosts</div><div><br></div><div>127.0.0.1 localhost squealer <a href="http://squealer.maiakaat.co.uk">squealer.maiakaat.co.uk</a> <a href="http://maiakaat.co.uk">maiakaat.co.uk</a> <a href="http://www.maiakaat.co.uk">www.maiakaat.co.uk</a></div> <div>192.168.2.140 localhost squealer <a href="http://squealer.maiakaat.co.uk">squealer.maiakaat.co.uk</a> <a href="http://maiakaat.co.uk">maiakaat.co.uk</a> <a href="http://www.maiakaat.co.uk">www.maiakaat.co.uk</a></div> <div><br></div><div><br></div><div><br></div><div>sudo usermod -a -G root,kvm jodic</div><div><br></div><div>chmod 775 /var/lib/libvirt/qemu</div><div>#temporary change</div><div><br></div><div>#libvirt directory permissions are drwxr-xr-x</div> <div><br></div><div>sudo mkdir /var/lib/libvirt/pki</div><div>sudo mkdir /var/lib/libvirt/pki/libvirt-spice</div><div><br></div><div>sudo nano /etc/libvirt/qemu.conf</div><div><br></div><div>spice_tls = 1</div><div>spice_tls_x509_cert_dir = "/var/lib/libvirt/pki/libvirt-spice"</div> <div><br></div><div>cd /var/lib/libvirt/pki/libvirt-spice</div><div><br></div><div>sudo openssl genrsa -des3 -out ca-key.pem 1024</div><div>sudo openssl req -new -x509 -days 750 -key ca-key.pem -out ca-cert.pem -utf8 -subj "/CN=Self Signed"</div> <div>sudo openssl genrsa -out server-key.pem 1024</div><div>sudo openssl req -new -key server-key.pem -out server-key.csr -utf8 -subj "/CN=squealer"</div><div>sudo openssl x509 req -days 750 -in server-key.csr -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem</div> <div>sudo openssl rsa -in server-key.pem -out server-key.pem.insecure</div><div>sudo mv server-key.pem server-key.pem.secure</div><div>sudo mv server-key.pem.insecure server-key.pem</div><div><br></div><div>sudo chown libvirt-qemu /var/lib/libvirt/pki</div> <div>sudo chown libvirt-qemu /var/lib/libvirt/pki/libvirt-spice</div><div>sudo chown libvirt-qemu /var/lib/libvirt/pki/libvirt-spice/server-key.pem</div><div>sudo chown libvirt-qemu /var/lib/libvirt/pki/libvirt-spice/server-cert.pem</div> <div>sudo chown libvirt-qemu /var/lib/libvirt/pki/libvirt-spice/ca-cert.pem</div><div><br></div><div>#temporary change</div><div>sudo chmod 775 /var/lib/libvirt/pki</div><div>sudo chmod 775 /var/lib/libvirt/pki/libvirt-spice</div> <div>sudo chmod 775 /var/lib/libvirt/pki/libvirt-spice/server-key.pem</div><div>sudo chmod 775 /var/lib/libvirt/pki/libvirt-spice/server-cert.pem</div><div>sudo chmod 775 /var/lib/libvirt/pki/libvirt-spice/ca-cert.pem</div> <div><br></div><div>sudo virsh destroy VM11</div><div>sudo virsh undefine VM11</div><div><br></div><div>sudo shutdown -r now</div><div>#don't know how to restart service for re-read of qemu.conf in Ubuntu</div><div><br> </div><div>#Ubuntu offering 28 updates - none related to virtualization at all</div><div><br></div><div>sudo apt-get update</div><div>sudo apt-get upgrade</div><div><br></div><div>edit apparmor.d/libvirt-qemu and add the key directory after /etc/pki/libvirt-vnc** r, in an identical format within the apparmor.d config file, along with any iso directories needed</div> <div><br></div><div>sudo virsh define /var/lib/libvirt/local/xml/default-revision7.xml</div><div><br></div><div>#defined VM11</div><div><br></div><div>sudo virsh start VM11</div><div><br></div><div>#started VM11 23:14 ish UK time</div> <div><br></div><div>#spice configuration</div><div><graphics type="spice" autoport="yes" keymap="en-gb"> </div><div> <channel name="main" mode="secure" /></div> <div> <channel name="record" mode="insecure" /></div><div> <channel name="display" mode="insecure" /></div><div> <channel name="inputs" mode="insecure" /></div> <div> <channel name="cursor" mode="insecure" /></div><div> <channel name="playback" mode="insecure" /></div><div> <channel name="usbredir" mode="insecure" /></div> <div><br></div><div> <image compression="auto_glz"/></div><div> <streaming mode="filter"/> </div><div> <clipboard copypaste="yes"/></div><div> <mouse mode="client"/></div> <div> </div><div> <listen type="address" address="0.0.0.0" /></div><div> <disable-ticketing /></div><div> </graphics></div> <div> </div><div>On attempts to connect via virsh I am given this warning</div><div>spice channels 1 should be encrypted, I'm guessing this is an authentication issue with my attempts to connect?</div><div><br></div> <div>sudo /var/log/libvirt/qemu/qemu.conf</div><div><br></div><div>((null):2230): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div><br></div><div>2012-11-13 07:28:43.081+0000: starting up</div> <div>LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin QEMU_AUDIO_DRV=spice /usr/bin/kvm -name VM11 -S -M pc-1.2 -cpu Opteron_G3,+ibs,+osvw,+3dnowprefetch,+cr8legacy,+extapic,+cmp_legacy,+3dnow,+3dnowext,+pdpe1gb,+fxsr_opt,+mmxext,+ht,+vme -enable-kvm -m 2048 -smp 1,sockets=1,cores=1,threads=1 -uuid a5fa6af1-89e6-ff32-7d47-5fd28ab47a05 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/VM11.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=localtime -no-shutdown -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/var/lib/libvirt/local/fixed-pool0/buildsvr-disk0,if=none,id=drive-virtio-disk0,format=raw,cache=writeback -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=3 -drive file=/var/lib/libvirt/local/dynamic-pool0/buildsvr-disk1,if=none,id=drive-virtio-disk1,format=raw,cache=writethrough -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x6,drive=drive-virtio-disk1,id=virtio-disk1,bootindex=4 -drive if=none,id=drive-ide0-0-0,readonly=on,format=raw -device ide-cd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=2 -drive file=/var/lib/libvirt/local/fixed-pool0/buildsvr-media,if=none,id=drive-ide0-0-1,readonly=on,format=raw -device ide-cd,bus=ide.0,unit=1,drive=drive-ide0-0-1,id=ide0-0-1,bootindex=1 -netdev tap,fd=21,id=hostnet0,vhost=on,vhostfd=22 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=00:16:3e:1a:b3:4c,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -device usb-tablet,id=input0 -spice port=5908,tls-port=5918,addr=0.0.0.0,agent-mouse=on,disable-ticketing,x509-dir=/var/lib/libvirt/pki/libvirt-spice,tls-channel=main,plaintext-channel=display,plaintext-channel=inputs,plaintext-channel=cursor,plaintext-channel=playback,plaintext-channel=record,plaintext-channel=usbredir,image-compression=auto_glz,streaming-video=filter -k en-gb -vga qxl -global qxl-vga.vram_size=33554432 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5</div> <div>char device redirected to /dev/pts/1</div><div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div> <div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div> <div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div> <div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div> <div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div> <div>((null):1838): Spice-Warning **: reds.c:2812:reds_handle_read_link_done: spice channels 1 should be encrypted</div><div><br></div><div><br></div><div><br></div></div>