关于openstack中spice加密问题的探讨

最新推荐文章于 2024-03-15 10:23:30 发布

day walker

最新推荐文章于 2024-03-15 10:23:30 发布

阅读量5.7k

点赞数

分类专栏： openstack 文章标签： openstack ssl spice

本文链接：https://blog.youkuaiyun.com/happyteafriends/article/details/53668131

版权

openstack 专栏收录该内容

22 篇文章

订阅专栏

本文介绍如何生成证书并配置QEMU的Spice使用TLS，包括生成证书脚本、配置qemu.conf启用TLS、修改Nova代码限制仅开启TLS端口的方法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

生成证书

首先生成证书等，从网上查了一个，生成脚本如下：

#!/bin/bash

SERVER_KEY=server-key.pem
# creating a key for our ca
if [ ! -e ca-key.pem ]; then
 openssl genrsa -des3 -out ca-key.pem 1024
fi
# creating a ca
if [ ! -e ca-cert.pem ]; then
 openssl req -new -x509 -days 1825 -key ca-key.pem -out ca-cert.pem  -subj "/C=CN/L=BeiJing/O=E3Cloud/CN=my ca"
fi
# create server key
if [ ! -e $SERVER_KEY ]; then
 openssl genrsa -out $SERVER_KEY 1024
fi
# create a certificate signing request (csr)
if [ ! -e server-key.csr ]; then
 openssl req -new -key $SERVER_KEY -out server-key.csr -subj "/C=CN/L=BeiJing/O=E3Cloud/CN=my server"
fi
# signing our server certificate with this ca
if [ ! -e server-cert.pem ]; then
 openssl x509 -req -days 1825 -in server-key.csr -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
fi

# now create a key that doesn't require a passphrase
openssl rsa -in $SERVER_KEY -out $SERVER_KEY.insecure
mv $SERVER_KEY $SERVER_KEY.secure
mv $SERVER_KEY.insecure $SERVER_KEY

# show the results (no other effect)
openssl rsa -noout -text -in $SERVER_KEY
openssl rsa -noout -text -in ca-key.pem
openssl req -noout -text -in server-key.csr
openssl x509 -noout -text -in server-cert.pem
openssl x509 -noout -text -in ca-cert.pem
# copy *.pem file to /etc/pki/libvirt-spice
if [[ -d "/etc/pki/libvirt-spice" ]]
then
 cp ./*.pem /etc/pki/libvirt-spice
else
 mkdir /etc/pki/libvirt-spice
 cp ./*.pem /etc/pki/libvirt-spice
fi

# echo SUBJECT
echo "SUBJECT is:" \" `openssl x509 -noout -text -in server-cert.pem | grep Subject: | cut -f 10- -d " "` \"

配置qemu 的spice使用tls

#vim /etc/libvirt/qemu.conf
spice_listen="0.0.0.0"
spice_tls=1
spice_tls_x509_cert_dir="/etc/pki/libvirt-spice"

重启 libvirtd

ps aux|grep kvm 可以看到虚拟机实际上用了两个端口
-spice port=5900,tls-port=5901,addr=0.0.0.0,x509-dir=/etc/pki/libvirt-spice,

A <graphics type='spice' autoport='yes' listen='0.0.0.0' passwd='123456'>     
B <graphics type='spice' port='5901' autoport='no' listen='0.0.0.0' passwd='123456'>
C <graphics type='spice' tlsPort='-1' autoport='no' listen='0.0.0.0' passwd='123456'>

xml文件中安全端口可以有不同设置方法

A: 每台虚拟机自动配置两个端口,普通端口和安全端口,并且端口号自动分配(5900+N)

B: 不自动配置端口,手动指定一个普通端口,不开启安全端口

C: 不自动配置端口,只开启安全端口,并且安全端口自动分配(5900+N)

再nova中配置SPICE的ssl_only后，似乎虚拟机仍有两个端口可用。

此时用DASHBOARD看，控制台Error: Permission denied.

限制只开启TLS端口

不知道通过配置能不能实现，反正我没找到办法，只好修改了NOVA代码

/usr/lib/python2.7/site-packages/nova/virt/libvirt/config.py

def __init__(self, **kwargs):
    super(LibvirtConfigGuestGraphics, self).__init__(root_name="graphics",
                                                     **kwargs)

    self.type = "vnc"
    self.autoport = True
    self.keymap = None
    self.listen = None
    #wz for spice password
    self.passwd = None
    self.ssl_only = None
def format_dom(self):
    dev = super(LibvirtConfigGuestGraphics, self).format_dom()

    dev.set("type", self.type)
    if self.autoport:
        dev.set("autoport", "yes")
    else:
        dev.set("autoport", "no")
    if self.keymap:
        dev.set("keymap", self.keymap)
    if self.listen:
        dev.set("listen", self.listen)
    if self.passwd:
        dev.set("passwd", self.passwd)
    if self.ssl_only:
        dev.set("tlsPort","-1")

    return dev

增加了tlsPort -1并设置autoport FALSE

/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py

 if (CONF.spice.enabled and
            virt_type not in ('lxc', 'uml', 'xen') and not isSuper):
        graphics = vconfig.LibvirtConfigGuestGraphics()
        graphics.type = "spice"
        graphics.autoport = False
        graphics.ssl_only = True
        graphics.keymap = CONF.spice.keymap
        graphics.listen = CONF.spice.server_listen
        guest.add_device(graphics)
        add_video_driver = True

重启相关服务，再从virt-manager去看，只开启了tls端口的spice

[virt-viewer]
type=spice
host=10.10.0.100
tls-port=5900
password=6a37617677e73237f9b5ffe1468240ca
fullscreen=1
usb-filter=-1,-1,-1,-1,0
toggle-fullscreen=shift+f11
release-cursor=shift+f12
host-subject= C=CN,L=BeiJing,O=E3Cloud,CN=e3cloud Server
ca=-----BEGIN CERTIFICATE-----\nMIICWjCCAcOgAwIBAgIJAJ681/ZITtaSMA0GCSqGSIb3DQEBCwUAMEYxCzAJBgNV\nBAYTAkNOMRAwDgYDVQQHDAdCZWlKaW5nMRAwDgYDVQQKDAdFM0Nsb3VkMRMwEQYD\nVQQDDAplM2Nsb3VkIENBMB4XDTE2MTIyOTA2NDg0NFoXDTIxMTIyODA2NDg0NFow\nRjELMAkGA1UEBhMCQ04xEDAOBgNVBAcMB0JlaUppbmcxEDAOBgNVBAoMB0UzQ2xv\ndWQxEzARBgNVBAMMCmUzY2xvdWQgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ\nAoGBAMwdKhY6OXwytLrgO6/sayofM+lg5oWLOfp9DtzuUVeU40fPRwcLFUNqOEiz\nUkk046qw1AA3p7C9TUXzQvZRFuk1rm+6jOAYxBdbvmbLhz7rtF5LjwENxikp9XYZ\npAeY3nEUGPkACVxl1ZUXsZ1btO6XaYAJ9cmBE3Qfaswjxh77AgMBAAGjUDBOMB0G\nA1UdDgQWBBSxwyQ+R1m7hl/xSZJFa4a82Tf3zTAfBgNVHSMEGDAWgBSxwyQ+R1m7\nhl/xSZJFa4a82Tf3zTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAEmr\nm/6p9mDaXWl/5G4PDsl06yWUvefbyTTfCpJlQQ8jRr2xEnqzquB/3tiBtjoiwU5o\naJqs/Bx0Kuf1GzgxHYB37TzLGiMu9pQ9i54VGUYkeU+y7E+7KMV14GDfNZm02I0Z\nOc4qEEFNTiGHz0SVpxusJ1YmthU0F7cnoMGxExuD\n-----END CERTIFICATE-----

其他：https://www.spice-space.org/docs/manual/manual.chunked/ar01s08.html

搞IT没有谷歌不行，推荐给大家个VPN,SHADOWSOCKS,每年花点小钱，远离坑害
shadowsocks下载