Skip to content

KVM: do not listen on TCP port when configure kvm host #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DaanHoogland merged 1 commit into from
Jan 25, 2023
Merged

KVM: do not listen on TCP port when configure kvm host #301

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 21 additions & 22 deletions source/installguide/hypervisor/kvm.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -299,8 +299,10 @@ cloudstack-agent and should already be installed.
Please note that Cloudstack will automatically perform basic configuration of the agent and libvirt when the host is added. This is relevant if you are
planning to automate the deployment and configuration of your KVM hosts.

#. In order to have live migration working libvirt has to listen for
unsecured TCP connections. We also need to turn off libvirts attempt
#. To avoid potential security attack to virtual machines, We need to turn
off libvirt to listen on unsecure TCP port. CloudStack will automatically
set up cloud keystore and certificates when the host is added to cloudstack.
We also need to turn off libvirts attempt
to use Multicast DNS advertising. Both of these settings are in
``/etc/libvirt/libvirtd.conf``

Expand All @@ -312,7 +314,11 @@ cloudstack-agent and should already be installed.

.. parsed-literal::

listen_tcp = 1
listen_tcp = 0

.. parsed-literal::

tls_port = "16514"

.. parsed-literal::

Expand All @@ -326,8 +332,7 @@ cloudstack-agent and should already be installed.

mdns_adv = 0

#. Turning on "listen\_tcp" in libvirtd.conf is not enough, we have to
change the parameters as well:
#. We have to change the parameters as well:

On RHEL or CentOS or SUSE modify ``/etc/sysconfig/libvirtd``:

Expand All @@ -344,33 +349,35 @@ cloudstack-agent and should already be installed.
systemctl mask libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirtd-tls.socket libvirtd-tcp.socket


On Ubuntu modify ``/etc/default/libvirt-bin``
On Ubuntu 20.04 or older, modify ``/etc/default/libvirtd``

Uncomment and change the following line

.. parsed-literal::

#env libvirtd_opts=""
#libvirtd_opts=""

so it looks like:

.. parsed-literal::

env libvirtd_opts="-l"
libvirtd_opts="-l"

#. Restart libvirt
On Ubuntu 22.04 or newer version, modify ``/etc/default/libvirtd``:

In RHEL or CentOS or SUSE :
Uncomment the following line:

.. parsed-literal::

$ systemctl restart libvirtd
#LIBVIRTD_ARGS="--listen"

In Ubuntu:
#. Restart libvirt

In RHEL or CentOS or SUSE or Ubuntu:

.. parsed-literal::

$ systemctl restart libvirt-bin
$ systemctl restart libvirtd


Configure the Security Policies
Expand Down Expand Up @@ -1289,7 +1296,7 @@ using a firewall):

#. 1798

#. 16509, 16514 (libvirt)
#. 16514 (libvirt)

#. 5900 - 6100 (VNC consoles)

Expand All @@ -1313,10 +1320,6 @@ extra ports by executing the following iptable commands:

$ iptables -I INPUT -p tcp -m tcp --dport 1798 -j ACCEPT

.. parsed-literal::

$ iptables -I INPUT -p tcp -m tcp --dport 16509 -j ACCEPT

.. parsed-literal::

$ iptables -I INPUT -p tcp -m tcp --dport 16514 -j ACCEPT
Expand Down Expand Up @@ -1361,10 +1364,6 @@ To open the required ports, execute the following commands:

$ ufw allow proto tcp from any to any port 1798

.. parsed-literal::

$ ufw allow proto tcp from any to any port 16509

.. parsed-literal::

$ ufw allow proto tcp from any to any port 16514
Expand Down