KVM安装部署全过程

[root@ c7-41 ~]# systemctl stop firewalld
[root@ c7-41 ~]# systemctl disable firewalld
[root@ c7-41 ~]# setenforce 0
[root@ c7-41 ~]# sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

[root@ c7-41 ~]# yum -y install epel-release vim wget net-tools unzip zip gcc gcc-c++

[root@ c7-41 ~]# vim /etc/security/limits.conf   ###在末尾添加
* soft nofile 65535
* hard nofile 65535 
[root@ c7-41 ~]# cat /etc/security/limits.conf |grep -w '*' | grep -v '^#'
* soft nofile 65535
* hard nofile 65535

[root@ c7-41 ~]# vim /etc/pam.d/login        ###在末尾添加
session    required     /lib/security/pam_limits.so

#临时生效
[root@ c7-41 ~]# vim /etc/profile                   ###在末尾添加
ulimit -n 65535
[root@ c7-41 ~]# source /etc/profile          ###生效
[root@ c7-41 ~]# ulimit -n
65535
###星号代表全局， soft为软件，hard为硬件，nofile为这里指可打开文件数。

[root@ c7-41 ~]# egrep -o 'vmx|svm' /proc/cpuinfo
vmx
vmx

[root@ c7-41 ~]# yum -y install qemu-kvm qemu-kvm-tools qemu-img virt-manager libvirt libvirt-python libvirt-client virt-install virt-viewer bridge-utils libguestfs-tools

[root@ c7-41 ~]# systemctl start libvirtd
[root@ c7-41 ~]# systemctl enable libvirtd
[root@ c7-41 ~]# systemctl status libvirtd
#检查也没有kvm模块
[root@ c7-41 ~]# lsmod|grep kvm
kvm_intel             188644  0
kvm                   621480  1 kvm_intel
irqbypass              13503  1 kvm
#查看当前系统里面有没有
[root@ c7-41 ~]# virsh -c qemu:///system list
 Id    Name                           State
----------------------------------------------------
[root@ c7-41 ~]# ln -s /usr/libexec/qemu-kvm /usr/bin/qemu-kvm
[root@ c7-41 ~]# ll /usr/bin/qemu-kvm
lrwxrwxrwx 1 root root 21 May  5 11:16 /usr/bin/qemu-kvm -> /usr/libexec/qemu-kvm

[root@ c7-41 ~]# yum -y install git python-pip libvirt-python libxml2-python python-websockify supervisor nginx python-devel
##升级pip
[root@ c7-41 ~]# pip install --upgrade pip -i https://pypi.tuna.tsinghua.edu.cn/simple   
Collecting pip
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/54/2e/df11ea7e23e7e761d484ed3740285a34e38548cf2bad2bed3dd5768ec8b9/pip-20.1-py2.py3-none-any.whl (1.5MB)
    100% |████████████████████████████████| 1.5MB 256kB/s
Installing collected packages: pip
  Found existing installation: pip 8.1.2
    Uninstalling pip-8.1.2:
      Successfully uninstalled pip-8.1.2
Successfully installed pip-20.1

阿里云 https://mirrors.aliyun.com/pypi/simple/
中国科技大学 https://pypi.mirrors.ustc.edu.cn/simple/
豆瓣(douban) https://pypi.douban.com/simple/ 
清华大学 https://pypi.tuna.tsinghua.edu.cn/simple/
中国科学技术大学 http://pypi.mirrors.ustc.edu.cn/simple/
华中理工大学：http://pypi.hustunique.com/
山东理工大学：http://pypi.sdutlinux.org/

[root@ c7-41 ~]# cd /usr/local/src/
[root@ c7-41 src]# git clone git://github.com/retspen/webvirtmgr.git

[root@ c7-41 src]# cd webvirtmgr/
##如果报错，换一个镜像（上面有）
[root@ c7-41 webvirtmgr]# pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple

[root@ c7-41 webvirtmgr]# python
Python 2.7.5 (default, Aug  7 2019, 00:51:29)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-39)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import sqlite3
>>> exit()

[root@ c7-41 webvirtmgr]# python manage.py syncdb
WARNING:root:No local_settings file found.
Creating tables ...
Creating table auth_permission
Creating table auth_group_permissions
Creating table auth_group
Creating table auth_user_groups
Creating table auth_user_user_permissions
Creating table auth_user
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table servers_compute
Creating table instance_instance
Creating table create_flavor

You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes  ##是否创建超级管理员帐号
Username (leave blank to use 'root'):  ##回车默认为root
Email address: 1279087939@qq.com  ##设置超级管理员邮箱
Password: 123456       ##设置超级管理员密码
Password (again):123456
Superuser created successfully.
Installing custom SQL ...
Installing indexes ...
Installed 6 object(s) from 1 fixture(s)

[root@ c7-41 webvirtmgr]# mkdir /var/www
[root@ c7-41 webvirtmgr]# cp -r /usr/local/src/webvirtmgr/ /var/www/
[root@ c7-41 webvirtmgr]# chown -R nginx.nginx /var/www/webvirtmgr/

[root@ c7-41 webvirtmgr]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):  
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:FBWgwlyptDF8dem65poTlImt5c1Qm63bf9Mp2WDJGSs root@c7-41
The key's randomart image is:
+---[RSA 2048]----+
|   .  .o+o+o     |
|   o=.o..o.      |
|   .+O.+.=       |
|    +.B.o o  .   |
|     = +So  . =  |
|    . o =  E B   |
|       . +  o +..|
|      ..+ .  ooo.|
|      o=.  ..... |
+----[SHA256]-----+

[root@ c7-41 webvirtmgr]# ssh-copy-id 10.0.0.41
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '10.0.0.41 (10.0.0.41)' can't be established.
ECDSA key fingerprint is SHA256:AxAn8ho/KqTHrRuTeSOokFBDmQK36JAdH49GlnnjoOg.
ECDSA key fingerprint is MD5:57:79:69:72:65:46:7e:04:7d:f5:55:0e:c6:44:65:70.
Are you sure you want to continue connecting (yes/no)? yes     ##yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@10.0.0.41's password:        ##123456

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '10.0.0.41'"
and check to make sure that only the key(s) you wanted were added.

[root@ c7-41 ~]# ssh 10.0.0.41 -L localhost:8000:localhost:8000 -L localhost:6080:localhost:60
Last login: Tue May  5 11:50:04 2020 from 10.0.0.1
[root@ c7-41 ~]# ss -antl
State       Recv-Q Send-Q            Local Address:Port                           Peer Address:Port
LISTEN      0      100                   127.0.0.1:25                                        *:*
LISTEN      0      128                   127.0.0.1:6010                                      *:*
LISTEN      0      128                   127.0.0.1:6011                                      *:*
LISTEN      0      128                   127.0.0.1:6080                                      *:*
LISTEN      0      128                   127.0.0.1:8000                                      *:*
LISTEN      0      128                           *:111                                       *:*
LISTEN      0      5                 192.168.122.1:53                                        *:*
LISTEN      0      128                           *:22                                        *:*
LISTEN      0      100                       [::1]:25                                     [::]:*
LISTEN      0      128                       [::1]:6010                                   [::]:*
LISTEN      0      128                       [::1]:6011                                   [::]:*
LISTEN      0      128                       [::1]:6080                                   [::]:*
LISTEN      0      128                       [::1]:8000                                   [::]:*
LISTEN      0      128                        [::]:111                                    [::]:*
LISTEN      0      128                        [::]:22                                     [::]:*

[root@ c7-41 ~]# vim /etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80;
        server_name  localhost;

        include /etc/nginx/default.d/*.conf;

        location / {
                root html;
                index index.html index.htm;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}

[root@ c7-41 ~]# vim /etc/nginx/conf.d/webvirtmgr.conf
server {
listen 80 default_server;

server_name $hostname;
#access_log /var/log/nginx/webvirtmgr_access_log;

location /static/ {
    root /var/www/webvirtmgr/webvirtmgr;
    expires max;
   }

location / {
     proxy_pass http://127.0.0.1:8000;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
     proxy_set_header Host $host:$server_port;
     proxy_set_header X-Forwarded-Proto $remote_addr;
     proxy_connect_timeout 600;
     proxy_read_timeout 600;
     proxy_send_timeout 600;
     client_max_body_size 1024M;
   }
}

[root@ c7-41 ~]# vim /var/www/webvirtmgr/conf/gunicorn.conf.py
bind = '127.0.0.1:8000'
backlog = 2048
#还有很多方法，来查看
[root@ c7-41 ~]# cat /var/www/webvirtmgr/conf/gunicorn.conf.py | grep -v '^#' | sed -n '5,6p'
bind = '127.0.0.1:8000'
backlog = 2048

[root@ c7-41 ~]# systemctl start nginx

[root@ c7-41 ~]# vim /etc/supervisord.conf
##在末尾添加
[program:webvirtmgr]
command=/usr/bin/python2 /var/www/webvirtmgr/manage.py run_gunicorn -c /var/www/webvirtmgr/conf/gunicorn.conf.py
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
logfile=/var/log/supervisor/webvirtmgr.log
log_stderr=true
user=nginx

[program:webvirtmgr-console]
command=/usr/bin/python2 /var/www/webvirtmgr/console/webvirtmgr-console
directory=/var/www/webvirtmgr
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/webvirtmgr-console.log
redirect_stderr=true
user=nginx

[root@ c7-41 ~]# systemctl start supervisord
[root@ c7-41 ~]# systemctl enable supervisord
[root@ c7-41 ~]# systemctl status supervisord

[root@ c7-41 ~]# su - nginx -s /bin/bash
[nginx@ c7-41 ~]$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/nginx/.ssh/id_rsa):
Created directory '/var/lib/nginx/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /var/lib/nginx/.ssh/id_rsa.
Your public key has been saved in /var/lib/nginx/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:yx8WDwCmUpIpg+jPDa5/6qPbxr58GIyVBb6sd40tC4A nginx@c7-41
The key's randomart image is:
+---[RSA 2048]----+
|o .+o o          |
|= +o + .         |
|.o..+   .        |
|...=.    .       |
|E.Boo   S o      |
| .o* .+. . +     |
| .ooo+ oo o .    |
| .+=ooo  o .     |
| oBO*.    .      |
+----[SHA256]-----+

[nginx@ c7-41 ~]$ touch ~/.ssh/config && echo -e "StrictHostKeyChecking=no\nUserKnownHostsFile=/dev/null" >>~/.ssh/config
[nginx@ c7-41 ~]$ chmod 0600 ~/.ssh/config
[nginx@ c7-41 ~]$ ssh-copy-id root@10.0.0.41
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/var/lib/nginx/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Warning: Permanently added '10.0.0.41' (ECDSA) to the list of known hosts.
root@10.0.0.41's password:123456

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@10.0.0.41'"
and check to make sure that only the key(s) you wanted were added.

#退出
[nginx@ c7-41 ~]$ exit
logout

[root@ c7-41 ~]# vim /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[Remote libvirt SSH access]
Identity=unix-user:root
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes
[root@ c7-41 ~]# chown -R root.root /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
[root@ c7-41 ~]# systemctl restart supervisord
[root@ c7-41 ~]#  systemctl restart libvirtd

[root@ c7-41 ~]# cd /var/lib/libvirt/images
[root@ c7-41 images]# ll
total 4554752
-rw-r--r-- 1 root root 4664066048 May  8 15:03 CentOS-7-x86_64-DVD-1908.iso