Hi, It looks like my only option to get a console is using spice-proxy as in http://www.ovirt.org/Features/Spice_Proxy However I am not sure how to make it work. I have installed all three required packages on the engine (3.3.2). And my engine-config shows: [root@xyz ~]# engine-config -a | grep Spice EnableSpiceRootCertificateValidation: true version: general SpiceReleaseCursorKeys: shift+f12 version: general SpiceSecureChannels: smain,sinputs version: 3.0 SpiceSecureChannels: smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard version: 3.1 SpiceSecureChannels: smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard version: 3.2 SpiceSecureChannels: smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard version: 3.3 SpiceToggleFullScreenKeys: shift+f11 version: general SpiceUsbAutoShare: true version: general SpiceProxyDefault: version: general

ClientModeSpiceDefault: Auto version: general The problem is that on my web portal, I don't see any "Enable SPICE Proxy" box that I can check. Anyone knows why? Thanks. David _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

Itamar, The web page isn't very clear how to set this. What's the "someProxy" supposed to be?

engine-config -s SpiceProxyDefault=someProxy ----- Original Message ----- > From: Itamar Heim <iheim(a)redhat.com&gt; > To: David Li <david_li(a)sbcglobal.net>; &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; > Cc: > Sent: Thursday, January 23, 2014 1:01 PM > Subject: Re: [Users] Spice-proxy questions > > On 01/23/2014 10:05 PM, David Li wrote: >> Hi, >> >> It looks like my only option to get a console is using spice-proxy as in > http://www.ovirt.org/Features/Spice_Proxy >> >> However I am not sure how to make it work. I have installed all three > required packages on the engine (3.3.2). And my engine-config shows: >> >> >> [root@xyz ~]# engine-config -a | grep Spice >> EnableSpiceRootCertificateValidation: true version: general >> SpiceReleaseCursorKeys: shift+f12 version: general >> SpiceSecureChannels: smain,sinputs version: 3.0 >> SpiceSecureChannels: > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard version: > 3.1 >> SpiceSecureChannels: > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard version: > 3.2 >> SpiceSecureChannels: > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard version: > 3.3 >> SpiceToggleFullScreenKeys: shift+f11 version: general >> SpiceUsbAutoShare: true version: general >> SpiceProxyDefault: version: general > > i don't remember the details, but i assume SpiceProxyDefault should not > be empty, set it with engine-config -s SpiceProxyDefault > > engine-config.properties:SpiceProxyDefault.description='Default proxy > used by SPICE client to connect to the > > >> ClientModeSpiceDefault: Auto version: general >> >> >> The problem is that on my web portal, I don't see any "Enable > SPICE Proxy" box that I can check. >> >> Anyone knows why? >> >> Thanks. >> >> David >> >> _______________________________________________ >> Users mailing list >> Users(a)ovirt.org >> http://lists.ovirt.org/mailman/listinfo/users >> > _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

David, With SpiceProxy, should I point my admin portal browser to http://proxy_ip_or_fqdn:port? Does it matter which port number to use?

----- Original Message ----- > From: David Jaša <djasa(a)redhat.com&gt; > To: David Li <david_li(a)sbcglobal.net&gt; > Cc: Itamar Heim <iheim(a)redhat.com>; &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; > Sent: Friday, January 24, 2014 1:48 AM > Subject: Re: [Users] Spice-proxy questions > > On Čt, 2014-01-23 at 13:42 -0800, David Li wrote: >> Itamar, >> >> The web page isn't very clear how to set this. >> >> What's the "someProxy" supposed to be? > > SpiceProxyDefaut=http://proxy_ip_or_fqdn:port/ > > David > >> >> engine-config -s SpiceProxyDefault=someProxy >> >> >> >> ----- Original Message ----- >> > From: Itamar Heim <iheim(a)redhat.com&gt; >> > To: David Li <david_li(a)sbcglobal.net>; > &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; >> > Cc: >> > Sent: Thursday, January 23, 2014 1:01 PM >> > Subject: Re: [Users] Spice-proxy questions >> > >> > On 01/23/2014 10:05 PM, David Li wrote: >> >> Hi, >> >> >> >> It looks like my only option to get a console is using > spice-proxy as in >> > http://www.ovirt.org/Features/Spice_Proxy >> >> >> >> However I am not sure how to make it work. I have installed all > three >> > required packages on the engine (3.3.2). And my engine-config shows: >> >> >> >> >> >> [root@xyz ~]# engine-config -a | grep Spice >> >> EnableSpiceRootCertificateValidation: true version: general >> >> SpiceReleaseCursorKeys: shift+f12 version: general >> >> SpiceSecureChannels: smain,sinputs version: 3.0 >> >> SpiceSecureChannels: >> > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > version: >> > 3.1 >> >> SpiceSecureChannels: >> > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > version: >> > 3.2 >> >> SpiceSecureChannels: >> > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > version: >> > 3.3 >> >> SpiceToggleFullScreenKeys: shift+f11 version: general >> >> SpiceUsbAutoShare: true version: general >> >> SpiceProxyDefault: version: general >> > >> > i don't remember the details, but i assume SpiceProxyDefault > should not >> > be empty, set it with engine-config -s SpiceProxyDefault >> > >> > engine-config.properties:SpiceProxyDefault.description='Default > proxy >> > used by SPICE client to connect to the >> > >> > >> >> ClientModeSpiceDefault: Auto version: general >> >> >> >> >> >> The problem is that on my web portal, I don't see any > "Enable >> > SPICE Proxy" box that I can check. >> >> >> >> Anyone knows why? >> >> >> >> Thanks. >> >> >> >> David >> >> >> >> _______________________________________________ >> >> Users mailing list >> >> Users(a)ovirt.org >> >> http://lists.ovirt.org/mailman/listinfo/users >> >> >> > >> _______________________________________________ >> Users mailing list >> Users(a)ovirt.org >> http://lists.ovirt.org/mailman/listinfo/users > _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

On Pá, 2014-01-24 at 18:45 +0100, David Jaša wrote: > On Pá, 2014-01-24 at 09:39 -0800, David Li wrote: > > David, > > > > With SpiceProxy, should I point my admin portal browser to http://proxy_ip_or_fqdn:port? Does it matter which port number to use? > > Both FQDN/IP and port do matter. You have to set them so they point to a > running http proxy server instance (e.g. squid). Engine won't set up a > spice-capable http proxy Just to clarify: you need to tell squid to permit connections to spice port range (5900-6144 IIRC). It only allows connections to http ports by default. David > for you, you have to take care of it yoursef. > > What engine can do for you is to configure websocket proxy that allows > connections by html5 client (the one that runs entirely in browser). > > David

http_access deny CONNECT !SSL_ports

http_port 3128

From: David Jaša <djasa(a)redhat.com&gt; To: David Li <david_li(a)sbcglobal.net&gt; Cc: &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; Sent: Friday, January 24, 2014 9:58 AM Subject: Re: [Users] Spice-proxy questions On Pá, 2014-01-24 at 18:45 +0100, David Jaša wrote: > On Pá, 2014-01-24 at 09:39 -0800, David Li wrote: > > David, > > > > With SpiceProxy, should I point my admin portal browser to http://proxy_ip_or_fqdn:port? Does it matter which port number to use? > > Both FQDN/IP and port do matter. You have to set them so they point to a > running http proxy server instance (e.g. squid). Engine won't set up a > spice-capable http proxy Just to clarify: you need to tell squid to permit connections to spice port range (5900-6144 IIRC). It only allows connections to http ports by default. David > for you, you have to take care of it yoursef. > > What engine can do for you is to configure websocket proxy that allows > connections by html5 client (the one that runs entirely in browser). > > David > > > > > > > > > > > ----- Original Message ----- > > > From: David Jaša <djasa(a)redhat.com&gt; > > > To: David Li <david_li(a)sbcglobal.net&gt; > > > Cc: Itamar Heim <iheim(a)redhat.com>; &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; > > > Sent: Friday, January 24, 2014 1:48 AM > > > Subject: Re: [Users] Spice-proxy questions > > > > > > On Čt, 2014-01-23 at 13:42 -0800, David Li wrote: > > >>  Itamar, > > >> > > >>  The web page isn't very clear how to set this. > > >> > > >>  What's the "someProxy" supposed to be? > > > > > > SpiceProxyDefaut=http://proxy_ip_or_fqdn:port/ > > > > > > David > > > > > >> > > >>  engine-config -s SpiceProxyDefault=someProxy > > >> > > >> > > >> > > >>  ----- Original Message ----- > > >>  > From: Itamar Heim <iheim(a)redhat.com&gt; > > >>  > To: David Li <david_li(a)sbcglobal.net>; > > > &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; > > >>  > Cc: > > >>  > Sent: Thursday, January 23, 2014 1:01 PM > > >>  > Subject: Re: [Users] Spice-proxy questions > > >>  > > > >>  > On 01/23/2014 10:05 PM, David Li wrote: > > >>  >>  Hi, > > >>  >> > > >>  >>  It looks like my only option to get a console is using > > > spice-proxy as in > > >>  > http://www.ovirt.org/Features/Spice_Proxy > > >>  >> > > >>  >>  However I am not sure how to make it work. I have installed all > > > three > > >>  > required packages on the engine (3.3.2). And my engine-config shows: > > >>  >> > > >>  >> > > >>  >>  [root@xyz ~]# engine-config -a | grep Spice > > >>  >>  EnableSpiceRootCertificateValidation: true version: general > > >>  >>  SpiceReleaseCursorKeys: shift+f12 version: general > > >>  >>  SpiceSecureChannels: smain,sinputs version: 3.0 > > >>  >>  SpiceSecureChannels: > > >>  > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > > > version: > > >>  > 3.1 > > >>  >>  SpiceSecureChannels: > > >>  > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > > > version: > > >>  > 3.2 > > >>  >>  SpiceSecureChannels: > > >>  > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > > > version: > > >>  > 3.3 > > >>  >>  SpiceToggleFullScreenKeys: shift+f11 version: general > > >>  >>  SpiceUsbAutoShare: true version: general > > >>  >>  SpiceProxyDefault:  version: general > > >>  > > > >>  > i don't remember the details, but i assume SpiceProxyDefault > > > should not > > >>  > be empty, set it with engine-config -s SpiceProxyDefault > > >>  > > > >>  > engine-config.properties:SpiceProxyDefault.description='Default > > > proxy > > >>  > used by SPICE client to connect to the > > >>  > > > >>  > > > >>  >>  ClientModeSpiceDefault: Auto version: general > > >>  >> > > >>  >> > > >>  >>  The problem is that on my web portal, I don't see any > > > "Enable > > >>  > SPICE Proxy" box that I can check. > > >>  >> > > >>  >>  Anyone knows why? > > >>  >> > > >>  >>  Thanks. > > >>  >> > > >>  >>  David > > >>  >> > > >>  >>  _______________________________________________ > > >>  >>  Users mailing list > > >>  >>  Users(a)ovirt.org > > >>  >>  http://lists.ovirt.org/mailman/listinfo/users > > >>  >> > > >>  > > > >>  _______________________________________________ > > >>  Users mailing list > > >>  Users(a)ovirt.org > > >>  http://lists.ovirt.org/mailman/listinfo/users > > > > > _______________________________________________ > > Users mailing list > > Users(a)ovirt.org > > http://lists.ovirt.org/mailman/listinfo/users > > > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users

From: Gianluca Cecchi <gianluca.cecchi(a)gmail.com&gt; To: David Li <david_li(a)sbcglobal.net&gt; Cc: &quot;users(a)ovirt.org&quot; <users(a)ovirt.org>; &quot;djasa(a)redhat.com&quot; <djasa(a)redhat.com&gt; Sent: Friday, January 24, 2014 2:25 PM Subject: Re: [Users] Spice-proxy questions On Fri, Jan 24, 2014 at 8:45 PM, David Li  wrote: > David > > I set up the squid proxy on the same machine as ovirt-engine. I have this in squid.conf: > > > > ------------------- > acl localhost src 10.10.2.143/32 # for the machine running the browser > > > #safe ports > acl SSL_ports port 443 > acl Safe_ports port 80          # http > acl Safe_ports port 21          # ftp > acl Safe_ports port 443        # https > acl Safe_ports port 70          # gopher > acl Safe_ports port 210        # wais > acl Safe_ports port 1025-65535  # unregistered ports <---------- will this allow connections to spice port range (5900-6144 IIRC).??? > acl Safe_ports port 280        # http-mgmt > acl Safe_ports port 488        # gss-http > acl Safe_ports port 591        # filemaker > acl Safe_ports port 777        # multiling http > > > > # Squid normally listens to port 3128 > http_port 3128 > > # Deny requests to certain unsafe ports > http_access deny !Safe_ports > > ------------------------- > > and set my SpiceProxyDefault=http://10.10.2.143:3128 > > > > So far, this is still not working. The Spice popup window still fails to connect to the graphics server and html5 browser window remains blank. > Are there any log files that can be used to debug this? > > Thanks. > > There is something I don't understand or that you are doing incorrectly. From what you write it seems that: - your engine has ip 10.10.2.143 - From which ip do you run your browser? - Can this ip connect to engine on port 3128? Perhaps your engine setup already configured iptables (or firewalld) and it is blocking you? You can easily verify at runtime by putting this line on engine: iptables -I INPUT -s xxx.yyy.www.zzz -j ACCEPT where xxx.yyy.www.zzz is the ip of the client from where you run the browser so that you put this accept rule on top of INPUT chain and retry to connect to VM console - Which ip have the hosts where VMs are running? - Is engine (so your proxy in your configuration) capable to reach ip of your hosts on spice ports (5900-..)? ALso see my previous thread here: http://lists.ovirt.org/pipermail/users/2013-December/018554.html and the useful answers. I cannot test your config, because I have no control on my network and network admins only allow 80 and 443 so that they are already taken by engine itself and I can't test putting the proxy on engine itself... HIH anyway, Gianluca

Do I need to generate and install a x509 key pair for the squid proxy? How can I find out if the key pair has already been done?

----- Original Message ----- > From: Gianluca Cecchi <gianluca.cecchi(a)gmail.com&gt; > To: David Li <david_li(a)sbcglobal.net&gt; > Cc: &quot;users(a)ovirt.org&quot; <users(a)ovirt.org>; &quot;djasa(a)redhat.com&quot; <djasa(a)redhat.com&gt; > Sent: Friday, January 24, 2014 2:25 PM > Subject: Re: [Users] Spice-proxy questions > > On Fri, Jan 24, 2014 at 8:45 PM, David Li wrote: >> David >> >> I set up the squid proxy on the same machine as ovirt-engine. I have this > in squid.conf: >> >> >> >> ------------------- >> acl localhost src 10.10.2.143/32 # for the machine running the browser >> >> >> #safe ports >> acl SSL_ports port 443 >> acl Safe_ports port 80 # http >> acl Safe_ports port 21 # ftp >> acl Safe_ports port 443 # https >> acl Safe_ports port 70 # gopher >> acl Safe_ports port 210 # wais >> acl Safe_ports port 1025-65535 # unregistered ports <---------- will > this allow connections to spice port range (5900-6144 IIRC).??? >> acl Safe_ports port 280 # http-mgmt >> acl Safe_ports port 488 # gss-http >> acl Safe_ports port 591 # filemaker >> acl Safe_ports port 777 # multiling http >> >> >> >> # Squid normally listens to port 3128 >> http_port 3128 >> >> # Deny requests to certain unsafe ports >> http_access deny !Safe_ports >> >> ------------------------- >> >> and set my SpiceProxyDefault=http://10.10.2.143:3128 >> >> >> >> So far, this is still not working. The Spice popup window still fails to > connect to the graphics server and html5 browser window remains blank. >> Are there any log files that can be used to debug this? >> >> Thanks. >> >> > > There is something I don't understand or that you are doing incorrectly. > > From what you write it seems that: > > - your engine has ip 10.10.2.143 > > - From which ip do you run your browser? > > - Can this ip connect to engine on port 3128? Perhaps your engine > setup already configured iptables (or firewalld) and it is blocking > you? > You can easily verify at runtime by putting this line on engine: > > iptables -I INPUT -s xxx.yyy.www.zzz -j ACCEPT > where xxx.yyy.www.zzz is the ip of the client from where you run the browser > so that you put this accept rule on top of INPUT chain and retry to > connect to VM console > > - Which ip have the hosts where VMs are running? > - Is engine (so your proxy in your configuration) capable to reach ip > of your hosts on spice ports (5900-..)? > > ALso see my previous thread here: > http://lists.ovirt.org/pipermail/users/2013-December/018554.html > > and the useful answers. > > I cannot test your config, because I have no control on my network and > network admins only allow 80 and 443 so that they are already taken by > engine itself and I can't test putting the proxy on engine itself... > > HIH anyway, > Gianluca >

From: Gianluca Cecchi <gianluca.cecchi(a)gmail.com&gt; To: &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; Cc: David Li <david_li(a)sbcglobal.net&gt; Sent: Tuesday, January 28, 2014 9:21 AM Subject: Re: [Users] Spice-proxy questions On Tue, Jan 28, 2014 at 9:49 AM, David Jaša wrote: > On Po, 2014-01-27 at 11:21 -0800, David Li wrote: >> Do I need to generate and install a x509 key pair for the squid proxy?  How can I find out if the key pair has already been done? > > No. Spice channels are encrypted end-to-end so if you configure squid to > forward the connections just to the display network range of the hosts, > you anly allow connections that are encrypted anyway - so the TLS would > be here quite redundant. > > Have you made sure that you have opened port 3128 in iptables? If the > box doesn't use firewalld (which is the case on RHEL/CentOS, Fedora must > be configured to disable firewalld but I presume that engine-setup does > that), add the port definition among other opened ports > in /etc/sysconfig/iptables. > > David > > PS: I'm mangling reply-to: header for a reason. Please don't hog my > inbox, I can very well read your messages on-list. Thank you. I made a test setting proxy on engine and it seems it is ok. I have no other ports than 80 and 443 allowed so I have to use environment with all the servers in 10.4.4.0 network client 10.4.4.61 engine 10.4.4.60 test VM 10.4.4.63 host (where test VM is running on) 10.4.4.59 # engine-config -s SpiceProxyDefault="http://10.4.4.60:3128" # systemctl restart ovirt-engine configured squid on engine on its default port 3128 I have firewalld configured on engine, so that I have this in /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone>   <short>Public</short>   <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>   <service name="mdns"/>   <service name="ovirt-nfs"/>   <service name="ovirt-http"/>   <service name="dhcpv6-client"/>   <service name="ovirt-websocket-proxy"/>   <service name="ovirt-https"/>   <service name="ssh"/>   <service name="ovirt-postgres"/>   <port protocol="tcp" port="6100"/>   <port protocol="tcp" port="3128"/> </zone> On client CentOS 6.5 (10.4.4.61): I run firefox and connect to webadmin gui of engine (https://10.4.4.60) I have enabled spice proxy for the test VM I select console and specify to run /usr/bin/remote-viewer at popup window, enabling popups in firefox I successfully get the console $ ps -ef|grep remote g.cecchi 23897 23726  0 15:50 pts/0    00:00:00 /usr/bin/remote-viewer /tmp/console.vv g.cecchi 23923 23704  0 15:52 pts/0    00:00:00 grep remote $ sudo lsof -Pp 23897 | grep TCP remote-vi 23897 g.cecchi    4u  IPv6 498441      0t0    TCP localhost:45817->localhost:6010 (ESTABLISHED) remote-vi 23897 g.cecchi  14u  IPv4 498447      0t0    TCP 10.4.4.61:36909->10.4.4.60:3128 (ESTABLISHED) remote-vi 23897 g.cecchi  20u  IPv4 498449      0t0    TCP 10.4.4.61:36910->10.4.4.60:3128 (ESTABLISHED) remote-vi 23897 g.cecchi  24u  IPv4 498451      0t0    TCP 10.4.4.61:36911->10.4.4.60:3128 (ESTABLISHED) remote-vi 23897 g.cecchi  25u  IPv4 498452      0t0    TCP 10.4.4.61:36912->10.4.4.60:3128 (ESTABLISHED) remote-vi 23897 g.cecchi  60u  IPv4 497799      0t0    TCP 10.4.4.61:44961->10.4.4.60:443 (ESTABLISHED) On engine (10.4.4.60) # netstat -an|grep 3128 tcp6      0      0 :::3128                :::*                    LISTEN tcp6      0      0 10.4.4.60:3128          10.4.4.61:36912        ESTABLISHED tcp6      0      0 10.4.4.60:3128          10.4.4.61:36911        ESTABLISHED tcp6      0      0 10.4.4.60:3128          10.4.4.61:36910        ESTABLISHED tcp6      0      0 10.4.4.60:3128          10.4.4.61:36909        ESTABLISHED On hypervisor (10.4.4.59) $ netstat -an|grep 5901 tcp        0      0 0.0.0.0:5901            0.0.0.0:*              LISTEN tcp        0      0 10.4.4.59:5901          10.4.4.60:38879        ESTABLISHED tcp        0      0 10.4.4.59:5901          10.4.4.60:38881        ESTABLISHED tcp        0      0 10.4.4.59:5901          10.4.4.60:38880        ESTABLISHED tcp        0      0 10.4.4.59:5901          10.4.4.60:38882        ESTABLISHED So all seems ok. Gianluca

What's the "someProxy" supposed to be?

From: "David Li" <david_li(a)sbcglobal.net&gt; To: "Itamar Heim" <iheim(a)redhat.com&gt;, users(a)ovirt.org Sent: Friday, January 24, 2014 12:37:48 AM Subject: Re: [Users] Spice-proxy questions Still not working. I believe spice-proxy has setup on the engine: SpiceUsbAutoShare: true version: general SpiceProxyDefault: myProxy version: general ClientModeSpiceDefault: Auto version: general In the web portal, I also see "Enable SPICE Proxy" checked under "SPICE options". But no matter what method I use under "Console Invocation",  nothing works. It's either fail to connect to the graphics server or show a blank browser window. David ----- Original Message ----- > From: Itamar Heim <iheim(a)redhat.com&gt; > To: David Li <david_li(a)sbcglobal.net>; &quot;users(a)ovirt.org&quot; <users(a)ovirt.org&gt; > Cc: > Sent: Thursday, January 23, 2014 1:01 PM > Subject: Re: [Users] Spice-proxy questions > > On 01/23/2014 10:05 PM, David Li wrote: >> Hi, >> >> It looks like my only option to get a console is using spice-proxy as in > http://www.ovirt.org/Features/Spice_Proxy >> >> However I am not sure how to make it work. I have installed all three > required packages on the engine (3.3.2). And my engine-config shows: >> >> >> [root@xyz ~]# engine-config -a | grep Spice >> EnableSpiceRootCertificateValidation: true version: general >> SpiceReleaseCursorKeys: shift+f12 version: general >> SpiceSecureChannels: smain,sinputs version: 3.0 >> SpiceSecureChannels: > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > version: > 3.1 >> SpiceSecureChannels: > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > version: > 3.2 >> SpiceSecureChannels: > smain,sinputs,scursor,splayback,srecord,sdisplay,susbredir,ssmartcard > version: > 3.3 >> SpiceToggleFullScreenKeys: shift+f11 version: general >> SpiceUsbAutoShare: true version: general >> SpiceProxyDefault:  version: general > > i don't remember the details, but i assume SpiceProxyDefault should not > be empty, set it with engine-config -s SpiceProxyDefault > > engine-config.properties:SpiceProxyDefault.description='Default proxy > used by SPICE client to connect to the > > >> ClientModeSpiceDefault: Auto version: general >> >> >> The problem is that on my web portal, I don't see any "Enable > SPICE Proxy" box that I can check. >> >> Anyone knows why? >> >> Thanks. >> >> David >> >> _______________________________________________ >> Users mailing list >> Users(a)ovirt.org >> http://lists.ovirt.org/mailman/listinfo/users >> > _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

Hi Tomas, David: I set my SpiceProxyDefault to "http://<ovirt-engine-IP>:80 and my .vv file indeed reflects that. However this is still not working. The popup window still fails to connect to the graphic server. Any further suggestion how to debug? Thanks. David