web interface?

Hi guys, I had a quick question.

I was playing around writing a php-based web interface for KVM. Basically something that would allow you to use a tiny distro and let you manage disk/net etc via php (atm its crude to say the least).

It all seems relatively straight forward except for one component - the console bits. I wanted to make it so you could click on your new vm, then click on a "console" link and *poof* your console appears on your web browser via an embedded java applet. The problem is security, Authenticating users on the page is simple enough, but i cant see a method by which i could put a password on the vnc port in qemu?

Ideally, what i would like to be able to do is when someone accesses the console it sets the password randomly, then embed's it into the request. Once everyone disconnects it resets the password (but thats not quite so important at this point).

Of course, if someone is already doing a web interface then i'd like to know that too :)

Thanks in advance guys.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

Take a look at Lucho's kvmfs before you go too far.

See his OLS talk and papers.

ron

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

https://ols2006.108.redhat.com/2007/Reprints/mirtchovski-Reprint.pdf

Seems pretty cool.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

Wow, those are both pretty informative. Given both those replies, i'm wondering if i should continue?

The kind of thing I had in mind was relatively simple, it'd be a miniture OS that would boot up (over pxe/usb/cdrom) into ram (its about 90mb of ram so far with kvm and a full kernel + kudzu and few small components such as a httpd+php). it searches for a configuration partition and away you go managing the rest via the web interface. I had clustering/multi-node sitting at the back of my head as well.

But im no guru at such things, and the reason I ask is that it sounds like it may be someone is already thinking along those lines anyway (someone much better at such things than me!).

Thanks for the replies everyone.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

FYI, libvirt also now provides secure remote access, so it can be used off-node from the box being managed. Access is either tunnelled over SSH, or directly connected using TLS + x509 certificates.

http://libvirt.org/remote.html

This would enable a single web service to manage multiple hosts securely.
http://libvirt.org/remote.html

I illustrated some very simple examples here, showing the same commands talking to Xen, and KVM/QEMU both locally and remotely over SSH, or TLS.

http://berrange.com/personal/diary/2007/07/libvirt-remote-management-news

Regards,
Dan.

|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

Yeah, i did look at libvirt and it remains an option. Originally this was all going to be built around xen (I got xen running on two servers and had it changing the number of cpu's in a pv host on the fly as well as live-migrate guests and went oooooo). But then kvm got merged and so i went thru a phase of trying to decide which would be better suited to my little project. Around the same time frame, f7 came out and i had a good play with virt manager (as well as a few other things like the qemu virtualpc for webmin plugin). Libvirt was right after that and i wrote a bit of test code to see what i could do with it mostly because it solved part of the equation. After much agonizing though i settled on native kvm/qemu mostly for simplicity and its ability to run non-modified guests on non-hardware virt capable cpus.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

libvirt could help in reference to the points elsewhere in this thread about some people prefering to use a Web UI, and others preferring to automate with command line tools. The command line virsh tool would see exactly the same state as the Web UI & they'd each see the results of the other's changes.

We realize there are some things that libvirt doesn't support in its APIs yet, and so welcome feedback from any users & developers about capabilites that they need so we can adapt & prioritize future development plans.

Regards,
Dan.

|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

I can tell you that for clusters web console interfaces are pretty useless, as scripting is hard for them, and a web interface is really pretty clumsy for almost anything of reasonable size. I think that kvmfs is really a great idea, and what I would want if I had a 128 or 1024 node or larger cluster. Note that we plan9 to do sims here with 10,000 instances of lguest on a 128-node cluster, and a web interface would be the worst possible way to do that.

ron

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

Being a command line guy myself, I tend to agree and disagree. You can wrap up nearly all of your day-to-day tasks in a gui (be it X, web or other). Your gui may only provide 75% of the functionality of your software. The kind of thing i had in mind was more like, "hey, we got a new initrd//kernel, lets push that out to the pxeboot area and we'll do rolling reboots of the nodes" and get the cluster/web framework to manage live migration of hosts (or shutdown/startup) from one node to another. Plus things like, click, click, click - i just provisioned a new guest with a some disk space, a network connection and a chunk of memory/cpu. Of course the most important part of that is "how's the cluster going this morning" - *click* its all green, good.

That doesn't mean your free from the command, god no cause a gui limits (quite harshly at times) what your capable of doing - but it can simplify your life.

But why web? <story>a while ago i was deploying a bunch of sun servers doing some web server work for a large corp (by AU terms, 50k employee's) mostly j2ee, iplanet web server and oracle. They used HP openview (among other things), but the op's guys jumped on and installed big brother agents. The guy said to me "oh yeah, we have this little server over here running bb for ourselves cause we can do almost anything and monitor almost anything with it. If its not in BB already its like easy enough to throw together a script of some kind to measure/monitor it. Basically, what i do is set the warning levels really low so i can just pull up my java nokia phone and go thru the wap portal and see if im likely to get paged before i go anywhere. If its yellow, OV wont alarm but I know I had best take a look before i go anywhere".</story>

But, its always made me aim for a simple interface for day-to-day and get funky for the special cases, disaster recovery, etc. Now as the thing im trying to manage gets large, the better I want that interface to be because if i have to manage 4 machines i could ssh into them all and just look, but as that becomes 8 machines, 16, 32, etc the more i need information compressed or the harder its going to be for me to get to terms with it (this may come across as me sounding like im missing the point of kvmfs, which it inst intended to).

But, i whole-heartedly agree with kvmfs, it looks brilliant and exactly what vm's really do need!

Of course, prefix everything i just said with "in my humble opinion".

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/

Well since KVM uses QEMU you'd really be writing a frontend for that. I've already seen a number of other projects for QEMU frontends, google should turn up a few.

Try http://www.oszoo.org/wiki/index.php/Free_Live_OS_Zoo

http://fedoraproject.org/wiki/Releases/FeatureVirtSecurity is a project tasked with improving VNC security among other things, right now qemu doesn't have many options in that regard.

Xen has patches to qemu vnc for supporting passwords if you need a starting point. Though iirc they are pulled from the xenstore or whatever they call it, so it would need some work I'd imagine.

Matthew Kent \ SA \ bravenet.com


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

Yep, this is the code I'm just finishing off now in preparation for review on QEMU mailing lists.

The Xenstore integration made it pretty useless as a basis for password support in general QEMU codebase :-(

Dan.

|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

You could have the qemu listen on localhost, the web server connect to qemu and encapsulate it in ssl, so:

[ client ] ---ssl---> [ web server ] ----plain---> [ qemu ]

Presumably, the ssl session was already authenticated by the web server, so all you need to do is peel away the ssl encapsulation and forward traffic to the qemu process.

An advantage of this approach is that qemu need not be on the same machine as the web server; you could have a single web server tunneling vnc sessions to several hosts.

error compiling committee.c: too many arguments to function


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

Watch this space. I will be submitting patches to upstream QEMU either today or tomorrow which will enable password support in VNC. It will also provide for optional TLS encryption, and x509 certificates for both client and server validation & authentication.

My patches will cope with that scenario. They provide a monitor command to let you change the password on the fly.

Regards,
Dan.

|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

Oh that's great stuff. I'll be sure to help test it out thoroughly.

Matthew Kent \ SA \ bravenet.com


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/