[Users] Notes on setting spice-proxy console option

[Michal Skrivanek]

On Jan 28, 2014, at 20:14 , Marian Krcmarik <mkrcmari at redhat.com> wrote:

> 
> 
> ----- Original Message -----
>> From: "David Li" <david_li at sbcglobal.net>
>> To: users at ovirt.org
>> Cc: "david li" <david_li at sbcglobal.net>
>> Sent: Tuesday, January 28, 2014 7:41:26 PM
>> Subject: [Users] Notes on setting spice-proxy console option
>> 
>> Hi,
>> 
>> I have struggled quite a bit to get it up and running. Over the time, I have
>> accumulated some notes on various things I did so to share with everyone who
>> is interested in doing this. This complements the online doc in a way that
>> might give me a complete picture in one place. However I need some
>> clarifications as I might have forgotten to document certain steps or
>> certain steps I did turn out to be not necessary in the end. It will be
>> great if experts here can help me get the things straight.
>> 
>> 
>> My setup is like:
>> 
>> Browser (firefox 24.2 on RHEL6) ------------ ovirt-engine (3.3.2)
>> ------------ ovirt-node (3.0.3)
>> 
>> No direct network connectivity from the browser machine to the node machine.
>> 
>> These are the major things I installed for spice-proxy to work:
>> 
>>     * On ovirt-engine:
>>        yum install spice-gtk, virt-viewer, spice-xpi
> These components are client components (what you call Browser machine).
>>        yum-install squid
>>       /etc/squid/squid.conf updates:
>>     acl localhost src <browser IP addr>
>>         #http_access deny CONNECT !SSL_ports
> I would rather allow CONNECT to specific Spice ports only 5634-6166:
> acl Spice_ports port 5634-6166
> http_access denny CONNECT !Spice_ports
>>         http_access deny !Safe_ports
>>         http_port 3128
>>     
>>        service squid restart
>>        make sure iptables allow 3128
>> 
>>        engine-config -s SpiceProxyDefault= http://<ovirt-engine-IP>:3128
>>        service ovirt-engine restart
>>    
>>    *  On browser machine running firefox 24.2.0 on RHEL6 for running browser
>>    console plugin client
>>       yum install spice-xpi.
> spice-xpi should bring its dependencies virt-viewer -> spice-gtk -> etc. but If you do not wish to use the plugin launch type, you may install only virt-viewer (without spice-xpi) and use what I guess is called "Native client" launch type.
>>       make sure VM's console option is set to SPICE
>>       
>> Are the above steps reasonable? any missing or redundant?
> Seems fine, just no need the client packages on the engine.
>> 
>> Additional questions:
>> 
>> 1. Will spice-proxy work with the Spice HTML5 client in the browser?
> Probably, but you would need to set the websocket proxy which is part of installation steps for engine as well (I believe).

since it's a proxy as well I'd recommend to use it instead of squid, not in addition. By default it's installed on the engine host but it can be deployed anywhere else.

>> 2. Is the spice-proxy architecture diagram like:  browser --------- squid
>> proxy - spice-proxy ---------------------- VM
> Browser plugin spice-xpi invokes start of Spice client (virt-viewer) which makes CONNECT to Host machine (where the VM is hosted) through the HTTP proxy (in your case squid).
> Client machine ---> Squid ---> Host (where the VM is hosted).
>> 3. I didn't explicitly install any certs for the squid proxy. Is it
>> automatically taken care of?
> No, no authentication to Squid is supported with Spice now. So If It is publicly visible proxy It's important to set careful proxy rules.
>> 
>> 
>> References:
>> 
>> http://www.ovirt.org/Console_Client_Resources
>> 
>> http://www.ovirt.org/Features/Spice_Proxy
>> 
>> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.3/pdf/Installation_Guide/Red_Hat_Enterprise_Virtualization-3.3-Installation_Guide-en-US.pdf
>> 
>> 
>> Thanks.
>> 
>> David
>> 
>> _______________________________________________
>> Users mailing list
>> Users at ovirt.org
>> http://lists.ovirt.org/mailman/listinfo/users
>> 
> _______________________________________________
> Users mailing list
> Users at ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users