[libvirt-users] error: unable to connect to libvirtd at 'a.b.c.d': Connection refused

Thu Feb 11 19:37:32 UTC 2010

Thank you Matthias. 

I addressed the issues that you mentioned below. 

Now i have my libvirt built for esx. 

I followed the instructions http://libvirt.org/remote.html#Remote_TLS_CA  to generate the CA key/cert and client key/cert. 

However, the connect still fails, with "error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60)". 

Trace is below: 

root # virsh -c esx://a.b.c.d 

14:21:29.771: debug : virInitialize:336 : register drivers 
14:21:29.772: debug : virRegisterDriver:837 : registering Test as driver 0 
14:21:29.772: debug : virRegisterNetworkDriver:675 : registering Test as network driver 0 
14:21:29.772: debug : virRegisterInterfaceDriver:706 : registering Test as interface driver 0 
14:21:29.772: debug : virRegisterStorageDriver:737 : registering Test as storage driver 0 
14:21:29.772: debug : virRegisterDeviceMonitor:768 : registering Test as device driver 0 
14:21:29.772: debug : virRegisterSecretDriver:799 : registering Test as secret driver 0 
14:21:29.773: debug : virRegisterDriver:837 : registering Xen as driver 1 
14:21:29.773: debug : virRegisterDriver:837 : registering OPENVZ as driver 2 
14:21:29.774: debug : vboxRegister:109 : VBoxCGlueInit failed, using dummy driver 
14:21:29.774: debug : virRegisterDriver:837 : registering VBOX as driver 3 
14:21:29.774: debug : virRegisterNetworkDriver:675 : registering VBOX as network driver 1 
14:21:29.774: debug : virRegisterStorageDriver:737 : registering VBOX as storage driver 1 
14:21:29.774: debug : virRegisterDriver:837 : registering ESX as driver 4 
14:21:29.775: debug : virRegisterDriver:837 : registering remote as driver 5 
14:21:29.775: debug : virRegisterNetworkDriver:675 : registering remote as network driver 2 
14:21:29.775: debug : virRegisterInterfaceDriver:706 : registering remote as interface driver 1 
14:21:29.775: debug : virRegisterStorageDriver:737 : registering remote as storage driver 2 
14:21:29.775: debug : virRegisterDeviceMonitor:768 : registering remote as device driver 1 
14:21:29.775: debug : virRegisterSecretDriver:799 : registering remote as secret driver 1 
14:21:29.775: debug : virConnectOpenAuth:1337 : name=esx://a.b.c.d, auth=0xb7f41678, flags=0 
14:21:29.776: debug : do_open:1106 : name "esx://a.b.c.d" to URI components: 
  scheme esx 
  opaque (null) 
  authority (null) 
  server a.b.c.d 
  user (null) 
  port 0 
  path (null) 

14:21:29.776: debug : do_open:1116 : trying driver 0 (Test) ... 
14:21:29.776: debug : do_open:1122 : driver 0 Test returned DECLINED 
14:21:29.776: debug : do_open:1116 : trying driver 1 (Xen) ... 
14:21:29.776: debug : do_open:1122 : driver 1 Xen returned DECLINED 
14:21:29.776: debug : do_open:1116 : trying driver 2 (OPENVZ) ... 
14:21:29.776: debug : do_open:1122 : driver 2 OPENVZ returned DECLINED 
14:21:29.777: debug : do_open:1116 : trying driver 3 (VBOX) ... 
14:21:29.777: debug : do_open:1122 : driver 3 VBOX returned DECLINED 
14:21:29.777: debug : do_open:1116 : trying driver 4 (ESX) ... 
Enter username for a.b.c.d [root]: 
Enter root password for a.b.c.d: 
14:21:33.416: debug : do_open:1122 : driver 4 ESX returned ERROR 
14:21:33.416: debug : virUnrefConnect:259 : unref connection 0x931f698 1 
14:21:33.417: debug : virReleaseConnect:216 : release connection 0x931f698 
error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60) 
error: failed to connect to the hypervisor 

BTW, I observed that any modification to the /etc/libvirt/libvirt.conf does not take effect when. Isn't this the default conf file for libvirt/virsh? The changes i am talking about are: 

- for default path for the CA key/cert and clinet key/cert 

- uncommented #tls_no_verify_certificate = 1 

# ls /etc/pki/CA/ 
cacert.pem  cakey.pem 
# ls /etc/pki/libvirt/ 
clientcert.pem  private 
# ls /etc/pki/libvirt/private/ 
clientkey.pem 

Thank you in advance for any comments/suggestions. 

Antonela 

----- Original Message ----- 
From: "Matthias Bolte" <matthias.bolte at googlemail.com> 
To: "antonela_other at yahoo.com" <antonela at comcast.net> 
Cc: libvirt-users at redhat.com 
Sent: Wednesday, February 10, 2010 4:59:18 AM GMT -05:00 US/Canada Eastern 
Subject: Re: [libvirt-users] error: unable to connect to libvirtd at  'a.b.c.d': Connection refused 

2010/2/9 antonela_other at yahoo.com <antonela at comcast.net>: 
> Greetings: 
> 

Hello. 

> 
> I have an issue with connecting to the esx hypervisor from my guest Vm. The 
> purpose of the connection is to obtain host related information (like 
> network, devices etc). 
> 

Unfortunately network and device enumeration is not implemented yet 
for the ESX driver. 

> 
> I am not sure what is it that rejects the connect at the server side, and 
> what i am missing. 
> 
> I am running lib0.7.5, i have libvirtd running on guest-vm. 

ESX support was added in 0.7.0, so your libvirt version is new enough. 
For ESX you don't need an libvirtd, neither on the client side nor on 
the server side, see http://libvirt.org/drvesx.html#prereq 

> The host ESX has the ip address a.b.c.d. 
> 
> 
> 
> Any thoughts? 
> 

Are you sure that your libvirt was build with ESX support enabled? If 
you're using the Debian/Ubuntu packages that could be your problem, 
because they are build without ESX support. So you'll either need to 
file a bugreport with Debian/Ubuntu about the excluded ESX support, or 
build libvirt from source. If you're already building from source make 
sure to install the libcurl development package version 7.18.0 or 
newer, otherwise configure will disable ESX support. 

> 
> Below the error with some debug output from libvirt. 
> 
> 
> 
> root > virsh -c esx://a.b.c.d/system 
> 
>  ...................... 
> 
> 17:06:16.065: debug : virConnectOpenAuth:1337 : 
> name=esx://10.59.56.109/system, auth=0xb80ac638, flags=0 
> 
> 17:06:16.065: debug : do_open:1106 : name "esx://10.59.56.109/system" to URI 
> components: 
> 
>   scheme esx 
> 
>   opaque (null) 
> 
>   authority (null) 
> 
>   server 10.59.56.109 
> 
>   user (null) 
> 
>   port 0 
> 
>   path /system 
> 
> 
> 
> 17:06:16.065: debug : do_open:1116 : trying driver 0 (Test) ... 
> 
> 17:06:16.066: debug : do_open:1122 : driver 0 Test returned DECLINED 
> 
> 17:06:16.066: debug : do_open:1116 : trying driver 1 (Xen) ... 
> 
> 17:06:16.066: debug : do_open:1122 : driver 1 Xen returned DECLINED 
> 
> 17:06:16.066: debug : do_open:1116 : trying driver 2 (OPENVZ) ... 
> 
> 17:06:16.066: debug : do_open:1122 : driver 2 OPENVZ returned DECLINED 
> 
> 17:06:16.066: debug : do_open:1116 : trying driver 3 (VBOX) ... 
> 
> 17:06:16.066: debug : do_open:1122 : driver 3 VBOX returned DECLINED 

Yep, your libvirt is build without ESX support. If it is enabled it 
would be probed before the remote driver. 

> 17:06:16.066: debug : do_open:1116 : trying driver 4 (remote) ... 
> 
> 17:06:16.067: debug : doRemoteOpen:564 : proceeding with name = 
> esx:///system 
> 
> 17:06:16.069: debug : initialise_gnutls:1145 : loading CA file 
> /etc/pki/CA/cacert.pem 
> 
> 17:06:16.070: debug : initialise_gnutls:1158 : loading client cert and key 
> from files /etc/pki/libvirt/clientcert.pem and 
> /etc/pki/libvirt/private/clientkey.pem 
> 
> 17:06:16.074: debug : do_open:1122 : driver 4 remote returned ERROR 
> 
> 17:06:16.074: debug : virUnrefConnect:259 : unref connection 0x903e078 1 
> 
> 17:06:16.074: debug : virReleaseConnect:216 : release connection 0x903e078 
> 
> error: unable to connect to libvirtd at a.b.c.d': Connection refused 

The error message could be more explicit about the missing ESX 
support, I'll try to improve this. 

> error: failed to connect to the hypervisor 
> 
> 
> 
> 
> 
> I tried to use uri like: esx://a.b.c.d/, esx://a.b.c.d, 
> esxi://a.b.c.d/system etc. They all give same issue. 
> 

See http://libvirt.org/drvesx.html#uri for the URI format understood 
by the ESX driver, there is no distinction between /system and 
/session as with some other drivers. 

Matthias 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvirt-users/attachments/20100211/d07aa32f/attachment.htm>