-
kvm部署
kvm
1. 虚拟化介绍
虚拟化是云计算的基础。简单的说，虚拟化使得在一台物理的服务器上可以跑多台虚拟机，虚拟机共享物理机的 CPU、内存、IO 硬件资源，但逻辑上虚拟机之间是相互隔离的。
物理机我们一般称为宿主机（Host），宿主机上面的虚拟机称为客户机（Guest）。
那么 Host 是如何将自己的硬件资源虚拟化，并提供给 Guest 使用的呢？
这个主要是通过一个叫做 Hypervisor 的程序实现的。根据 Hypervisor 的实现方式和所处的位置，虚拟化又分为两种：
- 全虚拟化
- 半虚拟化
全虚拟化：
Hypervisor 直接安装在物理机上，多个虚拟机在 Hypervisor 上运行。Hypervisor 实现方式一般是一个特殊定制的 Linux 系统。Xen 和 VMWare 的 ESXi 都属于这个类型
半虚拟化：
物理机上首先安装常规的操作系统，比如 Redhat、Ubuntu 和 Windows。Hypervisor 作为 OS 上的一个程序模块运行，并对管理虚拟机进行管理。KVM、VirtualBox 和 VMWare Workstation 都属于这个类型
理论上讲：
全虚拟化一般对硬件虚拟化功能进行了特别优化，性能上比半虚拟化要高；
半虚拟化因为基于普通的操作系统，会比较灵活，比如支持虚拟机嵌套。嵌套意味着可以在KVM虚拟机中再运行KVM。2. kvm介绍
kVM 全称是 Kernel-Based Virtual Machine。也就是说 KVM 是基于 Linux 内核实现的。
KVM有一个内核模块叫 kvm.ko，只用于管理虚拟 CPU 和内存。那 IO 的虚拟化，比如存储和网络设备则是由 Linux 内核与Qemu来实现。
作为一个 Hypervisor，KVM 本身只关注虚拟机调度和内存管理这两个方面。IO 外设的任务交给 Linux 内核和 Qemu。
大家在网上看 KVM 相关文章的时候肯定经常会看到 Libvirt 这个东西。
Libvirt 就是 KVM 的管理工具。
其实，Libvirt 除了能管理 KVM 这种 Hypervisor，还能管理 Xen，VirtualBox 等。
Libvirt 包含 3 个东西：后台 daemon 程序 libvirtd、API 库和命令行工具 virsh
- libvirtd是服务程序，接收和处理 API 请求；
- API 库使得其他人可以开发基于 Libvirt 的高级工具，比如 virt-manager，这是个图形化的 KVM 管理工具；
- virsh 是我们经常要用的 KVM 命令行工具
虚拟化是云计算的基础。简单的说，虚拟化使得在一台物理的服务器上可以跑多台虚拟机，虚拟机共享物理机的 CPU、内存、IO 硬件资源，但逻辑上虚拟机之间是相互隔离的。
物理机我们一般称为宿主机（Host），宿主机上面的虚拟机称为客户机（Guest）。
那么 Host 是如何将自己的硬件资源虚拟化，并提供给 Guest 使用的呢？
这个主要是通过一个叫做 Hypervisor 的程序实现的。虚拟化分类：
全虚拟化 裸金属上部署（没有操作系统的主机）
特点：性能强，不能嵌套
半虚拟化 OS(操作系统)上部署
特点：和全虚相比性能略差，可以嵌套
虚拟化的实现方式：服务器中使用的：
1、kvm
2、esxi
3、xen
4、Citrix 面向银行
5、hyper-v个人用户：
1、VMware workstations
2、virualbox二、KVM部署3.kvm安装 web管理界面安装
kvm 的 web 管理界面是由 webvirtmgr 程序提供的。
环境说明：
系统类型 IP 安装 centos7/redhat7 192.168.200.10 kvm centos7/redhat7 192.168.200.13 kvm的web界面 kvm安装
关闭防火墙和selinux
[root@kvm ~]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled) Active: inactive (dead) Docs: man:firewalld(1) [root@kvm ~]# getenforce Disabled [root@kvm_web ~]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled) Active: inactive (dead) Docs: man:firewalld(1) [root@kvm_web ~]# getenforce Disabled //验证CPU是否支持KVM；如果结果中有vmx（Intel）或svm(AMD)字样，就说明CPU的支持的 [root@kvm ~]# egrep -o 'vmx|svm' /proc/cpuinfo svm svm svm svm- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
//kvm安装 [root@kvm ~]# yum -y install qemu-kvm qemu-kvm-tools qemu-img virt-manager libvirt libvirt-python libvirt-client virt-install virt-viewer bridge-utils libguestfs-tools //设置网卡 因为虚拟机中网络，我们一般都是和公司的其他服务器是同一个网段，所以我们需要把 KVM服务器的网卡配置成桥接模式。这样的话KVM的虚拟机就可以通过该桥接网卡和公司内部 其他服务器处于同一网段。 [root@kvm ~]# cd /etc/sysconfig/network-scripts/ [root@kvm network-scripts]# cp ifcfg-ens33 ifcfg-br0 [root@kvm network-scripts]# vi ifcfg-br0 [root@kvm network-scripts]# cat ifcfg-br0 TYPE=Bridge BOOTPROTO=static NAME=br0 DEVICE=br0 ONBOOT=yes NM_CONTROLLED=no IPADDR=192.168.200.10 NETMASK=255.255.255.0 GATEWAY=192.168.200.2 DNS1=114.114.114.114 [root@kvm network-scripts]# vi ifcfg-ens33 TYPE=Ethernet BOOTPROTO=static NAME=ens33 DEVICE=ens33 ONBOOT=yes BRIDGE=br0 NM_CONTROLLED=no [root@kvm network-scripts]# systemctl restart network [root@kvm network-scripts]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000 link/ether 00:0c:29:ed:7a:ea brd ff:ff:ff:ff:ff:ff inet6 fe80::20c:29ff:feed:7aea/64 scope link valid_lft forever preferred_lft forever 3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:0c:29:ed:7a:ea brd ff:ff:ff:ff:ff:ff inet 192.168.200.10/24 brd 192.168.200.255 scope global br0 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:feed:7aea/64 scope link valid_lft forever preferred_lft forever- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
//启动服务 启动守护进程 [root@kvm network-scripts]# systemctl enable --now libvirtd [root@kvm network-scripts]# systemctl status libvirtd ● libvirtd.service - Virtualization daemon Loaded: loaded (/usr/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2022-08-20 05:10:37 EDT; 13s ago Docs: man:libvirtd(8) https://libvirt.org Main PID: 3175 (libvirtd) Tasks: 19 (limit: 32768) CGroup: /system.slice/libvirtd.service ├─3175 /usr/sbin/libvirtd ├─3285 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr... └─3286 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-sc //验证安装结果 [root@kvm network-scripts]# lsmod|grep kvm //这里有显示kvm就表示安装成功了 kvm_amd 2177304 0 kvm 637515 1 kvm_amd irqbypass 13503 1 kvm [root@kvm network-scripts]# virsh -c qemu:///system list //列出现有kvm系统 Id Name State ---------------------------------------------------- [root@kvm network-scripts]# virsh --version 4.5.0 [root@kvm network-scripts]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm //创建一个软连接，让系统能找到这个命令 [root@kvm network-scripts]# ll /usr/bin/qemu-kvm lrwxrwxrwx 1 root root 21 Aug 20 05:11 /usr/bin/qemu-kvm -> /usr/libexec/qemu-kvm [root@kvm network-scripts]# which qemu-kvm /usr/bin/qemu-kvm [root@kvm network-scripts]# brctl show //查看网桥信息 bridge name bridge id STP enabled interfaces br0 8000.000c29ed7aea no ens33 virbr0 8000.52540021f25f yes virbr0-nic- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
kvm web界面安装
//安装依赖包 [root@kvm_web yum.repos.d]# yum -y install git python-pip libvirt-python libxml2-python python-websockify supervisor nginx python-devel //从github上下载webvirtmgr代码 [root@kvm_web yum.repos.d]# cd /usr/local/src/ [root@kvm_web src]# ls [root@kvm_web src]# git clone git://github.com/retspen/webvirtmgr.git Cloning into 'webvirtmgr'... remote: Enumerating objects: 5730, done. remote: Total 5730 (delta 0), reused 0 (delta 0), pack-reused 5730 Receiving objects: 100% (5730/5730), 3.01 MiB | 39.00 KiB/s, done. Resolving deltas: 100% (3688/3688), done. [root@kvm_web src]# ls webvirtmgr //安装webvirtmgr [root@kvm_web src]# cd webvirtmgr/ [root@kvm_web webvirtmgr]# pip install -i https://pypi.douban.com/simple -r requirements.txt Collecting django==1.5.5 (from -r requirements.txt (line 1)) Downloading https://pypi.doubanio.com/packages/38/49/93511c5d3367b6b21fc2995a0e53399721afc15e4cd6eb57be879ae13ad4/Django-1.5.5.tar.gz (8.1MB) 100% |████████████████████████████████| 8.1MB 130kB/s Collecting gunicorn==19.5.0 (from -r requirements.txt (line 2)) Downloading https://pypi.doubanio.com/packages/f9/4e/f4076a1a57fc1e75edc0828db365cfa9005f9f6b4a51b489ae39a91eb4be/gunicorn-19.5.0-py2.py3-none-any.whl (113kB) 100% |████████████████████████████████| 122kB 3.9MB/s Collecting lockfile>=0.9 (from -r requirements.txt (line 5)) Downloading https://pypi.doubanio.com/packages/c8/22/9460e311f340cb62d26a38c419b1381b8593b0bb6b5d1f056938b086d362/lockfile-0.12.2-py2.py3-none-any.whl Installing collected packages: django, gunicorn, lockfile Running setup.py install for django ... done Successfully installed django-1.5.5 gunicorn-19.5.0 lockfile-0.12.2 //检查sqlite3是否安装 [root@kvm_web webvirtmgr]# python Python 2.7.5 (default, Jun 28 2022, 15:30:04) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import sqlite3 //导入模块，如果没有输入信息表示没有问题，如果有输出内容表示有问题。 >>> exit() //退出 或者ctrl+D //初始化帐号信息 [root@kvm_web webvirtmgr]# python manage.py syncdb WARNING:root:No local_settings file found. Creating tables ... Creating table auth_permission Creating table auth_group_permissions Creating table auth_group Creating table auth_user_groups Creating table auth_user_user_permissions Creating table auth_user Creating table django_content_type Creating table django_session Creating table django_site Creating table servers_compute Creating table instance_instance Creating table create_flavor You just installed Django's auth system, which means you don't have any superusers defined. Would you like to create one now? (yes/no): yes Username (leave blank to use 'root'): //指定超级管理员帐号用户名，默认留空为root Email address: 1@11.com //设置超级管理员邮箱 Password: //设置超级管理员密码 Password (again): //再次输入超级管理员密码 Superuser created successfully. Installing custom SQL ... Installing indexes ... Installed 6 object(s) from 1 fixture(s) //拷贝web界面到指定目录 [root@kvm_web webvirtmgr]# mkdir /var/www [root@kvm_web webvirtmgr]# cp -r /usr/local/src/webvirtmgr /var/www/ [root@kvm_web webvirtmgr]# chown -R nginx.nginx /var/www/webvirtmgr/ [root@kvm_web webvirtmgr]# cd /var/www/ [root@kvm_web www]# ll total 4 drwxr-xr-x 19 nginx nginx 4096 Aug 21 01:25 webvirtmgr //生成秘钥 [root@kvm_web www]# ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: SHA256:LM+k0C2YCDxcBVeZJZ88IDPZzQaWnq4PCWiXvCJcklI root@kvm_web The key's randomart image is: +---[RSA 2048]----+ | oo*+*O. | |o . ..===+. | |.+E . o= | | o=..+ = . | |.=.*+ = S | |+ + o..O | |.o . oo o | |. . .. | | .. | +----[SHA256]-----+ [root@kvm_web www]# ssh-copy-id 192.168.200.10 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub" The authenticity of host '192.168.200.10 (192.168.200.10)' can't be established. ECDSA key fingerprint is SHA256:/RdPc5FYoRB6bruCpNI3c6uotUWc/8fN4JbUIYSVwic. ECDSA key fingerprint is MD5:ef:f1:72:7f:85:00:fd:48:14:01:c6:16:03:e5:dd:8d. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@192.168.200.10's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh '192.168.200.10'" and check to make sure that only the key(s) you wanted were added. //配置端口转发 [root@kvm_web www]# ssh 192.168.200.10 -L localhost:8000:localhost:8000 -L localhost:6080:localhost:60 Last login: Sat Aug 20 05:00:38 2022 from 192.168.200.1 这里可能会连到对面虚拟机 要退出一下exit [root@kvm_web ~]# ss -antl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:8000 *:* LISTEN 0 100 *:6080 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LISTEN 0 128 [::]:22 [::]:* LISTEN 0 100 [::1]:25 [::]:*- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
- 100
- 101
- 102
- 103
- 104
- 105
- 106
- 107
- 108
- 109
- 110
- 111
- 112
- 113
- 114
- 115
- 116
- 117
- 118
- 119
- 120
- 121
- 122
- 123
- 124
- 125
- 126
- 127
//配置nginx 先备份然后清空文件内容，然后再重新编辑配置文件 [root@kvm_web ~]# cp nginx.conf{,-bak} [root@kvm_web ~]# > nginx.conf [root@kvm_web ~]# vi /etc/nginx/nginx.conf user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; include /usr/share/nginx/modules/*.conf; events { worker_connections 1024; } http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; include /etc/nginx/mime.types; default_type application/octet-stream; include /etc/nginx/conf.d/*.conf; server { listen 80; server_name localhost; include /etc/nginx/default.d/*.conf; location / { root html; index index.html index.htm; } error_page 404 /404.html; location = /40x.html { } error_page 500 502 503 504 /50x.html; location = /50x.html { } } } //编辑nginx的子文件 [root@kvm_web ~]# cat /etc/nginx/conf.d/webvirtmgr.conf server { listen 80 default_server; server_name $hostname; #access_log /var/log/nginx/webvirtmgr_access_log; location /static/ { root /var/www/webvirtmgr/webvirtmgr; expires max; } location / { proxy_pass http://127.0.0.1:8000; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for; proxy_set_header Host $host:$server_port; proxy_set_header X-Forwarded-Proto $remote_addr; proxy_connect_timeout 600; proxy_read_timeout 600; proxy_send_timeout 600; client_max_body_size 1024M; } } //编辑配置文件，确保bind绑定的是本机的8000端口 [root@kvm_web ~]# cat /var/www/webvirtmgr/conf/gunicorn.conf.py bind = '0.0.0.0:8000' //把原来的127本地地址改成默认地址，监听本机的所有IP的8000端口 backlog = 2048 //重启nginx，如果重启失败报端口被占用就用fuser -k 80/tcp 命令关闭80端口即可，然后再重启 [root@kvm_web ~]# systemctl restart nginx.service [root@kvm_web ~]# ss -antl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:8000 *:* LISTEN 0 100 *:6080 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LISTEN 0 128 [::]:22 [::]:* LISTEN 0 100 [::1]:25 [::]:* //设置supervisor,在文件的末尾添加一下内容 [root@kvm_web ~]# cat /etc/supervisord.conf [program:webvirtmgr] command=/usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py directory=/var/www/webvirtmgr autostart=true autorestart=true logfile=/var/log/supervisor/webvirtmgr.log log_stderr=true user=nginx [program:webvirtmgr-console] command=/usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console directory=/var/www/webvirtmgr autostart=true autorestart=true stdout_logfile=/var/log/supervisor/webvirtmgr-console.log redirect_stderr=true user=nginx [root@kvm_web ~]# systemctl enable --now supervisord [root@kvm_web ~]# systemctl status supervisord ● supervisord.service - Process Monitoring and Control Daemon Loaded: loaded (/usr/lib/systemd/system/supervisord.service; enabled; vendor preset: disabled) Active: active (running) since Sun 2022-08-21 01:32:19 CST; 35min ago Process: 18987 ExecStart=/usr/bin/supervisord -c /etc/supervisord.conf (code=exited, status=0/SUCCESS) Main PID: 18990 (supervisord) CGroup: /system.slice/supervisord.service ├─18990 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf ├─18991 /usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console ├─18992 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.con... ├─18998 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.con... ├─18999 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.con... ├─19000 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.con... ├─19001 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.con... ├─19002 /usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.con... ├─20885 ssh -l root -- 192.168.200.10 sh -c 'if 'nc' -q 2>&1 | grep "requires an argument" >/dev/null 2>&1; ... └─20913 ssh -l root -- 192.168.200.10 sh -c 'if 'nc' -q 2>&1 | grep "requires an argument" >/dev/null 2>&1; ... Aug 21 01:32:19 kvm_web systemd[1]: Starting Process Monitoring and Control Daemon... Aug 21 01:32:19 kvm_web systemd[1]: Started Process Monitoring and Control Daemon.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
- 100
- 101
- 102
- 103
- 104
- 105
- 106
- 107
- 108
- 109
- 110
- 111
- 112
- 113
- 114
- 115
- 116
- 117
- 118
- 119
- 120
- 121
- 122
- 123
- 124
- 125
- 126
- 127
- 128
- 129
- 130
- 131
- 132
- 133
- 134
- 135
- 136
- 137
- 138
//配置nginx用户，生成秘钥 [root@kvm_web ~]# su - nginx -s /bin/bash //零时给Nginx用户一个bin/bash 因为是系统用户所有直接登陆时登陆不成功的 -bash-4.2$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/var/lib/nginx/.ssh/id_rsa): Created directory '/var/lib/nginx/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /var/lib/nginx/.ssh/id_rsa. Your public key has been saved in /var/lib/nginx/.ssh/id_rsa.pub. The key fingerprint is: SHA256:UKTuvbpXYFyez0JPrfFEvMc/Nw2Vu58YnynnG1p6e48 nginx@kvm The key's randomart image is: +---[RSA 2048]----+ | .o . .| | o . o..| | o. o . o +.| | . .+ + o =.o| | ..So = = o+| | . . o =..++| | . .. . +oO| | .. o+O+| | o+. oE+*| +----[SHA256]-----+ ———————————————— -bash-4.2$ touch ~/.ssh/config && echo -e "StrictHostKeyChecking=no\nUserKnownHostsFile=/dev/null" >> ~/.ssh/config //添加一个配置文件 -bash-4.2$ cat ~/.ssh/config StrictHostKeyChecking=no //主机key检查关闭，就是远程登陆的时候没有让输入yes/no那一步 UserKnownHostsFile=/dev/null //不要.ssh/known_hosts文件，不输入yes和no就没有主机信息，所有把这个文件放到空洞中 -bash-4.2$ chmod 0600 ~/.ssh/config //改权限 -bash-4.2$ ssh-copy-id root@192.168.200.10 //把公钥给root用户，让Nginx登陆root时免密登陆 kvm主机ip /bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub" /bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys Warning: Permanently added '192.168.200.10' (ECDSA) to the list of known hosts. root@192.168.200.10's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'root@192.168.200.10'" and check to make sure that only the key(s) you wanted were added. -bash-4.2$ exit logout //生成一个配置文件 [root@kvm_web ~]# vi /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla [Remote libvirt SSH access] Identity=unix-user:root Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes //设置刚创建文件权限并重启服务 [root@kvm_web ~]# chown -R root.root /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla [root@kvm_web ~]# systemctl restart nginx [root@kvm ~]# systemctl restart libvirtd- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
[root@kvm images]# ls CentOS-Stream-8-x86_64-20201211-dvd1.iso [root@kvm images]# pwd /var/lib/libvirt/images- 1
- 2
- 3
- 4
4.故障案例
4.1 案例1
web界面配置完成后可能会出现以下错误界面
解决方法是安装novnc并通过novnc_server启动一个vnc
[root@localhost ~]# ll /etc/rc.local lrwxrwxrwx. 1 root root 13 Aug 6 2018 /etc/rc.local -> rc.d/rc.local [root@localhost ~]# ll /etc/rc.d/rc.local -rw-r--r-- 1 root root 513 Mar 11 22:35 /etc/rc.d/rc.local [root@localhost ~]# chmod +x /etc/rc.d/rc.local [root@localhost ~]# ll /etc/rc.d/rc.local -rwxr-xr-x 1 root root 513 Mar 11 22:35 /etc/rc.d/rc.local [root@localhost ~]# vim /etc/rc.d/rc.local ......此处省略N行 # that this script will be executed during boot. touch /var/lock/subsys/local nohup novnc_server 192.168.200.13:5920 & [root@localhost ~]# . /etc/rc.d/rc.local- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
做完以上操作后再次访问即可正常访问
4.2 案例2
第一次通过web访问kvm时可能会一直访问不了，一直转圈，而命令行界面一直报错(too many open files)此时需要对nginx进行配置
[root@localhost ~]# vim /etc/nginx/nginx.conf ....此处省略N行 user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; worker_rlimit_nofile 655350; //添加此行配置 # Load dynamic modules. See /usr/share/nginx/README.dynamic. ....此处省略N行 [root@localhost ~]# systemctl restart nginx 然后对系统参数进行设置- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
[root@localhost ~]# vim /etc/security/limits.conf ....此处省略N行 # End of file * soft nofile 655350 * hard nofile 655350- 1
- 2
- 3
- 4
- 5
到此问题即可解决
-
相关阅读:
Csharp中表达式树
09-进程和计划任务管理
is-is表与消息及认证 详解
景联文科技低价策略帮助AI企业降低模型训练成本
【我不熟悉的css】10- 一行字号不同的文字底部对齐，vertical-align的使用，字体行高line-height使用的注意事项
【微信小程序】快速入门学习笔记
Linux编辑器-vim使用
设计模式--工厂设计模式
7、DVWA——SQL盲注
salesforce的按钮执行js代码如何链接到apex代码
- 原文地址：https://blog.csdn.net/whl0102222/article/details/126442830
