Ce contenu n'est pas disponible dans la langue sélectionnée.
E.3. Enabling encrypted VNC consoles for FIPS
You can set up encrypted VNC consoles to work with a Red Hat Virtualization (RHV) Manager and hosts that have FIPS enabled.
To set up encrypted VNC consoles, you complete the following procedures:
E.3.1. Configuring the cluster to enable VNC Encryption
Prerequisites
- FIPS must be enabled on the cluster.
Procedure
-
In the Administration Portal, click
. - Select the cluster where you plan to enable VNC encryption and click . The Edit Cluster window opens.
- Select the Console tab.
- Select the Enable VNC Encryption checkbox and click .
E.3.2. Running the VNC SASL Ansible playbook for each host
Procedure
In the Administration Portal, put the FIPS-enabled hosts into maintenance mode:
-
Click
. In the Virtual Machines column, verify that each host has zero virtual machines.
Perform a live migration to remove virtual machines from hosts, if necessary. See Migrating Virtual Machines Between Hosts.
-
Select each host and click
and .
-
Click
Connect to the command line of the machine where the Manager is running.
Standalone Manager:
# ssh root@rhvm
-
Self-hosted engine: Click
to select the self-hosted engine virtual machine, named HostedEngineby default, and then click .
Run the VNC SASL Ansible playbook for each host:
# cd /usr/share/ovirt-engine/ansible-runner-service-project/project/ # ansible-playbook --ask-pass --inventory=<hostname> ovirt-vnc-sasl.yml <1>
- Specify the Hostname displayed on
.
-
Select the host and click
. -
After reinstallation, select the host and click
. -
After rebooting, select the host and click
.
VNC SASL Ansible playbook error message
When running the VNC SASL Ansible playbook, the task might fail with the following error message:
Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host’s fingerprint to your known_hosts file to manage this host.
To solve this problem, disable host key checking by doing one of the following:
Disable host key checking permanently by uncommenting the following line in
/etc/ansible/ansible.cfg:#host_key_checking = False
Disable host key checking temporarily by running the following command:
export ANSIBLE_HOST_KEY_CHECKING=False
E.3.3. Configuring the Remote Viewer to trust the Manager’s CA certificate
Configure the Remote Viewer console on your client machine, virt-viewer or remote-viewer, to trust the RHV Manager’s certificate authority (CA)
Procedure
-
Navigate to
https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA. - Enable all the trust settings.
On the client machine where you plan to run the VNC console, create a directory for the certificate file:
$ mkdir ~/.pki/CA
WarningIf this step generates an error such as
mkdir: cannot create directory ‘/home/example_user/.pki/CA’: File exists, take precautions to avoid overwriting~/.pki/CA/cacert.pemin the next step. For example, include the current date in the filename.Download the certificate:
$ curl -k -o ~/.pki/CA/cacert-<today’s date>.pem '\https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA'
Install the certificate authority in your browser:
Install the SASL SCRAM libraries on the client machine:
$ sudo dnf install cyrus-sasl-scram
Verification steps
- Run a virtual machine on one of the FIPS-enabled hosts you created.
- Connect to the virtual machine using a VNC console.
Additional resources
