Chapter 13. Remote management of virtualized guests

13.1. Remote management with SSH
13.2. Remote management over TLS and SSL
13.3. Transport modes

This section explains how to remotely manage your virtualized guests using ssh or TLS and SSL.

13.1. Remote management with SSH

The ssh package provides an encrypted network protocol which can securely send management functions to remote virtualization servers. The method described uses the libvirt management connection securely tunneled over an SSH connection to manage the remote machines. All the authentication is done using SSH public key cryptography and passwords or passphrases gathered by your local SSH agent. In addition the VNC console for each guest virtual machine is tunneled over SSH.

SSH is usually configured by default so you probably already have SSH keys setup and no extra firewall rules needed to access the management service or VNC console.

Be aware of the issues with using SSH for remotely managing your virtual machines, including:

you require root log in access to the remote machine for managing virtual machines,
the initial connection setup process may be slow,
there is no standard or trivial way to revoke a user's key on all hosts or guests, and
ssh does not scale well with larger numbers of remote machines.

Configuring SSH access for `virt-manager`

The following instructions assume you are starting from scratch and do not already have SSH keys set up.

You need a public key pair on the machine virt-manager is used. If ssh is already configured you can skip this command.
```
$ ssh-keygen -t rsa
```
To permit remote log in, virt-manager needs a copy of the public key on each remote machine running libvirt. Copy the file $HOME/.ssh/id_rsa.pub from the machine you want to use for remote management using the scp command:
```
$ scp $HOME/.ssh/id_rsa.pub root@somehost:/root/key-dan.pub
```
After the file has copied, use ssh to connect to the remote machines as root and add the file that you copied to the list of authorized keys. If the root user on the remote host does not already have an list of authorized keys, make sure the file permissions are correctly set
```
$ ssh root@somehost
# mkdir /root/.ssh
# chmod go-rwx /root/.ssh
# cat /root/key-dan.pub >> /root/.ssh/authorized_keys
# chmod go-rw /root/.ssh/authorized_keys
```

The `libvirt` daemon (`libvirtd`)

The libvirt daemon provide an interface for managing virtual machines. You should use the libvirtd daemon installed and running on every remote host that you need to manage. Using the Fedora kernel-xen package requires a speci TODO

$ ssh root@somehost
# chkconfig libvirtd on
# service libvirtd start

After libvirtd and SSH are configured you should be able to remotely access and manage your virtual machines. You should also be able to access your guests with VNC at this point.