<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 2, 2017 at 3:10 PM, Gianluca Cecchi <span dir="ltr"><<a href="mailto:gianluca.cecchi@gmail.com" target="_blank">gianluca.cecchi@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="gmail-">On Thu, Mar 2, 2017 at 12:49 PM, Koen Vanoppen <span dir="ltr"><<a href="mailto:vanoppen.koen@gmail.com" target="_blank">vanoppen.koen@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><span class="gmail-m_4028702102489394797gmail-">[root@mercury1 ~]# saslpasswd2 -a libvirt koen<br>Password: <br>Again (for verification): <br></span>[root@mercury1 ~]# virsh list --all<span class="gmail-m_4028702102489394797gmail-"><br>Please enter your authentication name: koen<br>Please enter your password: <br>error: failed to connect to the hypervisor<br>error: no valid connection<br>error: authentication failed: authentication failed<br><br></span></div></blockquote><div><br></div></span><div>I can only say that I just tested on my environment, with plain CentOS 7.3 in oVirt 4.1 and it works.</div><div><br></div><div>In theory, your connection string should use unix domain sockets if I'm not wrong and should be the same as "-c qemu:///system" </div><div>In fact, using that connection URI I get the same prompts as without anything (only thing I just get the login/pwd prompt before running any command).</div><div><br></div><div>Possibly there is something SELinux related? Is it enabled?</div><div><br></div><div>Strange enough I'm verifying in my 4.1 system that I can actually run this command below without any password..... </div><div>(obviously all the caveat of running it out of oVirt are applicable...)</div><div><br></div><div><div>[root@ovmsrv05 ~]# virsh -c qemu://ovmsrv05.mydomain/<wbr>system</div><span class="gmail-"><div>Welcome to virsh, the virtualization interactive terminal.</div><div><br></div><div>Type: 'help' for help with commands</div><div> 'quit' to quit</div><div><br></div></span><div>virsh # list</div><div> Id Name State</div><div>------------------------------<wbr>----------------------</div><div> 2 raclab1 running</div><div> 10 c7testovn1 running</div><div> <br></div></div><div><div>virsh # </div></div><div><br></div><div>This happens using the hostname used for the host when added to oVirt infra</div><div>Instead if I use localhost I get</div><div><br></div><div><div>[root@ovmsrv05 ~]# virsh -c qemu://localhost/system</div><div>2017-03-02 13:58:16.190+0000: 25221: info : libvirt version: 2.0.0, package: 10.el7_3.4 (CentOS BuildSystem <<a href="http://bugs.centos.org" target="_blank">http://bugs.centos.org</a>>, 2017-01-17-23:37:48, <a href="http://c1bm.rdu2.centos.org" target="_blank">c1bm.rdu2.centos.org</a>)</div><div>2017-03-02 13:58:16.190+0000: 25221: info : hostname: ovmsrv05.mydomain</div><div>2017-03-02 13:58:16.190+0000: 25221: warning : virNetTLSContextCheckCertifica<wbr>te:1125 : Certificate check failed Certificate [session] owner does not match the hostname localhost</div><span class="gmail-"><div>error: failed to connect to the hypervisor</div></span><div>error: authentication failed: Failed to verify peer's certificate</div><div>[root@ovmsrv05 ~]# </div></div><div><br></div><div>Does this command work for you too in 4.0?</div><div>Is it in general a bug or a feature? Or anything cached (I don't think so because I can execute the same on another host where I didn't run anything before and where I didn't use the saslpasswd2 command to add a local virsh user)?</div></div></div></div></blockquote><div><br></div><div>It's a feature: we configure it for TLS/x509 authentication for the engine over TCP and SASL authentication for the local access overt the unix domain socket.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="gmail-HOEnZb"><font color="#888888"><div><br></div><div>Gianluca</div><div><br></div><div><br></div><div><br></div></font></span></div></div></div>
<br>______________________________<wbr>_________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/<wbr>mailman/listinfo/users</a><br>
<br></blockquote></div><br></div></div>