LC_PVE_TICKET not set, VNC proxy without password is forbidden

[WinterGrasp]

Hello:

When running in the same node (IP 10.1.48.18)

/usr/bin/ssh -e none -T -o BatchMode=yes 10.1.48.18 /usr/sbin/qm vncproxy 602
LC_PVE_TICKET not set, VNC proxy without password is forbidden

ssh_config is fine:

...
    SendEnv LANG LC_*
...

sshd_config:

...
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
...

This works on other nodes of the cluster, running Proxmox 6.4
Related post: https://forum.proxmox.com/threads/l...rror-failed-to-run-vncproxy.98192/post-440710

Versions:

proxmox-ve: 7.1-1 (running kernel: 5.13.19-2-pve)
pve-manager: 7.1-8 (running version: 7.1-8/5b267f33)
pve-kernel-helper: 7.1-6
pve-kernel-5.13: 7.1-5
pve-kernel-5.4: 6.4-11
pve-kernel-5.3: 6.1-6
pve-kernel-5.0: 6.0-11
pve-kernel-5.13.19-2-pve: 5.13.19-4
pve-kernel-5.4.157-1-pve: 5.4.157-1
pve-kernel-5.4.143-1-pve: 5.4.143-1
pve-kernel-5.3.18-3-pve: 5.3.18-3
pve-kernel-5.0.21-5-pve: 5.0.21-10
pve-kernel-5.0.15-1-pve: 5.0.15-1
ceph-fuse: 14.2.21-1
corosync: 3.1.5-pve2
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown: residual config
ifupdown2: 3.1.0-1+pmx3
ksm-control-daemon: 1.4-1
libjs-extjs: 7.0.0-1
libknet1: 1.22-pve2
libproxmox-acme-perl: 1.4.0
libproxmox-backup-qemu0: 1.2.0-1
libpve-access-control: 7.1-5
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.0-14
libpve-guest-common-perl: 4.0-3
libpve-http-server-perl: 4.0-4
libpve-storage-perl: 7.0-15
libqb0: 1.0.5-1
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 4.0.11-1
lxcfs: 4.0.11-pve1
novnc-pve: 1.3.0-1
proxmox-backup-client: 2.1.2-1
proxmox-backup-file-restore: 2.1.2-1
proxmox-mini-journalreader: 1.3-1
proxmox-widget-toolkit: 3.4-4
pve-cluster: 7.1-3
pve-container: 4.1-3
pve-docs: 7.1-2
pve-edk2-firmware: 3.20210831-2
pve-firewall: 4.2-5
pve-firmware: 3.3-4
pve-ha-manager: 3.3-1
pve-i18n: 2.6-2
pve-qemu-kvm: 6.1.0-3
pve-xtermjs: 4.12.0-1
qemu-server: 7.1-4
smartmontools: 7.2-pve2
spiceterm: 3.2-2
swtpm: 0.7.0~rc1+2
vncterm: 1.7-1
zfsutils-linux: 2.1.1-pve3

 

[fiona]

Hi,
AFAIK, it's not possible anymore, because of changes in QEMU 6.0. See this commit for context. You always need use a password now, i.e. set the environment variable when starting the vncproxy.

EDIT: For setting up password-less access, see here.

 

[WinterGrasp]

Hello: I've detected this trying to access console of a VM in a 7.1 cluster member from the web interfase in a 6.4 member.
I'm asking this to preven any issue when we migrate the rest of the cluster's members.

 

[fiona]

I'm not able to reproduce the issue with the web interface here. Could you also share the pveversion -v of the node with 6.4 and the VM configuration qm config <ID>?

Could you try running

LC_PVE_TICKET=foo ssh <IP of node with 7.1> 'perl -e "print \"\$ENV{LC_PVE_TICKET}\n\""'

on the node with 6.4 to see if the environment variable is passed along correctly?

 

[WinterGrasp]

I'm not able to reproduce the issue with the web interface here. Could you also share the pveversion -v of the node with 6.4 and the VM configuration qm config <ID>?

Could you try running

LC_PVE_TICKET=foo ssh <IP of node with 7.1> 'perl -e "print \"\$ENV{LC_PVE_TICKET}\n\""'

on the node with 6.4 to see if the environment variable is passed along correctly?

Returns "foo"

 

[fiona]

What if you run

LC_PVE_TICKET=foo /usr/bin/ssh -e none -T -o BatchMode=yes 10.1.48.18 /usr/sbin/qm vncproxy 602

on the 6.4 node (assuming that 10.1.48.18 is the 7.1 node)? That's essentially what the UI/API does too.