云安全：KVM虚拟机基本概念及相关实践

一、KVM介绍

官网介绍http://www.linux-kvm.org/page/Main_Page

KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware containing virtualization extensions (Intel VT or AMD-V). It consists of a loadable kernel module, kvm.ko, that provides the core virtualization infrastructure and a processor specific module, kvm-intel.ko or kvm-amd.ko.

Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.

KVM is open source software. The kernel component of KVM is included in mainline Linux, as of 2.6.20. The userspace component of KVM is included in mainline QEMU, as of 1.3.

翻译

KVM（基于内核的虚拟机）是Linux对包含虚拟化扩展（Intel VT or AMD-V）的x86硬件的一种全虚拟化解决方案。KVM包含，一个可加载的内核模块kvm.ko——提供核心虚拟化基础，一个处理器特化模块kvm-intel.ko或kvm-amd.ko

通过使用KVM，我们可以运行多个加载Linux或Windows的虚拟机。每个虚拟机都有属于自己的虚拟设备：网卡，硬盘，显卡等

KVM是一个开源软件。从2.6.20开始，KVM的核心组件包含在主线Linux中。从1.3版开始，KVM的用户空间组件包含在主线QEMU中。

二、搭建KVM虚拟机

描述：在虚拟机上搭建KVM虚拟机

物理机：win10

宿主机（VMware虚拟机）：CentOS7

KVM虚拟机：CentOS7

环境准备：

1，安装VMware虚拟机

2，编辑虚拟机配置，开启虚拟化功能

 3、进入VMware虚拟机

#安装必要软件
$yum install qemu-kvm qemv-kvm-tools libvirt

#启动libvirt
$systemctl start libvirtd

#设置开机自启
$systemctl enable libvirtd

#创建KVM虚拟机安装磁盘，格式为 raw
$qemu-img create -f raw /opt/CentOS.raw 10G

#安装virt-install
$yum install -y virt-install

安装KVM虚拟机

$virt-install --virt-type kvm --name CentOS7 --ram 2048 --cdro=/mnt/hgfs/CentOS-7-x86_64-Minimal-1908.iso --disk path=/opt/CentOS.raw --network network=default --graphics vnc,listen=0.0.0.0 --noautoconsole

问题1：

could not open disk image /home/user/os.ios: Could not open '/home/user/os.ios': Permission denied

解决：

将raw文件和ios文件放到同一个目录下

问题2：

vnc-viewer无法连接虚拟机，无法控制安装过程

猜测是vmware客户机未安装vnc-server，改用命令行安装。

 

命令行安装KVM虚拟机

$virt-install --virt-type=kvm --name=centos8 --vcpus=2 --memory=1024 --location=/opt/CentOS-7-x86_64-Minimal-1908.iso --disk path=/opt/CentOS.raw --network network=default --graphics none --extra-args='console=ttyS0' --force

开始安装 

选择数字进行设定，最后登陆

登陆KVM虚拟机后

问题3：

网络不通

[user@localhost ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default q000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP groupult qlen 1000
    link/ether 52:54:00:12:65:5a brd ff:ff:ff:ff:ff:ff
[user@localhost ~]$ ping www.baidu.com
ping: www.baidu.com: Name or service not known

解决:

[user@localhost ~]$ vi /etc/sysconfig/network-scripts/ifcfg-eth0
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=dhcp
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth0
#UUID=5fdc35c0-e6b9-4120-a138-4f84e14dc176
DEVICE=eth0
ONBOOT=yes

验证

[root@localhost user]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:12:65:5a brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.66/24 brd 192.168.122.255 scope global noprefixroute dynamic eth0
       valid_lft 3598sec preferred_lft 3598sec
    inet6 fe80::4e1c:8d3c:e88b:747f/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
[root@localhost user]# ping www.baidu.com
PING www.a.shifen.com (61.135.169.121) 56(84) bytes of data.
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=1 ttl=127 time=24.8 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=2 ttl=127 time=24.2 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=3 ttl=127 time=24.2 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=4 ttl=127 time=24.2 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=5 ttl=127 time=25.2 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=6 ttl=127 time=24.7 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=7 ttl=127 time=24.7 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=8 ttl=127 time=24.5 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=9 ttl=127 time=26.3 ms
64 bytes from 61.135.169.121 (61.135.169.121): icmp_seq=10 ttl=127 time=24.4 ms

--- www.a.shifen.com ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 13480ms
rtt min/avg/max/mdev = 24.212/24.777/26.367/0.629 ms

note:

安装后的虚拟机的定义文件的位置

[root@agent test]# ls /etc/libvirt/qemu/
CentOS7.xml  networks

 

三、KVM虚拟机管理

基本操作

#列出创建的kvm虚拟机
$virsh list --all

#连接kvm虚拟机
$virsh console

#将虚拟机以xml格式导出
$virsh dumpxml centos7 > /home/user/centos.bake

#从备份中恢复虚拟机
$virsh define centos.bake

#结束
$virsh shutdown centos7

#开始
$virsh start centos7

#挂起虚拟机
$virsh suspend centos7

#恢复被挂起的虚拟机
$virsh resume

#开机启动虚拟机，即在虚拟机服务（libvirt）启动的时候，就启动虚拟机。
$virsh autostart 

#关闭开机启动虚拟机
$virsh auto start --disable 

#关闭虚拟机
$virsh shutdown 

#强制关闭虚拟机
$virsh destory 

 

备份、销毁及恢复KVM虚拟机

[root@localhost test]# virsh list --all
 Id    Name                           State
----------------------------------------------------
 -     centos7                        shut off

[root@localhost test]# virsh dumpxml centos7 > ./centos7.bak
[root@localhost test]# ls
centos7.bak
[root@localhost test]# virsh list --all
 Id    Name                           State
----------------------------------------------------
 -     centos7                        shut off

[root@localhost test]# virsh undefine centos7
Domain centos7 has been undefined

[root@localhost test]# virsh list --all
 Id    Name                           State
----------------------------------------------------

[root@localhost test]# virsh define centos7.bak
Domain centos7 defined from centos7.bak

[root@localhost test]# virsh list --all
 Id    Name                           State
----------------------------------------------------
 -     centos7                        shut off

连接kvm虚拟机

[root@localhost user]# virsh list --all
 Id    Name                           State
----------------------------------------------------
 -     centos7                        shut off

[root@localhost user]# virsh start centos7
Domain centos7 started

[root@localhost user]# virsh console centos7
Connected to domain centos7
Escape character is ^]
[   11.616201] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   11.729755] Ebtables v2.0 registered
[   11.787247] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   11.798058] Netfilter messages via NETLINK v0.30.
[   11.863785] ip_set: protocol 7
[   12.223204] nf_conntrack version 0.5.0 (7925 buckets, 31700 max)

CentOS Linux 7 (Core)
Kernel 3.10.0-1062.el7.x86_64 on an x86_64

localhost login:

cpu及内存动态扩容

设置cpu

[root@localhost test]# virsh edit centos7
<vcpu placement='auto' current='1'>3</vcpu>

[root@localhost test]# virsh start centos7
Domain centos7 started

[root@localhost test]# virsh setvcpus centos7 2 --live

[root@localhost test]# virsh vcpuinfo centos7
VCPU:           0
CPU:            2
State:          running
CPU time:       15.2s
CPU Affinity:   yyyy

VCPU:           1
CPU:            3
State:          running
CPU time:       0.0s
CPU Affinity:   yyyy

 设置内存

[root@localhost test]# virsh --help |grep memory
    memtune                        Get or set memory parameters
    setmaxmem                      change maximum memory limit
    setmem                         change memory allocation
    dommemstat                     get memory statistics for a domain
    freecell                       NUMA free memory
    node-memory-tune               Get or set node memory parameters
    nodememstats                   Prints memory stats of the node.

[root@localhost test]# virsh dommemstat centos7
actual 1048576
swap_in 0
swap_out 0
major_fault 183
minor_fault 159993
unused 907752
available 1014520
last_update 1584580295
rss 363772

[root@localhost test]# virsh setmem centos7 1000000 --live

[root@localhost test]# virsh dommemstat centos7
actual 1000000
swap_in 0
swap_out 0
major_fault 183
minor_fault 159993
unused 907752
available 1014520
last_update 1584580295
rss 350252

磁盘及网络配置

磁盘

qcow2 格式的文件虽然在性能上比rRaw 格式的有一些损失（主要体现在对于文件增量上，qcow2 格式的文件为了分配 cluster 多花费了一些时间），但是 qcow2 格式的镜像比 Raw 格式文件更小，只有在虚拟机实际占用了磁盘空间时，其文件才会增长，能方便的减少迁移花费的流量，更适用于云计算系统，同时，它还具有加密，压缩，以及快照等 raw 格式不具有的功能。

 

​[root@localhost test]# qemu-img info /opt/CentOS.raw
image: /opt/CentOS.raw
file format: raw
virtual size: 10G (10737418240 bytes)
disk size: 1.5G
[root@localhost test]# qemu-img convert -f raw -O qcow2 /opt/CentOS.raw  /opt/CentOS.qcow2
[root@localhost test]# qemu-img info /opt/CentOS.qcow2
image: /opt/CentOS.qcow2
file format: qcow2
virtual size: 10G (10737418240 bytes)
disk size: 1.5G
cluster_size: 65536
Format specific information:
    compat: 1.1
    lazy refcounts: false
​

 网络控制

添加桥接

#添加桥接
[root@localhost user]# brctl addbr br0
[root@localhost user]# brctl addif br0 ens33

#删除ens33分配的地址
[root@localhost user]# ip addr del dev ens33 192.168.75.131/24

#br0分配ip地址
[root@localhost user]# ifconfig br0 192.168.75.131/24 up
[root@localhost user]# route add default gw 192.168.75.2

#修改kvm虚拟机网络配置
[root@localhost user]# virsh edit centos7
 </controller>
    <interface type='bridge'>
      <mac address='52:54:00:12:65:5a'/>
      <source bridge='br0'/>
      <model type='virtio'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>

[root@localhost user]# virsh edit centos7
Domain centos7 XML configuration edited.

 再次尝试连接KVM虚拟机

[root@localhost user]# virsh start centos7
Domain centos7 started


[root@localhost user]# virsh console centos7
Connected to domain centos7
Escape character is ^]
user
Password:
Last login: Thu Mar 19 08:39:52 on ttyS0

[root@localhost user]# ping baidu.com
PING baidu.com (39.156.69.79) 56(84) bytes of data.
64 bytes from 39.156.69.79 (39.156.69.79): icmp_seq=1 ttl=128 time=26.3 ms
64 bytes from 39.156.69.79 (39.156.69.79): icmp_seq=2 ttl=128 time=25.9 ms
64 bytes from 39.156.69.79 (39.156.69.79): icmp_seq=3 ttl=128 time=26.4 ms
64 bytes from 39.156.69.79 (39.156.69.79): icmp_seq=4 ttl=128 time=27.3 ms

--- baidu.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 25.977/26.534/27.353/0.517 ms

 

 

---

2020年4月19日更新

解决遗留问题：无法通过vnc连接kvm虚拟机

1，安装tigervnc-server

2，若仍无法连接记得关闭安全策略

setenforce 0

systemctl stop firewalld(经验证只需这条命令即可)

iptables -F

 

参考资料

https://github.com/jaywcjlove/handbook/blob/master/CentOS/CentOS7安装KVM虚拟机详解.md