KVM网页管理工具WebVirtMgr部署

便民

　　0ther
　　
https://github.com/retspen/webvirtmgr/wiki

System Optimization(Only CentOS6.X)
　　Run
　　

# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config　　
# LANG=en
　　
# for root in `chkconfig --list|grep 3:on|awk '{print $1}'`;do chkconfig --level 3 $root off;done
　　
# for root in crond network rsyslog sshd;do chkconfig --level 3 $root on;done
　　
# chkconfig --list|grep 3:on
　　

Install WebVirtMgr

1. Installation

CentOS/RHEL 6.x
　　Run:
　　

# yum -y install epel-release　　
# yum -y install vim wget ftp git python-pip libvirt-python libxml2-python python-websockify supervisor nginx
　　

CentOS 7.x
　　Run:
　　

# yum -y install epel-release　　
# yum -y install vim wget ftp git python-pip libvirt-python libxml2-python python-websockify supervisor nginx  
　　
# yum -y install gcc python-devel
　　
# pip install numpy
　　

2. Install python requirements and setup Django environment
　　Run:
　　

# git clone git://github.com/retspen/webvirtmgr.git　　
# cd webvirtmgr
　　
# pip install -r requirements.txt
　　
# ./manage.py syncdb          //Configuration database
　　
# ./manage.py collectstatic   //Add Database administrator for webvirtmagr, no System administrator!
　　

　　Enter the user information:
　　

You just installed Django's auth system, which means you don't have any superusers defined.　　
Would you like to create one now? (yes/no): yes (Put: yes)
　　
Username (Leave blank to use 'admin'): admin (Put: your username or login)
　　
E-mail address: username@domain.local (Put: your email)
　　
Password: xxxxxx (Put: your password)
　　
Password (again): xxxxxx (Put: confirm password)
　　
Superuser created successfully.
　　

Adding additional superusers
　　Run:
　　

# ./manage.py createsuperuser     //Create an Account, Account Login and Password Information　　

3. Setup Nginx
　　Warning: Usually WebVirtMgr is only available from localhost on port 8000. This step will make WebVirtMgr available to everybody on port 80. The webinterface is also unprotected (no https), which means that everybody in between you and the server (people on the same wifi, your local router, your provider, the servers provider, backbones etc.) can see your login credentials in clear text!
　　Instead you can also skip this step completely + uninstall nginx. By simply redirecting port 8000 to your local machine via SSH. This is much safer because WebVirtMgr is not available to the public any more and you can only access it over an encrypted connection.
　　Example:
　　

# ssh user@server:port -L localhost:8000:localhost:8000 -L localhost:6080:localhost:6080　　

　　You should be able to access WebVirtMgr by typing localhost:8000 in your browser after completing the install. Port 6080 is forwarded to make noVNC work.
　　If you really know what you are doing, feel free to ignore the warning and continue setting up the redirect with nginx:
　　

# cd ..  && mkdir -p /data/www　　
# mv webvirtmgr /data/www/
　　

　　Add file webvirtmgr.conf in /etc/nginx/conf.d
　　

server {　　listen 80 default_server;
　　

　　server_name $hostname;
　　access_log  off;
　　

　　location /static/ {
　　root /data/www/webvirtmgr;
　　expires max;
　　}
　　

　　location / {
　　proxy_pass http://127.0.0.1:8000;
　　proxy_set_header X-Real-IP $remote_addr;
　　proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
　　proxy_set_header Host $host:$server_port;
　　proxy_set_header X-Forwarded-Proto $scheme;
　　proxy_connect_timeout 600;
　　proxy_read_timeout 600;
　　proxy_send_timeout 600;
　　client_max_body_size 1024M; # Set higher depending on your needs
　　}
　　
}
　　

　　Delete default.conf
　　

# cd /etc/nginx/conf.d && rm -rf default.conf　　

　　Open nginx.conf out of /etc/nginx/nginx.conf (in Ubuntu 14.04 LTS the configuration is in /etc/nginx/sites-enabled/default):
　　

# vim /etc/nginx/nginx.conf　　

　　Comment the Server Section as it is shown in the example:
　　

#    server {　　
#        listen       80 default_server;
　　
#        server_name  localhost;
　　
#        root         /usr/share/nginx/html;
　　
#
　　
#        #charset koi8-r;
　　
#
　　
#        #access_log  /var/log/nginx/host.access.log  main;
　　
#
　　
#        # Load configuration files for the default server block.
　　
#        include /etc/nginx/default.d/*.conf;
　　
#
　　
#        location / {
　　
#        }
　　
#
　　
#        # redirect server error pages to the static page /40x.html
　　
#        #
　　
#        error_page  404              /404.html;
　　
#        location = /40x.html {
　　
#        }
　　
#
　　
#        # redirect server error pages to the static page /50x.html
　　
#        #
　　
#        error_page   500 502 503 504  /50x.html;
　　
#        location = /50x.html {
　　
#        }
　　
#    }
　　

　　Restart nginx service:
　　

# service nginx restart && chkconfig nginx on　　

　　Update SELinux policy
　　

# setsebool httpd_can_network_connect true　　

　　make it permanet service:
　　

# chkconfig supervisord on　　

4. Setup Supervisor

CentOS, RedHat, Fedora
　　Run:
　　

# chown -R nginx:nginx /data/html/webvirtmgr　　

　　Open supervisord.conf in /etc/supervisord.conf with following content:
　　

[program:webvirtmgr]　　
command=/usr/bin/python /data/www/webvirtmgr/manage.py run_gunicorn -c /data/www/webvirtmgr/conf/gunicorn.conf.py
　　
directory=/data/www/webvirtmgr
　　
autostart=true
　　
autorestart=true
　　
logfile=/var/log/supervisor/webvirtmgr.log
　　
log_stderr=true
　　
user=nginx
　　

　　
[program:webvirtmgr-console]
　　
command=/usr/bin/python /data/www/webvirtmgr/console/webvirtmgr-console
　　
directory=/data/www/webvirtmgr
　　
autostart=true
　　
autorestart=true
　　
stdout_logfile=/var/log/supervisor/webvirtmgr-console.log
　　
redirect_stderr=true
　　
user=nginx
　　

Restart supervisor daemon
　　

# service supervisord restart && chkconfig supervisord on　　

WebVirtMgr :Make it permanet service
　　

# vim /etc/rc.d/rc.local　　
...
　　
nohup ./data/www/webvirtmgr/manage.py runserver 0.0.0.0:8000 &
　　
...
　　

Reboot System

Setup SSH Authorization

For new versions of webvirtmgr

• Create SSH private key and ssh config options (On system where WebVirtMgr is installed):
  

　　

# cd /var/cahce/nginx/ &&　　
# mkdir .ssh
　　
# chown -Rf nginx:nginx .ssh
　　
# chmod -Rf 700 .ssh
　　
# su - nginx -s /bin/bash
　　

$ ssh-keygen　　
Generating public/private rsa key pair.
　　
Enter file in which to save the key (path-to-id-rsa-in-nginx-home):   Just hit Enter here!
　　
$ touch ~/.ssh/config && echo -e "StrictHostKeyChecking=no\nUserKnownHostsFile=/dev/null" >> ~/.ssh/config
　　
$ chmod -Rf 0600 ~/.ssh/config
　　

• Copy public key to qemu-kvm/libvirt host server:
  

　　

# su - nginx -s /bin/bash　　
$ ssh-copy-id root@emu-kvm-libvirt-host
　　
if you changed the default SSH port use:
　　
$ ssh-copy-id -P YOUR_SSH_PORT root@qemu-kvm-libvirt-host
　　

　　
Now you can test the connection by entering:
　　
$ ssh root@qemu-kvm-libvirt-host
　　

Setup TCP Authorization

Setup Host Server

Supported Linux distributions
　　CentOS 6.3, RedHat 6.3 and above
　　Fedora 18 and above
　　Debian Testing, Ubuntu 12.04 and above

Setup libvirt and KVM
　　

# curl http://retspen.github.io/libvirt-bootstrap.sh | sudo sh　　

　　or if haven't curl
　　

# wget -O - http://retspen.github.io/libvirt-bootstrap.sh | sudo sh　　

Configuring the firewall

CentOS 6, Fedora 18, RedHat EL6
　　Open access to libvirt port
　　

# iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 16509 -j ACCEPT　　

CentOS 7, Fedora 19+, RedHat EL7 (and other distributions utilizing firewalld)
　　Find your firewalld zones:
　　

# firewall-cmd --get-active-zones　　

　　The zone for the interface which connects the libvirt host and the webvirtmgr host is in the public zone by default, so the command is:
　　

# firewall-cmd --zone=public --add-port 16509/tcp --permanent　　

# firewall-cmd --reload　　

　　Otherwise substitute --zone=public in the above for the correct zone.
　　Adding users and setting their passwords is done with the saslpasswd2 command. When running this command it is important to tell it that the appname is libvirt. As an example, to add a user admin, run
　　

# saslpasswd2 -a libvirt admin　　
Password: xxxxxx
　　
Again (for verification): xxxxxx
　　

　　To see a list of all accounts the sasldblistusers2 command can be used. This command expects to be given the path to the libvirt user database, which is kept in /etc/libvirt/passwd.db
　　

# sasldblistusers2 -f /etc/libvirt/passwd.db　　
admin@webvirtmgr.net: userPassword
　　

　　To disable a user's access, use the command saslpasswd2 with the -d
　　

# saslpasswd2 -a libvirt -d admin　　

Verify settings
　　Before you add the ip address of your server in the control center perform the following test
　　

# virsh -c qemu+tcp://IP_address/system nodeinfo　　
Please enter your authentication name: admin
　　
Please enter your password: xxxxxx
　　
CPU model:           x86_64
　　
CPU(s):              2
　　
CPU frequency:       2611 MHz
　　
CPU socket(s):       1
　　
Core(s) per socket:  2
　　
Thread(s) per core:  1
　　
NUMA cell(s):        1

　　
Memory>　　

　　If you have same error:
　　

# virsh -c qemu+tcp://IP_address/system nodeinfo　　
Please enter your authentication name: admin
　　
Please enter your password:
　　
error: authentication failed: authentication failed
　　
error: failed to connect to the hypervisor
　　

　　Try input login with domain (hostname):
　　

# sasldblistusers2 -f /etc/libvirt/passwd.db　　
admin@webvirtmgr.net: userPassword