Managing KVM VMs with virt-manager on Windows

In this post, I will show you how to connect to your KVM via SSH in Windows using virt-manager (Virtual Machine Manager). For this, you also need Windows Subsystem for Linux (WSL), because the Windows version of virt-manager cannot establish an SSH connection. Sad but true. To tie everything together, you also need an X-server for Windows, and using SSH keys makes the whole process easier because you don’t have to enter your password every time.

Manage your KVM VMs from WSL with virt-manager over a secure SSH connection (qemu+ssh://)

Please note this is an older post of mine, transferred from itfaq.nl, translated to English and actualized.

The use of SSH keys is often mandatory to securely connect to external servers (services) under your management. But what if you need to manage a VM hosted on a KVM from Windows, and SSH key authentication is required? Libvirt does not offer QEMU with SSH connection type (qemu+ssh://) support in Windows with virt-manager. So you have to come up with something else.

KVM stands for Kernel-based Virtual Machine, so a “KVM virtual machine” is actually redundant.

KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware containing virtualization extensions (Intel VT or AMD-V). It consists of a loadable kernel module, kvm.ko, that provides the core virtualization infrastructure and a processor specific module, kvm-intel.ko or kvm-amd.ko.

Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.

KVM is open source software. The kernel component of KVM is included in mainline Linux, as of 2.6.20. The userspace component of KVM is included in mainline QEMU, as of 1.3.

https://www.linux-kvm.org/page/Main_Page

If you want to manage KVM from Windows 10 using Virtual Machine Manager (virt-manager), a Cygwin or Xming environment is of course an option. But hey, Windows nowadays also has built-in Linux support in the form of Windows Subsystem for Linux, or WSL. I wrote earlier about how to convert an Access database to MySQL in WSL (in Dutch on itfaq.nl). Handy, right?!

Required software

You need:

• OpenSSH Client (PowerShell: Add-WindowsCapability -Online -Name OpenSSH.Client*)
  • see Install OpenSSH in Windows Server how to install OpenSSH easily in Windows 11 / 10 and Windows Server.
  • and see YubiKey support in OpenSSH for Windows 11 for installing the Modern OpenSSH Client (.msi)
• ssh keys created with ssh-keygen.exe, choose the key type ed25519 and transfer you key to (the) external server(s). Windows OpenSSH doesn’t supply ssh-copy-id so you must copy the key manually.
  • Share OpenSSH keys met WSL in Windows
• Windows Subsystem for Linux, or WSL PowerShell: Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux) and I use Ubuntu:
  Invoke-WebRequest -Uri https://aka.ms/wsl-ubuntu-1804 -OutFile Ubuntu.appx -UseBasicParsing
Add-AppxPackage .\Ubuntu.appx
• VcXsrv Windows X Server
• virt-manager (in WSL) including all packages.

Install VcXsrv, and when you start it, you can simply leave the default settings selected.

VcXsrv is an open-source display server for Microsoft Windows. It enables a Windows user to run GUI programs developed for the Linux X Window system.

In Bash, you need to configure the local X server:

• execute the following command:

echo "export DISPLAY=localhost:0.0" >> ~/.bashrc

• to activate this, restart Bash or execute the following command:

. ~/.bashrc

You can now test a Linux graphics program in Windows, such as xeyes:

sudo apt-get install x11-apps && xeyes

Okay, we have now managed to get graphical Linux programs to run in Windows via an alternative X Server.

---

One-time donation

Your donation 💸 helps support me in the ongoing costs running a blog like this one. Costs like coffee ☕, web hosting services 🖥 , article research 🔎 , and so on. Thank you 🙏 for your support❤️ https://www.paypal.com/paypalme/jreilink.

---

WSL2 update for X server

Because WSL2 uses a different virtualization technology, you need to configure your WSL2 display slightly differently. This is because the WSL2 instance runs virtualized in a Hyper-V environment and therefore has its own IP address. You can use the IP address from /etc/resolv.conf:

grep nameserver /etc/resolv.conf | awk '{print $2}'

Suppose the result is 172.25.32.1, then you execute the following command in Bash:

echo "export DISPLAY=172.25.32.1:0.0" >> ~/.bashrc

And secondly, you need to start VcXsrv with Access Control disabled, so that external connections from clients are accepted:

Alternatively, use the -ac parameter for this. Also ensure that Windows Defender Firewall with Advanced Security allows the connection. You can create a rule to allow incoming traffic on port 6000, or you can disable the firewall for the virtual WSL adapter if necessary:

Set-NetFirewallProfile -DisabledInterfaceAliases "vEthernet (WSL)"

Sharing SSH keys between Windows and WSL

For convenience (well… until you make a chmod mistake), you can share your SSH keys between Windows and WSL. Use your Windows environment to create the SSH key(s), and you can then use them in WSL/Linux as well. To do this, you need to modify your DrvFs mount with metadata, or extra information, so that Linux permissions can be added to files as metadata.

This allows a file to have both Linux and Windows read/write/execute permission bits. Neat! 🙂 Create the file /etc/wsl.conf and place the following in it:

[automount]
  enabled = true
  root = /mnt/
  options = "metadata,umask=22,fmask=11"
  mountFsTab = false

You can find more information about this in the blog posts Unix permissions on WSL NTFS mount and Automatically Configuring WSL. After creating this file, you must log out of WSL (and possibly restart the LxssManager service). When you start WSL again, you can verify the mount point with mount -l. It looks something like this:

$ mount -l
rootfs on / type lxfs (rw,noatime)
none on /dev type tmpfs (rw,noatime,mode=755)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime,gid=5,mode=620)
none on /run type tmpfs (rw,nosuid,noexec,noatime,mode=755)
none on /run/lock type tmpfs (rw,nosuid,nodev,noexec,noatime)
none on /run/shm type tmpfs (rw,nosuid,nodev,noatime)
none on /run/user type tmpfs (rw,nosuid,nodev,noexec,noatime,mode=755)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime)
cgroup on /sys/fs/cgroup type tmpfs (rw,relatime,mode=755)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,relatime,devices)
C:\ on /mnt/c type drvfs (rw,noatime,uid=1000,gid=1000,umask=22,fmask=11,metadata,case=off)

However, you don’t have any SSH keys available in WSL yet. Fortunately, you can quickly resolve this with a symbolic link:

ln -s /mnt/c/Users/janreilink/.ssh/ ~/.ssh

It is of course important that ~/.ssh does not exist yet. If you then connect, you can ignore the error message setsockopt IPV6_TCLASS 16: Operation not permitted (source).

Great, ssh key authentication works now too. Since you have already installed virt-manager (Virtual Machine Manager) above, you can try that now as well.

Running Virt Manager in Windows 10 via WSL and a VcXserv X Server

If everything above went well, you can now start and run Virtual Machine Manager in Windows 10 via WSL and an open-source X Server VcXserv. It won’t be entirely perfect, but that doesn’t matter. The goal is for it to be workable.

You can now execute in Bash:

virt-manager -c 'qemu+ssh://kvm-test.example.com/system'

and after a short time, the Virtual Machine Manager window will open.

You can now perform your normal management tasks on KVM virtual machines from your Windows workstation.

With WSLg support in Windows 10, the above is a bit outdated. You no longer need VcXserv and can start virt-manager from a Windows Terminal (link 2). Nevertheless, I will leave the above untouched for educational purposes. Do you want to know how to use virt-manager, WSL 2, and qemu+ssh in Windows 11? Connect to a KVM host through an ssh tunnel and arbitrary port in Windows 11 and WSL 2.

Found this guide helpful? You can support my independent deep dives into Windows Server and DevOps by donating via PayPal. Every bit of support helps keep saotn.org fast and updated!