Chapter 23. Remote management of guests
sshor TLS and SSL.
23.1. Remote management with SSH
libvirtmanagement connection securely tunneled over an SSH connection to manage the remote machines. All the authentication is done using SSH public key cryptography and passwords or passphrases gathered by your local SSH agent. In addition the VNC console for each guest virtual machine is tunneled over SSH.
- you require root log in access to the remote machine for managing virtual machines,
- the initial connection setup process may be slow,
- there is no standard or trivial way to revoke a user's key on all hosts or guests, and
- ssh does not scale well with larger numbers of remote machines.
The following instructions assume you are starting from scratch and do not already have SSH keys set up. If you have SSH keys set up and copied to the other systems you can skip this procedure.
virt-managermust run as the user who owns the keys to connect to the remote host. That means, if the remote systems are managed by a non-root user
virt-managermust be run in unprivileged mode. If the remote systems are managed by the local root user then the SSH keys must be own and created by root.
Optional: Changing userChange user, if required. This example uses the local root user for remotely managing the other hosts and the local host.
$ su -
Generating the SSH key pairGenerate a public key pair on the machine
virt-manageris used. This example uses the default key location, in the
$ ssh-keygen -t rsa
Coping the keys to the remote hostsRemote login without a password, or with a passphrase, requires an SSH key to be distributed to the systems being managed. Use the ssh-copy-id command to copy the key to root user at the system address provided (in the example,
# ssh-copy-id -i ~/.ssh/id_rsa.pub
email@example.com firstname.lastname@example.org's password: Now try logging into the machine, with "ssh 'email@example.com'", and check in: .ssh/authorized_keys to make sure we haven't added extra keys that you weren't expectingRepeat for other systems, as required.
Optional: Add the passphrase to the ssh-agentAdd the passphrase for the SSH key to the
ssh-agent, if required. On the local host, use the following command to add the passphrase (if there was one) to enable password-less login.
# ssh-add ~/.ssh/id_rsa.pub
libvirt daemon provide an interface for managing virtual machines. You must have the
libvirtd daemon installed and running on every remote host that needs managing.
$ ssh root@somehost # chkconfig libvirtd on # service libvirtd start
libvirtdand SSH are configured you should be able to remotely access and manage your virtual machines. You should also be able to access your guests with
VNCat this point.
Remote hosts can be managed with the virt-manager GUI tool. SSH keys must belong to the user executing virt-manager for password-less login to work.
- Start virt-manager.
- Open the File->Add Connection menu.
- Input values for the hypervisor type, the connection, Connection->Remote tunnel over SSH, and enter the desired hostname, then click connection.