Thank you Matthias.
I addressed the issues that you mentioned below.
Now i have my libvirt built for esx.
I followed the instructions http://libvirt.org/remote.html#Remote_TLS_CA to generate the CA key/cert and client key/cert.
However, the connect still fails, with "error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60)".
Trace is below:
root# virsh -c esx://a.b.c.d
14:21:29.771: debug : virInitialize:336 : register drivers
14:21:29.772: debug : virRegisterDriver:837 : registering Test as driver 0
14:21:29.772: debug : virRegisterNetworkDriver:675 : registering Test as network driver 0
14:21:29.772: debug : virRegisterInterfaceDriver:706 : registering Test as interface driver 0
14:21:29.772: debug : virRegisterStorageDriver:737 : registering Test as storage driver 0
14:21:29.772: debug : virRegisterDeviceMonitor:768 : registering Test as device driver 0
14:21:29.772: debug : virRegisterSecretDriver:799 : registering Test as secret driver 0
14:21:29.773: debug : virRegisterDriver:837 : registering Xen as driver 1
14:21:29.773: debug : virRegisterDriver:837 : registering OPENVZ as driver 2
14:21:29.774: debug : vboxRegister:109 : VBoxCGlueInit failed, using dummy driver
14:21:29.774: debug : virRegisterDriver:837 : registering VBOX as driver 3
14:21:29.774: debug : virRegisterNetworkDriver:675 : registering VBOX as network driver 1
14:21:29.774: debug : virRegisterStorageDriver:737 : registering VBOX as storage driver 1
14:21:29.774: debug : virRegisterDriver:837 : registering ESX as driver 4
14:21:29.775: debug : virRegisterDriver:837 : registering remote as driver 5
14:21:29.775: debug : virRegisterNetworkDriver:675 : registering remote as network driver 2
14:21:29.775: debug : virRegisterInterfaceDriver:706 : registering remote as interface driver 1
14:21:29.775: debug : virRegisterStorageDriver:737 : registering remote as storage driver 2
14:21:29.775: debug : virRegisterDeviceMonitor:768 : registering remote as device driver 1
14:21:29.775: debug : virRegisterSecretDriver:799 : registering remote as secret driver 1
14:21:29.775: debug : virConnectOpenAuth:1337 : name=esx://a.b.c.d, auth=0xb7f41678, flags=0
14:21:29.776: debug : do_open:1106 : name "esx://a.b.c.d" to URI components:
scheme esx
opaque (null)
authority (null)
server a.b.c.d
user (null)
port 0
path (null)
14:21:29.776: debug : do_open:1116 : trying driver 0 (Test) ...
14:21:29.776: debug : do_open:1122 : driver 0 Test returned DECLINED
14:21:29.776: debug : do_open:1116 : trying driver 1 (Xen) ...
14:21:29.776: debug : do_open:1122 : driver 1 Xen returned DECLINED
14:21:29.776: debug : do_open:1116 : trying driver 2 (OPENVZ) ...
14:21:29.776: debug : do_open:1122 : driver 2 OPENVZ returned DECLINED
14:21:29.777: debug : do_open:1116 : trying driver 3 (VBOX) ...
14:21:29.777: debug : do_open:1122 : driver 3 VBOX returned DECLINED
14:21:29.777: debug : do_open:1116 : trying driver 4 (ESX) ...
Enter username for a.b.c.d [root]:
Enter root password for a.b.c.d:
14:21:33.416: debug : do_open:1122 : driver 4 ESX returned ERROR
14:21:33.416: debug : virUnrefConnect:259 : unref connection 0x931f698 1
14:21:33.417: debug : virReleaseConnect:216 : release connection 0x931f698
error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60)
error: failed to connect to the hypervisor
BTW, I observed that any modification to the /etc/libvirt/libvirt.conf does not take effect when. Isn't this the default conf file for libvirt/virsh? The changes i am talking about are:
- for default path for the CA key/cert and clinet key/cert
- uncommented #tls_no_verify_certificate = 1
# ls /etc/pki/CA/
cacert.pem cakey.pem
# ls /etc/pki/libvirt/
clientcert.pem private
# ls /etc/pki/libvirt/private/
clientkey.pem
Thank you in advance for any comments/suggestions.
Antonela
----- Original Message -----
From: "Matthias Bolte" <matthias.bolte@xxxxxxxxxxxxxx>
To: "antonela_other@xxxxxxxxx" <antonela@xxxxxxxxxxx>
Cc: libvirt-users@xxxxxxxxxx
Sent: Wednesday, February 10, 2010 4:59:18 AM GMT -05:00 US/Canada Eastern
Subject: Re: [libvirt-users] error: unable to connect to libvirtd at 'a.b.c.d': Connection refused
2010/2/9 antonela_other@xxxxxxxxx <antonela@xxxxxxxxxxx>:
> Greetings:
>
Hello.
>
> I have an issue with connecting to the esx hypervisor from my guest Vm. The
> purpose of the connection is to obtain host related information (like
> network, devices etc).
>
Unfortunately network and device enumeration is not implemented yet
for the ESX driver.
>
> I am not sure what is it that rejects the connect at the server side, and
> what i am missing.
>
> I am running lib0.7.5, i have libvirtd running on guest-vm.
ESX support was added in 0.7.0, so your libvirt version is new enough.
For ESX you don't need an libvirtd, neither on the client side nor on
the server side, see http://libvirt.org/drvesx.html#prereq
> The host ESX has the ip address a.b.c.d.
>
>
>
> Any thoughts?
>
Are you sure that your libvirt was build with ESX support enabled? If
you're using the Debian/Ubuntu packages that could be your problem,
because they are build without ESX support. So you'll either need to
file a bugreport with Debian/Ubuntu about the excluded ESX support, or
build libvirt from source. If you're already building from source make
sure to install the libcurl development package version 7.18.0 or
newer, otherwise configure will disable ESX support.
>
> Below the error with some debug output from libvirt.
>
>
>
> root > virsh -c esx://a.b.c.d/system
>
> ......................
>
> 17:06:16.065: debug : virConnectOpenAuth:1337 :
> name=esx://10.59.56.109/system, auth=0xb80ac638, flags=0
>
> 17:06:16.065: debug : do_open:1106 : name "esx://10.59.56.109/system" to URI
> components:
>
> scheme esx
>
> opaque (null)
>
> authority (null)
>
> server 10.59.56.109
>
> user (null)
>
> port 0
>
> path /system
>
>
>
> 17:06:16.065: debug : do_open:1116 : trying driver 0 (Test) ...
>
> 17:06:16.066: debug : do_open:1122 : driver 0 Test returned DECLINED
>
> 17:06:16.066: debug : do_open:1116 : trying driver 1 (Xen) ...
>
> 17:06:16.066: debug : do_open:1122 : driver 1 Xen returned DECLINED
>
> 17:06:16.066: debug : do_open:1116 : trying driver 2 (OPENVZ) ...
>
> 17:06:16.066: debug : do_open:1122 : driver 2 OPENVZ returned DECLINED
>
> 17:06:16.066: debug : do_open:1116 : trying driver 3 (VBOX) ...
>
> 17:06:16.066: debug : do_open:1122 : driver 3 VBOX returned DECLINED
Yep, your libvirt is build without ESX support. If it is enabled it
would be probed before the remote driver.
> 17:06:16.066: debug : do_open:1116 : trying driver 4 (remote) ...
>
> 17:06:16.067: debug : doRemoteOpen:564 : proceeding with name =
> esx:///system
>
> 17:06:16.069: debug : initialise_gnutls:1145 : loading CA file
> /etc/pki/CA/cacert.pem
>
> 17:06:16.070: debug : initialise_gnutls:1158 : loading client cert and key
> from files /etc/pki/libvirt/clientcert.pem and
> /etc/pki/libvirt/private/clientkey.pem
>
> 17:06:16.074: debug : do_open:1122 : driver 4 remote returned ERROR
>
> 17:06:16.074: debug : virUnrefConnect:259 : unref connection 0x903e078 1
>
> 17:06:16.074: debug : virReleaseConnect:216 : release connection 0x903e078
>
> error: unable to connect to libvirtd at a.b.c.d': Connection refused
The error message could be more explicit about the missing ESX
support, I'll try to improve this.
> error: failed to connect to the hypervisor
>
>
>
>
>
> I tried to use uri like: esx://a.b.c.d/, esx://a.b.c.d,
> esxi://a.b.c.d/system etc. They all give same issue.
>
See http://libvirt.org/drvesx.html#uri for the URI format understood
by the ESX driver, there is no distinction between /system and
/session as with some other drivers.
Matthias
