Spice server and client have support for SASL authentication. When
using QEMU, /etc/sasl2/qemu.conf will be used as a configuration
file. For testing, you can use the digest-md5 mechanism, and populate
a test database using saslpasswd2 -f /etc/qemu/passwd.db -c
foo. These files have to be readable by the QEMU process that will
handle your VM.
To troubleshoot SASL issues, running strace -e open on the QEMU
process can be a useful first step.
Using virt-manager. It’s currently not possible to enable SASL from virt-manager.
Using libvirt. SASL support for SPICE has been added to libvirt mid-October 2013 so
you need a libvirt version that was released after this date. To
enable SASL, you need to add spice_sasl = 1 in /etc/libvirt/qemu.conf
for the system libvirtd instance, and to ~/.config/libvirt/qemu.conf
for the session libvirtd instance.
Using QEMU. Using SASL with QEMU involves a slight modification of the -spice
parameter used when running QEMU:
-spice port=3001,sasl