Additional service definition files SPICE

Laine Stump laine at redhat.com
Wed Oct 30 21:55:19 UTC 2013


On 10/30/2013 01:45 AM, John Call wrote:
> Given the popularity of virtualization these days, I'd like to see a
> SPICE service definition file come "out-of-the-box" with firewalld. 
> Is this something that could be approached at this level, or would
> should the request be directed to the libvirt/qemu team?  For example,
> I think the definition below should be shipped as predefined/standard
> service.
>
> <?xml version="1.0" encoding="utf-8"?>
> <service>
>   <short>Simple Protocol for Independent Computing Environments
> (SPICE)</short>
>   <description>SPICE is an adaptive remote rendering protocol for
> virtual environments.  The range of allowed ports will allow up to 256
> concurrent remote console sessions to running virtual
> machines.</description>
>   <port protocol="tcp" port="5900-6411"/>

Instead of opening up lots of ports for unencrypted sessions,
virtualization management libraries and applications tend to handle this
by 1) setting up the virtual guests' spice/vnc sessions to only allow
connection from localhost on the virtualization host, and 2) tuneling
remote SPICE sessions through an ssh session (for example, virt-viewer
and virt-manager, both using libvirt, do this).

In this way an arbitrary number of guests can be handled without needing
to open a huge range of ports on the host (all that is needed is port 22
for ssh), and as a bonus all the sessions are secured by ssh.



More information about the firewalld-users mailing list