LC_PVE_TICKET not set, VNC proxy without password is forbidden

W

WinterGrasp

Member
Jan 13, 2022
3
0
6
47
Hello:

When running in the same node (IP 10.1.48.18)
Code: 
/usr/bin/ssh -e none -T -o BatchMode=yes 10.1.48.18 /usr/sbin/qm vncproxy 602
LC_PVE_TICKET not set, VNC proxy without password is forbidden

ssh_config is fine:
Code: 
...
    SendEnv LANG LC_*
...

sshd_config:
Code: 
...
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
...

This works on other nodes of the cluster, running Proxmox 6.4
Related post: https://forum.proxmox.com/threads/l...rror-failed-to-run-vncproxy.98192/post-440710

Versions:
Code: 
proxmox-ve: 7.1-1 (running kernel: 5.13.19-2-pve)
pve-manager: 7.1-8 (running version: 7.1-8/5b267f33)
pve-kernel-helper: 7.1-6
pve-kernel-5.13: 7.1-5
pve-kernel-5.4: 6.4-11
pve-kernel-5.3: 6.1-6
pve-kernel-5.0: 6.0-11
pve-kernel-5.13.19-2-pve: 5.13.19-4
pve-kernel-5.4.157-1-pve: 5.4.157-1
pve-kernel-5.4.143-1-pve: 5.4.143-1
pve-kernel-5.3.18-3-pve: 5.3.18-3
pve-kernel-5.0.21-5-pve: 5.0.21-10
pve-kernel-5.0.15-1-pve: 5.0.15-1
ceph-fuse: 14.2.21-1
corosync: 3.1.5-pve2
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown: residual config
ifupdown2: 3.1.0-1+pmx3
ksm-control-daemon: 1.4-1
libjs-extjs: 7.0.0-1
libknet1: 1.22-pve2
libproxmox-acme-perl: 1.4.0
libproxmox-backup-qemu0: 1.2.0-1
libpve-access-control: 7.1-5
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.0-14
libpve-guest-common-perl: 4.0-3
libpve-http-server-perl: 4.0-4
libpve-storage-perl: 7.0-15
libqb0: 1.0.5-1
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 4.0.11-1
lxcfs: 4.0.11-pve1
novnc-pve: 1.3.0-1
proxmox-backup-client: 2.1.2-1
proxmox-backup-file-restore: 2.1.2-1
proxmox-mini-journalreader: 1.3-1
proxmox-widget-toolkit: 3.4-4
pve-cluster: 7.1-3
pve-container: 4.1-3
pve-docs: 7.1-2
pve-edk2-firmware: 3.20210831-2
pve-firewall: 4.2-5
pve-firmware: 3.3-4
pve-ha-manager: 3.3-1
pve-i18n: 2.6-2
pve-qemu-kvm: 6.1.0-3
pve-xtermjs: 4.12.0-1
qemu-server: 7.1-4
smartmontools: 7.2-pve2
spiceterm: 3.2-2
swtpm: 0.7.0~rc1+2
vncterm: 1.7-1
zfsutils-linux: 2.1.1-pve3
 
Hi,
AFAIK, it's not possible anymore, because of changes in QEMU 6.0. See this commit for context. You always need use a password now, i.e. set the environment variable when starting the vncproxy.

EDIT: For setting up password-less access, see here.
 
Last edited:
Hello: I've detected this trying to access console of a VM in a 7.1 cluster member from the web interfase in a 6.4 member.
I'm asking this to preven any issue when we migrate the rest of the cluster's members.
 
I'm not able to reproduce the issue with the web interface here. Could you also share the pveversion -v of the node with 6.4 and the VM configuration qm config <ID>?

Could you try running
Code: 
LC_PVE_TICKET=foo ssh <IP of node with 7.1> 'perl -e "print \"\$ENV{LC_PVE_TICKET}\n\""'
on the node with 6.4 to see if the environment variable is passed along correctly?
 
Fabian_E said:
I'm not able to reproduce the issue with the web interface here. Could you also share the pveversion -v of the node with 6.4 and the VM configuration qm config <ID>?

Could you try running
Code: 
LC_PVE_TICKET=foo ssh <IP of node with 7.1> 'perl -e "print \"\$ENV{LC_PVE_TICKET}\n\""'
on the node with 6.4 to see if the environment variable is passed along correctly?
Click to expand...
Returns "foo"
 
What if you run
Code: 
LC_PVE_TICKET=foo /usr/bin/ssh -e none -T -o BatchMode=yes 10.1.48.18 /usr/sbin/qm vncproxy 602
on the 6.4 node (assuming that 10.1.48.18 is the 7.1 node)? That's essentially what the UI/API does too.
 
You must log in or register to reply here.
Top Bottom