Skip to content

"Console Port Isn't Password-Protected Yet"

Symptom

Opening a VM's console shows a warning:

<vm>'s console port isn't password-protected yet (started without VNC password authentication). Power the VM off and start it again to protect it. If this keeps showing, an admin needs to run Repair Worker on its host first.

The console still opens and works.

Root cause

Since 1.2.0-rc3, every VM's VNC port on a host asks for a password. The console sets a new one each time someone opens a console, valid for 5 minutes, and the browser never sees it (see Default Ports). Two things have to be true for that:

  1. The host has been set up for it. Add Host and Repair Worker give each host a VNC password default. Hosts added before 1.2.0-rc3 need one Repair Worker run.
  2. The VM was started after that. QEMU can't turn password checking on for a VM that's already running, so a VM started before its host was set up keeps an open console port until it's powered off and started again.

Until both are true, anyone who can reach the host's VNC port range (5900–6500) can open the VM's screen without a password. The host firewall rule that limits those ports to the console's own hosts still applies.

Fix

  1. Power the VM off and start it again. A restart from inside the guest isn't enough: QEMU itself has to start again. Open the console. The warning should be gone.
  2. If the warning is still there, the host hasn't been set up yet. Right-click the host → Repair Worker, wait for it to finish, then power the VM off and start it again.
  3. To protect every VM, run Repair Worker on each host, then power-cycle the VMs that were already running, for example in a maintenance window.

If the warning says could not set a console password instead, the console couldn't reach libvirt on the host to set the password. Check the host is Active and that its worker answers (Hosts table), then try again.

Second console on the same VM

Opening a console on a VM sets a new password, which ends the previous one. A console that's already connected stays connected.

See also