1

In KVM, it is possible to access the guest machine from the host machine. For example, you can SSH to the host machine and then access the guest VM by virsh console vm_name.

Is that possible in cloud? If yes, how? If not, why?

Edit: I mean if you are the cloud provider, not a customer. Or if you are the admin of your private cloud like OpenStack.

Noob_Guy
  • 111
  • 2
  • 3
    In the cloud you generally have no access to the host machine, so the question is moot. – vidarlo Aug 24 '23 at 05:14
  • @vidarlo I mean if you are the provider, or you are using a private cloud like OpenStack. – Noob_Guy Aug 24 '23 at 05:25
  • I put an edit to the question. – Noob_Guy Aug 24 '23 at 05:28
  • 1
    Are you asking if the provider has access to the VM in general terms? If so yes. They can read the memory at will, and there's nothing you can do about it. – vidarlo Aug 24 '23 at 05:31
  • @vidarlo yes. I am asking how does the provider do that, that is, how to access guest VM from host machine. – Noob_Guy Aug 24 '23 at 05:35
  • For example, in AWS or in OpenStack, how can you access the VM without using SSH? How to access the VM "from host machine"? – Noob_Guy Aug 24 '23 at 05:37
  • You can always access the VM's console from the host - the equivalent of access to mouse, keyboard, video on a physical machine. The host also controls every other aspect of the VM - memory, CPU, network, ... – Zac67 Aug 24 '23 at 06:26
  • @Zac67 I know that. My question is, is that possible in a cloud server? – Noob_Guy Aug 24 '23 at 06:57
  • @Noob_Guy Yes, of course. – Zac67 Aug 24 '23 at 07:19

3 Answers3

2

For the specifics of getting out of band access to your favorite rent-a-computer service, refer to their documentation. Usually called console access, serial console for the text version. Good documentation will have examples of how to connect via serial, or show graphics via VNC or SPICE.

As these cannot rely on IP in the guest working, usually this is done by attaching a serial console or display to the (virtualized) hardware. Sometimes via a host to guest command channel, such as is possible with VMware tools.

Your use of virsh on the VM host probably is via a UNIX socket to libvirt, which is this case is managing local kvm guests. This happens to work out of the box, and of course ssh is a known quantity for secure transport. However note that its also possible to connect to remote libvirt damons, or other hypervisor hosts.

A multi-tenant design should not in general allow users doing in guest things to log into the hypervisor. VM hosts are sensitive, so allowing ssh into them from possibly the internet is a bad idea. Need to restrict them from touching guests they should not. And users would need to know which compute host to use.

In practice, clouds have an API and proxy for remote access services. See for example OpenStack remote console configuration. Still the same tech for getting a hypervisor to expose a serial console, but designed as an application.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34
0

In KVM, it is possible to access the guest machine from the host machine.

No. KVM goes to the host. THAT SAID - in most hypervisors the host has out of band access possibilities. Which depend on the host virtualizer - RTFM is the only solution as you do not tell us that.

Hyper-V in example has both a client service to upload files (even without login), a graphical app (that runs on the host) that connects to the VM as a monitor, so to say, and a powershell login via a VM level client service (so no network needed).

TomTom
  • 51,649
  • 7
  • 54
  • 136
0

In cloud, is it possible to access guest VM from host machine?

Yes of course.

The host machine, the hypervisor has full control over the VM and the cloud provider has full control over the hypervisor and thus the VM.

The hypervisor controls that a VM, when launched, comes with virtual console, virtual hard drive, virtual serial port, one or mor virtual NIC's etc.

Frequently the cloud provider grants the customer using that cloud server remote access to the virtual console for out of band management. (That does not require access to the hypervisor by the way.)

And there is nothing that prevents the cloud provider, other than SLA's, contracts and privacy agreements, from also connecting to that virtual console, either directly from the hypervisor or though the same method that they use to grant their customers access.

(That is no different compared to when you host a physical server in a co-location datacenter. There too the provider can plug in a monitor, keyboard and mouse, insert an USB thumb drive or CD and see what your OS displays.)

HBruijn
  • 77,029
  • 24
  • 135
  • 201