[ovirt-users] Re: Lost console access to VMs after updating
I finally figured this out. After playing around with this some more I found that if I
manually connected to a KVM host with a VNC Client I got a console. Why I was getting
blank screens previously I'm unsure but I suspect the console of the VM was asleep and
I possibly didn't push keys on the console to wake it. I'm not sure.
Either way this meant my issue was either configuration issue in the ovirt-engine or the
webproxy configuration because I could now get VNC working manually with a stand alone
client.
Long story short of tracing things step by step I eventually found connection refused
errors in my web browser using F12 and checking the console output. The rest of the error
was:
"because it violates the following Content Security Policy directive:
"default-src 'self'". Note that 'connect-src' was not explicitly
set, so 'default-src' is used as a fallback."
So I dug around /etc/http.d/conf.d/ and found this file that was updated apparently in the
recent update: olvm45-security-fixes.conf
Looking inside that file I found this at the bottom of it:
# Refer for More info https://content-security-policy.com/
#This policy allows images, scripts, AJAX, form actions, and CSS from the same origin,
# and does not allow any other resources to load (eg object, frame, media, etc). It is a
good starting point for many sites.
Header always set Content-Security-Policy "default-src 'self'; script-src
'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self'
'unsafe-inline'; img-src 'self' data:"
I modified that "Header" line to include my engine:
Header always set Content-Security-Policy "default-src 'self'; script-src
'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self'
'unsafe-inline'; img-src 'self' data; connect-src
wss://<engine-fqdn>:6100;"
Restarted httpd and what do you know. noVNC web consoles work again.
What a horrible little updated line to add to apache config. Took me long enough to find
it. Hopefully this post helps someone else with this issue searching archives later.
Malcolm