☰

查看器与管理程序主机的连接被拒绝

tag-icon • tag-icon linux kvm
查看器与管理程序主机的连接被拒绝

我使用 virt-manager 中内置的 VNC-Viewer 来查看虚拟机桌面。但现在，当我单击虚拟机窗口中的“播放”按钮查看名为 的虚拟机的桌面时server1.example.com，我收到如下错误消息：

Error : Viewer Connection to hypervisor host got refused
or disconnected!

以下是我的配置/etc/libvirt/qemu/server1.example.com

<!--
WARNING: THIS IS AN AUTO-GENERATED FILE. CHANGES TO IT ARE LIKELY TO BE
OVERWRITTEN AND LOST. Changes to this xml configuration should be made      
using: virsh edit server1.example.com or other application using the 
libvirt API.
-->

<domain type='kvm'>
<name>server1.example.com</name>
<uuid>ca13796e-5917-bff4-b4ca-1203f660cbb2</uuid>
<memory unit='KiB'>1048576</memory>
<currentMemory unit='KiB'>1048576</currentMemory>
<vcpu placement='static'>1</vcpu>
<os>
<type arch='x86_64' machine='rhel6.4.0'>hvm</type>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<apic/>
<pae/>
</features>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>restart</on_crash>
<devices>
<emulator>/usr/libexec/qemu-kvm</emulator>
<disk type='file' device='disk'>
  <driver name='qemu' type='raw' cache='none'/>
  <source file='/var/lib/libvirt/images/server1.example.com.img'/>
  <target dev='hda' bus='ide'/>
  <address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>
<disk type='block' device='cdrom'>
  <driver name='qemu' type='raw'/>
  <target dev='hdc' bus='ide'/>
  <readonly/>
  <address type='drive' controller='0' bus='1' target='0' unit='0'/>
</disk>
<controller type='usb' index='0'>
</controller>
<controller type='ide' index='0'>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x01'     
function='0x1'/>
</controller>
<interface type='network'>
  <mac address='52:54:00:e1:ba:1e'/>
  <source network='default'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x03'    
  function='0x0'/>
</interface>
<serial type='pty'>
  <target port='0'/>
</serial>
<console type='pty'>
  <target type='serial' port='0'/>
</console>
<input type='mouse' bus='ps2'/>
<graphics type='vnc' port='5901' autoport='no' listen='127.0.0.1'>
  <listen type='address' address='127.0.0.1'/>
</graphics>

我对 iptables 规则有不好的感觉，所以我决定添加 /etc/sysconfig/iptables 文件。请看下文。

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
#-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 23 -j  ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5900 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5902 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5903 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 5904 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A OUTPUT -m state --state NEW -m tcp -p tcp --dport 5900 -j ACCEPT
-A OUTPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT
-A OUTPUT -m state --state NEW -m tcp -p tcp --dport 5902 -j ACCEPT
-A OUTPUT -m state --state NEW -m tcp -p tcp --dport 5903 -j ACCEPT
-A OUTPUT -m state --state NEW -m tcp -p tcp --dport 5904 -j ACCEPT
-A FORWARD -m state --state NEW -i wlan0 -o vibr0 -j ACCEPT
-A FORWARD -m state --state NEW -i vibr0 -o wlan0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

以下是我的系统上的虚拟化包：

libvirt.x86_64           0.10.2-18.el6                     @localrepo
libvirt-client.x86_64    0.10.2-18.el6                     @localrepo
libvirt-python.x86_64    0.10.2-18.el6                     @localrepo
python-virtinst.noarch   0.600.0-15.el6                    @localrepo
virt-manager.x86_64      0.9.0-18.el6                      @localrepo
virt-what.x86_64         1.11-1.2.el6                      @base/6

我尝试使用 Tiger-VNC 查看虚拟机桌面，并且成功了。
有人可以建议一种方法来解决这个问题吗？

编辑后添加的部分：令人惊讶的是 virt-viewer 命令工作正常，远程桌面查看器（vinagre）也可以完成这项工作。

[ssam@centos ~]$ virt-viewer --debug -c qemu:///system 2
** (virt-viewer:7930): DEBUG: Insert window 0 0x1a25890
** (virt-viewer:7930): DEBUG: fullscreen display 0: 0
** (virt-viewer:7930): DEBUG: fullscreen display 0: 0
** (virt-viewer:7930): DEBUG: Opening connection to libvirt with URI 
   qemu:///system
** (virt-viewer:7930): DEBUG: Add handle 7 1 0x1a8d5c0
** (virt-viewer:7930): DEBUG: notebook show status 0x1a24190
** (virt-viewer:7930): DEBUG: notebook show status 0x1a24190
** (virt-viewer:7930): DEBUG: Guest 2 is running, determining display
** (virt-viewer:7930): DEBUG: Set connect info: (null),(null),(null),-1,
   (null),(null),(null),0
** (virt-viewer:7930): DEBUG: Guest 2 has a vnc display
** (virt-viewer:7930): DEBUG: Guest graphics address is 127.0.0.1:5901
** (virt-viewer:7930): DEBUG: Set connect info: localhost,127.0.0.1,5901,-1,
   (null),(null),(null),0
** (virt-viewer:7930): DEBUG: Error operation virDomainOpenGraphics 
    forbidden for read only access
** (virt-viewer:7930): DEBUG: After open connection callback fd=-1
** (virt-viewer:7930): DEBUG: Opening direct TCP connection to display at 
   127.0.0.1:5901:-1
** (virt-viewer:7930): DEBUG: notebook show status 0x1a24190
** (virt-viewer:7930): DEBUG: Add timeout 0x1a9abf0 -1 0x3ee80aa2b0 
   0x1a8d900 1
** (virt-viewer:7930): DEBUG: notebook show status 0x1a24190
** (virt-viewer:7930): DEBUG: notebook show display 0x1a24190
** (virt-viewer:7930): DEBUG: Display size request 100x100 (desktop 100x100)
** (virt-viewer:7930): DEBUG: Allocated 400x375
** (virt-viewer:7930): DEBUG: Child allocate 375x375
** (virt-viewer:7930): DEBUG: desktop resize 1024x768
** (virt-viewer:7930): DEBUG: Preparing main window resize
** (virt-viewer:7930): DEBUG: Decided todo 1024x768 (desktop is 1024x768,
   fullscreen is 1280x800
** (virt-viewer:7930): DEBUG: Display size request 1024x768 (desktop 
   1024x768)
** (virt-viewer:7930): DEBUG: Allocated 1024x768
** (virt-viewer:7930): DEBUG: Child allocate 1024x768
** (virt-viewer:7930): DEBUG: Display size request 50x50 (desktop 1024x768)
** (virt-viewer:7930): DEBUG: Allocated 1024x768
** (virt-viewer:7930): DEBUG: Child allocate 1024x768
** (virt-viewer:7930): DEBUG: Dispatch handler 7 1 0x1a8d5c0
** (virt-viewer:7930): DEBUG: Dispatch handler 7 2 0x1a8d5c0
** (virt-viewer:7930): DEBUG: Dispatch handler 7 1 0x1a8d5c0

答案1

在我的 centos 机器中，恢复文件127.0.0.1中的条目可以解决此问题。我发现这个解决方案是在其他地方。我想与大家分享这一切。/etc/hostslocalhost

答案2

这不是解决方案，而是对问题的确认。在谷歌搜索这个特定问题时，我发现了以下参考文献：

我还建议在virt-manager 的项目页面。直接链接：

观看

报告

我在数据库中查找了您的错误消息，但没有看到任何内容。

答案3

在机器的域名和主机名后添加localhost您的文件。例如/etc/hosts

127.0.0.1 server1.example.com server1 localhost

为我工作！！！！我希望它对所有人都有效！

答案4

原因是，linux iptables 阻塞了输入连接。因此您无法连接 kvm 访客控制台。

因此，为了更好地理解这个问题，首先尝试刷新您的 iptables 规则，然后如果您的控制台已连接，则尝试相同的操作，问题出在防火墙上。

刷新 iptables：

iptables -F

查看规则：

iptables -L

要解决该问题，您需要禁用 iptables INPUT 规则拒绝。

相关内容