Skip to content

Provide SSH proxy command integration for VMs

Description of problem

The OpenSSH client has a mechanism for offloading connection establishment to an external command, which lets apps invent new naming schemes.

Systemd has a proposal (https://github.com/systemd/systemd/pull/30777) for supporting this with vsock and machined which will work with VMs created by libvirt which would let users do ssh vsock/5353 where 5353 is the vsock CID configured in libvirt XML. They also intend to support machined names, so users could ssh machine/qemu-7-myvmanme.

This is great, but it the limitation that it will only work for VMs with vsock support, which depends on the as yet unreleased systemd version. An annoyance is that the systemd machined names that libvirt creates are not stable as they include the incrementing VM ID.

Libvirt's NSS plugin works for VMs that have an IP address accessible from the host, and works for any service, not just SSH. Installing the libvirt-nss RPM isn't hard but users still need to edit /etc/nsswitch.conf so this does not work out of the box.

Thus it would be good for libvirt to provide an SSH proxy such that users can use

ssh qemu/myvmame

Libvirt should register a proxy by installing /usr/libexec/ssh_config.d/20-libvirt-qemu-vm.conf which contanis

Host qemu/*
        ProxyCommand {{LIBEXECDIR}}/libvirt_ssh_proxy %h %p
        ProxyUseFdpass yes
        CheckHostIP no

This ssh proxy should attempt to open a vsock connection if the guest has a vsock device present. If no vsock is configured, or opening it fails, then lookup an IP address lease for the VM, and attempt to connect over IP instead.

This will make SSH work both for future and pre-existing distro guests, with a friendly name. If we put this in the libvirt-client RPM ssh will "just work" out of the box with zero config required.

Edited by Daniel P. Berrangé
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information