Remote Console¶

Open a console on a machine from the portal without a direct network path to it. The portal offers up to four console types for a machine under Remote, all streamed through the endpoint's Guacamole service (guacd):

The browser sends only the console type, the machine id and its auth token. Addresses, usernames, passwords and keys are resolved on the endpoint and injected into guacd there. See Remote Console Network Path for every connection the consoles make and the ports involved.

Prerequisites¶

Endpoint¶

The guacd-service resource broker must exist. The bootstrap-guacd task creates it. Without it the portal hides the Remote button.

drpcli resource_brokers exists Name:guacd-service && echo "broker present"

Which consoles a machine offers¶

The portal always offers the SSH console. It offers the BMC consoles when the machine has ipmi/address, and the Hyper-V console when it has hyper-v/uuid. For BMC and Hyper-V the endpoint asks the plugin's console-info action what is reachable, and disables an item with the reason as a tooltip when it is not.

SSH console¶

The matching public key has to be in the machine's authorized_keys. The supported way to arrange that is the opt-in in bootstrap-ssh:

1. Set bootstrap-ssh/console-key to true on the global profile.
2. Run the endpoint bootstrap workflow. bootstrap-ssh creates a console keypair, publishes the public half in access-keys-global and stores the private half in the global profile's console/ssh-key.
3. Machines provisioned after that get the key through the ssh-access task. Machines provisioned earlier need ssh-access to run again.

The console does not read rsa/key-private. That param belongs to the Ansible and Kubespray content, and a key placed there would be picked up by unrelated tasks.

BMC serial console¶

The BMC has to advertise a serial console over SSH in Redfish, under either Managers/<id>.SerialConsole or Managers/<id>.CommandShell, and port 22 must be open on the BMC.

Most vendor BMCs drop an SSH login onto a management shell, not the serial port. The console sends the vendor's entry command when it knows the BMC:

Dell and Lenovo have been checked on hardware. HPE iLO gets vsp, and other BMCs get no entry command; if the session lands on a management shell, type the vendor's command.

BMC KVM console¶

Set one of ipmi/console-vnc-port or ipmi/console-url. Redfish only says the BMC has a graphical console, not whether it speaks VNC. iDRAC and XCC both use their own KVM protocol, so they take the link-out. With neither param set the item is disabled with the reason "BMC graphical console is not VNC capable".

Hyper-V console¶

The Hyper-V console has its own page with the host-side setup, including the per-VM Grant-VMConnectAccess step that is the usual cause of a session that connects and immediately closes: Hyper-V VM Console.

Opening a console¶

Open the machine in the portal and choose Remote, then the console type. The SSH, serial and Hyper-V consoles open in a window in the portal. The BMC KVM console opens in the portal when it streams over VNC and in a new tab when it is a vendor link.

Validation¶

Ask the endpoint what it can offer for a machine with a BMC or a Hyper-V UUID. Name the provider with --plugin: ipmi for the BMC consoles, hyper-v for a VM console.

drpcli machines runaction <machine-uuid> console-info --plugin ipmi

Every descriptor comes back with available and, when false, a reason. This is the answer for a Dell iDRAC with ipmi/console-url set:

{
  "consoles": [
    { "type": "bmc-kvm", "available": true, "transport": "link", "url": "https://<bmc-address>" },
    { "type": "bmc-sol", "available": true, "transport": "guacd-ssh", "port": 22, "command": "console com2" }
  ]
}

To confirm that no credentials reach the browser, open the browser's developer tools while a console is connected and look at the WebSocket request. Its query string carries only console, machine and token.

Troubleshooting¶

The console window shows a checklist for the console type when a session fails. The same items, with what to check:

SSH console

• Port 22 is open on the machine.
• console/ssh-key resolves for the machine. Check with --aggregate, since it usually comes from the global profile.
• console/ssh-user is the account whose authorized_keys holds the public half.
• If the OS has ssh-rsa disabled, add HostKeyAlgorithms +ssh-rsa to the end of /etc/ssh/sshd_config on the machine and restart sshd.
• A password prompt in the terminal means no key was offered. DRP's default sshd policy is key-only for root, so the prompt cannot be satisfied. Fix the key, not the password.

BMC serial console

• console-info reports bmc-sol available. If not, the reason names the missing piece: Redfish unreachable, wrong credentials, or no serial console over SSH.
• The session opens on a management shell instead of the serial console: the entry command for that vendor is missing or wrong. The command sent is in the command field of the console-info answer.
• On Lenovo XCC, "User does not have the authority to issue this command" means the BMC user lacks Supervisor authority. console-info cannot see this and still reports the console available.

BMC KVM console

• Neither ipmi/console-vnc-port nor ipmi/console-url is set: the item is disabled with that reason.
• Streaming VNC fails to authenticate: the VNC server usually has its own password. Set ipmi/console-vnc-password.
• Redfish reports the graphical console disabled: enable it on the BMC.

Hyper-V console

• See Hyper-V VM Console for the connect-then-close case.
• hyper-v/console-host must name the Hyper-V host, and hyper-v/console-username and hyper-v/console-password must authenticate to the host, not the guest.

The Remote button is not shown

• The endpoint has no guacd-service resource broker. Run bootstrap-guacd.

Parameters read back as null

• drpcli machines get <uuid> param <name> reads only params set directly on the machine. Add --aggregate to see values inherited from profiles.

References¶

• Remote Console Network Path
• Guacamole Tunnel
• Hyper-V VM Console