Logicalwebhost Cheatsheet

Linux & Open Source Cheatsheets & Howto's

Skip to: Content | Sidebar | Footer

kvm virtualization howto

KVM (not keyboard/video/mouse, used for viewing multiple screens and also called KVM) is a virtualization technology where you can run lots of different operating systems if you have the right cpu for it, like a Xeon or AMD one that supports virtualization. You have to have a remote client on your LAPTOP called virt-manager (I could only find a client for Linux/BSD, there may be some for Windows/Mac though?) to load the operating systems on your SERVER, which really sucks compared to xen, but xen is limited by the number/types of guest operating system

KVM install howto

This is on Debian, though others will apply will modification. Do this on your SERVER:

egrep '(vmx|svm)' --color=always /proc/cpuinfo

you should get a few lines of code output, this means your CPU will work with KVM, if you don’t stop, you can’t install it, you’ll have to use another Virtual Machine technology, like xen/virtualbox/VMWare, etc.

aptitude install qemu-kvm libvirt-bin virtinst
adduser whateveryournormalusernameis libvirt
vi /etc/libvirt/libvirtd.conf
  # unix_sock_rw_perms = "0770" <-- comment this line out and add one below:
  unix_sock_rw_perms = "0777"
sysctl vm.swappiness=0
echo "vm.swappiness=0" >> /etc/sysctl.conf
/etc/init.d/libvirt-bin restart (/etc/init.d/libvirtd in jessie)
vi /etc/network/interfaces (change it to look like this, but with your IP info)
  # The loopback network interface
  auto lo
  iface lo inet loopback
  #
  auto eth0
  iface eth0 inet manual
  #
  auto br0
  iface br0 inet static
        address 192.168.2.10
        netmask 255.255.255.0
        gateway 192.168.2.1
        bridge_ports eth0
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off
/etc/init.d/networking restart
see if you can still ping google.com
mkdir /root/.ssh
touch /root/.ssh/authorized_keys
vi /etc/ssh/sshd_config
  PermitRootLogin yes
  AllowUsers root@your.laptop.i.p anotheruser someotheruser (allow here everyone you want to be able to ssh in, you can not login with virt-manager on your laptop unless you login from this IP)
/etc/init.d/ssh reload
DO NOT LOGOUT OF YOUR SERVER UNTIL YOU MAKE SURE YOU CAN STILL LOGIN FROM YOUR LAPTOP

on your LAPTOP do:

sudo apt-get install virt-manager

now you have to set up an automatic connection to your KVM SERVER, so on your LAPTOP set it up with ssh/keys (as your REGULAR USER, not root) like:

ssh-keygen -t dsa -f ~/.ssh/id_dsa -C "yourusername@127.0.0.1"
  > hit enter 2x on passphrase
cat ~/.ssh/id_dsa.pub | ssh root@server.ip.or.hostname 'cat - >> ~/.ssh/authorized_keys'
ssh roote@server.ip.or.hostname (you should nott get a password prompt, it should just log you in)
ssh-add

now you have to set up a machine on your SERVER from your LAPTOP, but first you have to have an install .iso on the SERVER that you can do the install from, so download your .iso on the SERVER, and put it in /var/lib/libvirt/images, in this example we get a Debian .iso from a mirror by logging into your SERVER and doing:

cd /var/lib/libvirt/images
wget http://ftp.osuosl.org/pub/debian-cdimage/6.0.6/amd64/iso-cd/debian-6.0.6-amd64-CD-1.iso

Now, back on your LAPTOP, run virt-manager -> File -> Add connection:

Connect to remote host <--check checkbox
Method: ssh (should be by default)
Username: yourusernameonSERVER
Hostname: ip.or.hostname.ofSERVER

Now right-click on your new connection in the window, and do -> Connect. It shouldn’t prompt you for a password. Now click icon above connection to “create new virtual machine”, which it will do on the SERVER over your ssh connection now. Here’s an example machine I’m creating with the Debian .iso we just downloaded on the SERVER:

Name: whateveryouwanttocallyournewVM
Local install media checked <-- here it means local on your SERVER
Next button--->
Use ISO image <- click browse, select the image we just downloaded
OS type: whatever you are installing, same with Version
Forware --->
RAM/CPU for whatever you want
Forward --->
Change disk size to what you want
Forward --->
Advanced Options -> changet to "Specify shared device name"
Bridge name: br0
Architecture: select to match .iso
Finish --->
Allocates disk...

it should be done now, and you can click on the newly created machine and start it up and go through the install on the window on your LAPTOP.

KVM gotcha’s

if there is a not a /dev/kvm, it means your processor may have virtualization disabled in the bios. Look under advanced options for your processor, and enable virtualization. You will probably have to completely power off the server and then power it back on to enable it. after that, once it boots, run:

/etc/init.d/qemu-kvm restart (you should see something like:)
  Succesfully unloaded kvm module kvm_intel.
  Loading kvm module kvm_intel.

then double-check you have something listed in /dev/kvm

move a kvm guest to another server

You can shut down the vm, scp it to another server, then tell kvm on the new server about it, and you should be able to use it on your new server. This worked moving a guest from a Debian Squeeze server running qemu-kvm to another server running Debian Wheezy qemu-kvm on the same subnet so I didn’t have to change the guest IP configs. Here, the source server is server1 and destination server is server2. Make sure you shut down the guest on server1 before moving it, I’ll assume you’ve already done that.

server1#: su
cd /var/lib/libvirt/images/
scp guestmachinename.img ser.ver.2.ip:/var/lib/libvirt/images/
cd /etc/libvirt/qemu/
scp guestmachinename.xml ser.ver.2.ip:/etc/libvirt/qemu/
ssh user@ser.ver.2.ip
su
cd /etc/libvirt/qemu/
virsh define guestmachinename.xml
virsh
list --all (should now show guestmachinename)
start guestmachinename
list

you should now see your new machine in virt-manager on your laptop, or in virsh if you use that from the command line, and be able to login and use it on the new box.

machine won’t start after migrating

if you get an error like:

error: Failed to start domain videobox
error: internal error Process exited while reading console log output: Supported machines are:
pc         Standard PC (alias of pc-0.12)
pc-0.12    Standard PC (default)
pc-0.11    Standard PC, qemu 0.11
pc-0.10    Standard PC, qemu 0.10
isapc      ISA-only PC

it means you have to change the machine type in your migrated domain xml, so change it to something on the list in the error message like:

vi /etc/libvirt/qemu/yourdomain.xml
  <type arch='x86_64' machine='pc-0.12'>hvm</type>
virsh define yourdomain.xml
virsh start yourdomain

Resize KVM LVM partition

You can resize a normal partition using a recent version of the KVM/qemu tools, but resizing the LVM/VG/PV/partition inside that is a bit more tricky. You should back everything up before you start, or even better, just copy the image to a new one in case everything gets screwed up.

cd /var/lib/libvirt/images
virsh
> list --all

That should show all your machines, running or not, so shutdown the one you want by either logging in and shutting it down, or doing:

> shutdown whateverdomain
  domain is shutting down 
(wait a bit and then see if it really is by doing:)
> list --all
  whateverdomain     not running

now copy your image first to a backup like:

cp whateverdomain.img whateverdomain.img.bak

Now you can resize your image. In our example we resize a 20G (or whatever) to increase it to 30G (or whatever your current size + 10 GB like:

qemu-img resize vmdisk.img +10G
ls -lah *

you should see that your image “grew”, this takes a surprisingly short amount of time, like a few seconds on a powerful Xeon machine.

Now here comes the tricky part where you have to boot to a Gparted liveCD FROM INSIDE YOUR VM YOU JUST RESIZED. To do this, you have to use a virt-manager client on a Linux laptop somewhere and connect to your server running KVM for the next steps.

1. Login to virt-manager, connect to your KVM server host and then double-click on the icon for the virtual machine you’re resizing, BUT DON’T START IT ACCIDENTALLY, it has to be shut down still

2. Go to Show Details > Boot Options, check the box that says “IDE cdrom”, then use the arrow keys to move that entry to the top of the list there. Now go to the “IDE Cdrom” button and then browse and select the Gparted live .iso, which also has to be located in /var/lib/libvirt/images on your host KVM server to be visible to the browse function, so scp it to your server or use wget to download it directly to the server. Also chown libvirt-qemu.libvirt-qemu gparted-whatever.iso, so your virt-manager will see it. Sometimes you have to exit virt-manager and go back and redo the browse if it doesn’t pick it up.

3. Now when you start that machine up, you should see the boot screen for Gparted, not whatever OS is running normally on that machine. If you don’t stop and troubleshoot, you don’t want to screw up your original OS, so be sure of this.

4. On the boot screen just hit enter in most cases, that will take you to a GUI that has icons for running stuff. You actually need a terminal, but you just double-click on the terminal icon on the Gparted desktop.

5. Now you have to figure out which disk is which, otherwise if you select the wrong disk/volume you stand a fair chance of losing your data on that disk, which is never good. So take your time here and double-check you’re working on the right thing. You either have a MBR or a UEFI, and basically if you don’t know what the difference is, assume you have a normal MBR, which means you’d use fdisk (rather than gdisk/parted), and run:

blah

build VM from command line

you can use virt-install to build a new VM from the command line like:

virt-install \
        --name whatevername \
        --accelerate \
        --virt-type kvm \
        --vnc \
        --description "Some description you want" \
        --memory 1024 \
        --disk path=/var/lib/libvirt/images/whatever.img,bus=virtio,size=100 \
        --vcpus 2 \
        --os-type Linux \
        --os-variant debianwheezy \
        --cdrom /var/lib/libvirt/images/debian-8.5.0-amd64-DVD-1.iso \
        --network bridge=br0 \
        --console pty,target_type=serial
Starting install...
Allocating 'whatever.img'                                                                              | 100 GB     00:00     
Creating domain...                                                                                     |    0 B     00:00     
Unable to init server: Could not connect: Connection refused
Cannot open display: 
Run 'virt-viewer --help' to see a full list of available command line options
Domain installation still in progress. You can reconnect to 
the console to complete the installation process.

Now you login with your virt-manager on a remote laptop and finish the install.

KVM second interface eth1

You can add another network interface, typically eth1 to your KVM host, and then let guests use it too. First, set up the second bridge, “br1”, just add it below your other bridge at the end of the file like:

auto eth1
iface eth1 inet manual
#
auto br1
iface br1 inet static
        address sec.on.dary.ip
        netmask 255.255.255.0
        gateway sec.on.dary.gateway
        bridge_ports eth1
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

Now you can either manually reboot the server, restart networking (and hope it works, sometimes doesn’t on Debian), or just bring up your second interface like:

ifconfig br1 sec.on.dary.ip netmask 255.255.255.0 up

Now boot your guest VM, then once you do, make your GUEST VM /etc/network/interfaces (change to match your specific environment) look something like:

# The primary network interface
allow-hotplug eth1
iface eth1 inet static
        address pub.lic.static.ip
        netmask 255.255.255.0
        gateway pub.lic.static.gateway
        dns-nameservers 8.8.8.8
        post-up route del default gw whate.ver.private.ip eth0
        post-up route add default gw pub.lic.ip.gateway eth1
 
# The primary network interface
allow-hotplug eth0
iface eth0 inet static
        address whatever.private.i.p
        netmask 255.255.255.0
        gateway private.ip.gate.way

If you don’t do the post-up delete/add, it will try to route stuff out your private IP/subnet, instead of your public one.

References: http://wiki.debian.org/KVM

bridging for IDS/promiscuous monitoring

First, set up the second interface so it will bridge to eth1:

auto eth1
iface eth1 inet manual
#Alienvault OSIM Interface
auto br1
    iface br1 inet manual
    address 0.0.0.0
    bridge_ports eth1
    bridge_stp off

then

ifup eth1

then see if it’s capturing packets like:

tcpdump -i br1

you should get a ton of stuff like:

14:46:53.507328 IP 192.168.20.130.53866 > ipv4_1.cxl0.c154.sea001.ix.nflxvideo.net.https: Flags [.], ack 2897, win 5611, options [nop,nop,TS val 3160018074 ecr 2918482309,nop,nop,sack 1 {28961:46337}], length 0
 14:46:53.507402 IP ipv4_1.cxl0.c154.sea001.ix.nflxvideo.net.https > 192.168.20.130.53866: Flags [.], seq 56473:57921, ack 0, win 2050, options [nop,nop,TS val 2918482612 ecr 3160018052], length 1448

like pages and pages flowing past very quickly, this is good. Now add your bridge like:

brctl setageing br1 0
brctl setfd br1 0

Now fire up your VM and add a second NIC of > Specify shared device name > br1. You’ll probably have to reboot the VM, but then login to the VM and you should see a second NIC of eth1, which is bridged to your mirror interface and can start looking at packets. I still haven’t figured out how to get vswitch to copy mirror packets to multiple interfaces, in case you want to have multiple sensors look at the same data, so that’s my next issue. To make your brctl config persist a reboot, do:

cd /etc/network/if-up.d
touch br1-mirror
chmod +x br1-mirror
vi br1-mirror
  #!/bin/bash
  if [ "$IFACE" = br1 ]; then
  brctl setageing br1 0
  brctl setfd br3 0
fi

Mad props to the help here and also also this guy, very helpful all http://www.ryanhallman.com/kvm-configure-mirrored-ports-traffic-to-be-visible-in-guest-snort/ hope this all helps someone else, tough to figure out how to bolt all the pieces together.

Also, bridge tutorial:

http://www.dedoimedo.com/computers/kvm-bridged.html

Write a comment

You need to login to post comments!