Spice Client not able to connect

R

RafLei

New Member
Jul 3, 2024
9
0
1
Hi Everyone,

I am using remote-viewer 11.00 running on a Raspberry PI, and running version 8.2.2 of PVE VE on a Desktop Server. I have enable Spice on one of my VM's, but i am having problem connecting. When I open the .vv file on my Raspberry PI Remote Viewer, I am getting the following error:

"Unable to connect to the graphic server file:///home/user/Desktop/pve-spice.vv"

I ran some logs on the PVE VE using "tail -/var/log/pveproxy/access.log" and I am seeing this error:

"::ffff:172.16.1.35 - - [03/07/2024:11:26:01 -0700] "CONNECT pvespiceproxy:6685891a:100:pve-mini::02d6ccbc2ffa1fbd80bdfacdae4c8bffe6fc0069:61000 HTTP/1.0" 401 -"

I seem that I am getting a (HTTP) 401 Unauthorized, I am not sure way. Any help would be great.

thanks,

Rafael
 
Thanks for the reply Moayad, I tried using the remote-viewer command, but I got the same error, and after 40secs the file disappears. Anything else I can try?

Thanks,

Rafael
 
Last edited:
Moayad said:
May you provide us with the output of the remote-viewer --debug pve-spice.vv
Click to expand...
Here is the output:

testuser@raspberrypi:~/Desktop $ remote-viewer --debug pve-spice.vv
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.497: keymap string is empty - nothing to do
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.696: Opening display to pve-spice.vv
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.697: Guest (null) has a spice display
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.744: After open connection callback fd=-1
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.744: Opening connection to display at pve-spice.vv
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.794: New spice channel 0x5591091f10 SpiceMainChannel 0
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.794: notebook show status 0x5590d56220
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.909: main channel: failed to connect HTTP proxy connection failed: 401
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.909: Destroy SPICE channel SpiceMainChannel 0
(remote-viewer:14639): virt-viewer-DEBUG: 05:59:16.909: zap main channel

I am still getting the HTTP 401 error.

The spice proxy is running from my PVE:

root@pve-mini:~# ss -an | grep LISTEN | grep 3128
tcp LISTEN 0 4096 *:3128

I don't see anything on the iptables that would cause this problem:

root@pve-mini:~# iptables-save
# Generated by iptables-save v1.8.9 on Wed Jul 10 06:03:41 2024
*raw
:PREROUTING ACCEPT [5494580:4425086517]
:OUTPUT ACCEPT [1464469:911383064]
COMMIT
# Completed on Wed Jul 10 06:03:41 2024
# Generated by iptables-save v1.8.9 on Wed Jul 10 06:03:41 2024
*filter
:INPUT ACCEPT [1841714:3439476307]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1464469:911383064]
COMMIT
# Completed on Wed Jul 10 06:03:41 2024

Here is the pve-spice.vv output:

[virt-viewer]
toggle-fullscreen=Shift+F11
release-cursor=Ctrl+Alt+R
proxy=http://pve-mini.test.com:3128
delete-this-file=1
tls-port=61001
secure-attention=Ctrl+Alt+Ins
host-subject=C=CA,ST=California,L=Salinas,O=test,OU=test,CN=pve-mini.test.com,emailAddress=admin@test.com
ca=-----BEGIN CERTIFICATE-----xxxxxxxxxxxxxxxxxxxxxxxxxxx\n-----END CERTIFICATE-----\n
type=spice
title=Shell on 'pve-mini'
password=693a625f83fd1bb90c67d09668f6190b501547e9
host=pvespiceproxy:668616dd:0:pve-mini::3ff537ec3fe802487ce459062f111422f4b79219

Thanks,

Rafael
 
+
Can the machine you've tried remote-viewer from, resolve the DNS pve-mini.test.com domain?

To narrow down could you please add the pve-mini.test.com and its IP in the /etc/hosts file?
 
Moayad said:
+
Can the machine you've tried remote-viewer from, resolve the DNS pve-mini.test.com domain?

To narrow down could you please add the pve-mini.test.com and its IP in the /etc/hosts file?
Click to expand...
Yes, I am able to resolve pve-mini.test.com fine. Adding the hostname and IP to the /etc/hosts still gives me the same error.
 
RafLei said:
still gives me the same error.
Click to expand...
Hmmm, could you use the IP instead of the Domain?

If you still got the same error, could you run tcpdump and check the 401 in details?

May you also scan the 3128 port using namp as the following command:

nmap -p 3128 pve-mini.test.com -Pn -T5
 
Last edited:
I tried the IP instead on the pve-spice.vv file, so I ran tcpdump as suggested. Here is the output:

testuser@raspberrypi:~ $ sudo tcpdump host 192.168.1.229 -A -vvv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:55:10.131259 IP (tos 0x0, ttl 64, id 35475, offset 0, flags [DF], proto TCP (6), length 60)
172.16.1.35.46560 > 192.168.1.229.3128: Flags [S], cksum 0x6fef (incorrect -> 0x2e62), seq 2845085161, win 32120, options [mss 1460,sackOK,TS val 2688520846 ecr 0,nop,wscale 7], length 0
E..<..@.@.@h...#.......8..........}xo..........
.?..........
11:55:10.131674 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.229.3128 > 172.16.1.35.46560: Flags [S.], cksum 0x19ad (correct), seq 3232215801, ack 2845085162, win 31856, options [mss 1380,sackOK,TS val 4037521842 ecr 2688520846,nop,wscale 7], length 0
E..<..@.@..........#.8............|p.......d...
.....?......
11:55:10.131724 IP (tos 0x0, ttl 64, id 35476, offset 0, flags [DF], proto TCP (6), length 52)
172.16.1.35.46560 > 192.168.1.229.3128: Flags [.], cksum 0x6fe7 (incorrect -> 0xc39e), seq 1, ack 1, win 251, options [nop,nop,TS val 2688520846 ecr 4037521842], length 0
E..4..@.@.@o...#.......8............o......
.?......
11:55:10.132037 IP (tos 0x0, ttl 64, id 35477, offset 0, flags [DF], proto TCP (6), length 296)
172.16.1.35.46560 > 192.168.1.229.3128: Flags [P.], cksum 0x70db (incorrect -> 0x1e26), seq 1:245, ack 1, win 251, options [nop,nop,TS val 2688520846 ecr 4037521842], length 244
E..(..@.@.?z...#.......8............p......
.?......CONNECT pvespiceproxy:668616dd:0:pve-mini::3ff537ec3fe802487ce459062f111422f4b79219:61001 HTTP/1.0
Host: pvespiceproxy:668616dd:0:pve-mini::3ff537ec3fe802487ce459062f111422f4b79219:61001
Proxy-Connection: keep-alive
User-Agent: GLib/2.74


11:55:10.132286 IP (tos 0x0, ttl 64, id 39729, offset 0, flags [DF], proto TCP (6), length 52)
192.168.1.229.3128 > 172.16.1.35.46560: Flags [.], cksum 0xc2ac (correct), seq 1, ack 245, win 249, options [nop,nop,TS val 4037521842 ecr 2688520846], length 0
E..4.1@.@./........#.8.....................
.....?..
11:55:10.133799 IP (tos 0x0, ttl 64, id 39730, offset 0, flags [DF], proto TCP (6), length 251)
192.168.1.229.3128 > 172.16.1.35.46560: Flags [P.], cksum 0xb688 (correct), seq 1:200, ack 245, win 249, options [nop,nop,TS val 4037521844 ecr 2688520846], length 199
E....2@.@./
.......#.8.....................
.....?..HTTP/1.0 401 invalid ticket
Cache-Control: max-age=0
Connection: close
Date: Wed, 10 Jul 2024 18:55:10 GMT
Pragma: no-cache
Server: pve-api-daemon/3.0
Expires: Wed, 10 Jul 2024 18:55:10 GMT


11:55:10.133799 IP (tos 0x0, ttl 64, id 39731, offset 0, flags [DF], proto TCP (6), length 52)
192.168.1.229.3128 > 172.16.1.35.46560: Flags [F.], cksum 0xc1e2 (correct), seq 200, ack 245, win 249, options [nop,nop,TS val 4037521844 ecr 2688520846], length 0
E..4.3@.@./........#.8.....................
.....?..
11:55:10.133853 IP (tos 0x0, ttl 64, id 35478, offset 0, flags [DF], proto TCP (6), length 52)
172.16.1.35.46560 > 192.168.1.229.3128: Flags [.], cksum 0x6fe7 (incorrect -> 0xc1e0), seq 245, ack 200, win 250, options [nop,nop,TS val 2688520848 ecr 4037521844], length 0
E..4..@.@.@m...#.......8............o......
.?......
11:55:10.175175 IP (tos 0x0, ttl 64, id 35479, offset 0, flags [DF], proto TCP (6), length 52)
172.16.1.35.46560 > 192.168.1.229.3128: Flags [.], cksum 0x6fe7 (incorrect -> 0xc1b5), seq 245, ack 201, win 250, options [nop,nop,TS val 2688520890 ecr 4037521844], length 0
E..4..@.@.@l...#.......8............o......
.?......
11:55:10.184158 IP (tos 0x0, ttl 64, id 35480, offset 0, flags [DF], proto TCP (6), length 52)
172.16.1.35.46560 > 192.168.1.229.3128: Flags [F.], cksum 0x6fe7 (incorrect -> 0xc1ac), seq 245, ack 201, win 250, options [nop,nop,TS val 2688520898 ecr 4037521844], length 0
E..4..@.@.@k...#.......8............o......
.?......
11:55:10.184491 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
192.168.1.229.3128 > 172.16.1.35.46560: Flags [.], cksum 0xc17b (correct), seq 201, ack 246, win 249, options [nop,nop,TS val 4037521894 ecr 2688520898], length 0
E..4..@.@..........#.8...............{.....
.....?..
 
Last edited:
Here is the nmap output:

testuser@raspberrypi:~ $ nmap -p 3128 pve-mini.test.com -Pn -T5
Starting Nmap 7.93 ( https://nmap.org ) at 2024-07-10 07:09 PDT
Nmap scan report for pve-mini.rloteck.com (192.168.1.229)
Host is up (0.00045s latency).

PORT STATE SERVICE
3128/tcp open squid-http

Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds
 
You must log in or register to reply here.

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Quick Navigation

Home Get Subscription Wiki Downloads Proxmox Customer Portal About

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!
Community platform by XenForo® © 2010-2024 XenForo Ltd.
Top Bottom