E.3. Enabling encrypted VNC consoles for FIPS

Procedure

1. In the Administration Portal, click Compute Clusters.
2. Select the cluster where you plan to enable VNC encryption and click Edit. The Edit Cluster window opens.
3. Select the Console tab.
4. Select the Enable VNC Encryption checkbox and click OK.

Procedure

1. In the Administration Portal, put the FIPS-enabled hosts into maintenance mode:

   1. Click Compute Hosts.

   2. In the Virtual Machines column, verify that each host has zero virtual machines.

      Perform a live migration to remove virtual machines from hosts, if necessary. See Migrating Virtual Machines Between Hosts.

   3. Select each host and click Management Maintenance and OK.

2. Connect to the command line of the machine where the Manager is running.

   • Standalone Manager:

     # ssh root@rhvm

     Copy to Clipboard Toggle word wrap
   • Self-hosted engine: Click Compute Virtual Machines to select the self-hosted engine virtual machine, named HostedEngine by default, and then click Console.

3. Run the VNC SASL Ansible playbook for each host:

   # cd /usr/share/ovirt-engine/ansible-runner-service-project/project/
   # ansible-playbook --ask-pass --inventory=<hostname> ovirt-vnc-sasl.yml <1>

   Copy to Clipboard Toggle word wrap

   Specify the Hostname displayed on Compute Hosts.

4. Select the host and click Installation Reinstall.
5. After reinstallation, select the host and click Management Restart.
6. After rebooting, select the host and click Management Activate.

Procedure

1. Navigate to https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA.
2. Enable all the trust settings.

3. On the client machine where you plan to run the VNC console, create a directory for the certificate file:

   $ mkdir ~/.pki/CA

   Copy to Clipboard Toggle word wrap
   Warning

   If this step generates an error such as mkdir: cannot create directory ‘/home/example_user/.pki/CA’: File exists, take precautions to avoid overwriting ~/.pki/CA/cacert.pem in the next step. For example, include the current date in the filename.

4. Download the certificate:

   $ curl -k -o ~/.pki/CA/cacert-<today’s date>.pem '\https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA'

   Copy to Clipboard Toggle word wrap

5. Install the certificate authority in your browser:

   • Firefox
   • Internet Explorer
   • Google Chrome.

6. Install the SASL SCRAM libraries on the client machine:

   $ sudo dnf install cyrus-sasl-scram

   Copy to Clipboard Toggle word wrap

Verification steps

1. Run a virtual machine on one of the FIPS-enabled hosts you created.
2. Connect to the virtual machine using a VNC console.