I'm attempting to remote connect to my KVM instance using virsh, but all the commands hang.<div><br></div><div>When issuing the below command, nothing on the remote system happens, and no errors are displayed, (hostname changed)</div>
<div>$ virsh --debug 5 --log /var/lib/foreman/virsh.log -c qemu+ssh://foreman@kvmhost.tld:16509/system?no_tty=1</div><div><br></div><div>This is the uncommented lines in /etc/libvirt/libvirtd.conf</div><div>----------</div>
<div><br></div><div><div>listen_tls = 0</div></div><div><div>listen_tcp = 1</div></div><div><div>listen_addr = "<omitted, set to management NIC>"</div></div><div><div>log_level = 1</div></div><div><div>log_filters="1:remote 1:event 1:qemu"</div>
</div><div><div>log_outputs="1:syslog:libvirtd 1:file:/var/log/libvirt/libvirtd.log"</div></div><div><br></div><div><br></div><div>This is the only debug output I get in /var/log/libvirt/libvirtd.log during the remote connection attempt</div>
<div>-----------</div><div><div><div><div>17:56:04.579: debug : virEventRunOnce:595 : Poll got 1 event</div><div>17:56:04.580: debug : virEventDispatchTimeouts:405 : Dispatch 3</div><div>17:56:04.580: debug : virEventDispatchHandles:450 : Dispatch 10</div>
<div>17:56:04.580: debug : virEventDispatchHandles:464 : i=0 w=1</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=1 w=2</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=2 w=3</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=3 w=4</div>
<div>17:56:04.580: debug : virEventDispatchHandles:464 : i=4 w=5</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=5 w=6</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=6 w=7</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=7 w=8</div>
<div>17:56:04.580: debug : virEventDispatchHandles:477 : Dispatch n=7 f=13 w=8 e=1 0x1629640</div><div>17:56:04.580: debug : virEventAddHandleImpl:113 : Add handle fd=20 events=1 cb=0x4196e0 opaque=0x1629640</div><div>17:56:04.580: debug : virEventInterruptLocked:664 : Skip interrupt, 1 -1447459072</div>
<div>17:56:04.580: debug : virEventDispatchHandles:464 : i=8 w=9</div><div>17:56:04.580: debug : virEventDispatchHandles:464 : i=9 w=10</div><div>17:56:04.580: debug : virEventCleanupTimeouts:495 : Cleanup 3</div><div>17:56:04.580: debug : virEventCleanupHandles:536 : Cleanupo 11</div>
<div>17:56:04.580: debug : virEventCleanupTimeouts:495 : Cleanup 3</div><div>17:56:04.580: debug : virEventCleanupHandles:536 : Cleanupo 11</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=0 w=1, f=5 e=1</div>
<div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=1 w=2, f=7 e=1</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=2 w=3, f=14 e=1</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=3 w=4, f=15 e=1</div>
<div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=4 w=5, f=17 e=25</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=5 w=6, f=18 e=25</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=6 w=7, f=19 e=25</div>
<div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=7 w=8, f=13 e=25</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=8 w=9, f=12 e=25</div><div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=9 w=10, f=11 e=25</div>
<div>17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=10 w=15, f=20 e=1</div><div>17:56:04.580: debug : virEventCalculateTimeout:314 : Calculate expiry of 3 timers</div><div>17:56:04.580: debug : virEventCalculateTimeout:344 : Timeout at 0 due in -1 ms</div>
<div>17:56:04.580: debug : virEventRunOnce:593 : Poll on 11 handles 0x7f35a4001240 timeout -1</div></div></div></div><div><br></div><div><br></div><div>I've already opened up the firewall for port 16509, and allowed the user foreman (member of libvirt_admin) to manage libvirt via PolicyKit</div>
<div>Relevant line in iptables,</div><div><div>5 ACCEPT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:16509 </div></div><div><br></div><div>
/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla</div><div>-----------</div><div><div>[libvirt Remote Access]</div><div>Identity=unix-group:libvirt_admin </div><div>Action=org.libvirt.unix.manage</div>
<div>ResultAny=yes</div><div>ResultInactive=yes</div><div>ResultActive=yes</div></div><div><br></div><div><br></div><div>Originally I had created the file /etc/polkit-1/localauthority/50-local.d/51-libvirt-foreman-remote-access.pkla with contents below, and had the file 50-libvirt-remote-access.pkla only allowing a single user.</div>
<div>/etc/polkit-1/localauthority/50-local.d/51-libvirt-foreman-remote-access.pkla</div><div>----------</div><div><div>[libvirt Foreman Remote Access]</div><div>Identity=unix-user:foreman </div><div>Action=org.libvirt.unix.manage</div>
<div>ResultAny=yes</div><div>ResultInactive=yes</div><div>ResultActive=yes</div></div><div><br></div><div>However I wasn't able to connect to libvirt on the host itself, and the logs indicated it was a PolicyKit block, so my second problem/question...Is it possible to have multiple local PolicyKit *.pkla files or can only one exist? From the documentation here, <a href="http://wiki.libvirt.org/page/SSHPolicyKitSetup">http://wiki.libvirt.org/page/SSHPolicyKitSetup</a>, it seems like so long as the names are unique then multiple would be allowed. Reason that's key is I'm using Puppet and will have multiple servers/applications needing access and being restricted to a single file to manage will be a problem.</div>
<div><br></div><div>Connecting locally with a specific pkla for "foreman"...</div><div>-----------</div><div><div>$ virsh -c qemu:///system</div><div>error: authentication failed</div><div>error: failed to connect to the hypervisor</div>
</div><div><br></div><div>/var/log/libvirt/libvirtd.log</div><div>---------</div><div><div>17:50:06.102: debug : virRunWithHook:914 : Command stderr: Not authorized.</div><div><br></div><div>17:50:06.103: error : remoteDispatchAuthPolkit:3810 : Policy kit denied action org.libvirt.unix.manage from pid 29640, uid 503, result: 256</div>
</div><div><br></div><div><br></div><div><br></div><div>Thanks</div><div>- Trey</div>