E.3. Enabling encrypted VNC consoles for FIPS You can set up encrypted VNC consoles to work with a Red Hat Virtualization (RHV) Manager and hosts that have FIPS enabled. To set up encrypted VNC consoles, you complete the following procedures: Enable FIPS in RHV . Configure the cluster to enable VNC Encryption . Run the VNC SASL ansible playbook on each host . Configure the Remote Viewer to trust the Manager's CA certificate . E.3.1. Configuring the cluster to enable VNC Encryption Prerequisites FIPS must be enabled on the cluster. Procedure In the Administration Portal, click Compute Clusters . Select the cluster where you plan to enable VNC encryption and click Edit . The Edit Cluster window opens. Select the Console tab. Select the Enable VNC Encryption checkbox and click OK . E.3.2. Running the VNC SASL Ansible playbook for each host Procedure In the Administration Portal, put the FIPS-enabled hosts into maintenance mode: Click Compute Hosts . In the Virtual Machines column, verify that each host has zero virtual machines. Perform a live migration to remove virtual machines from hosts, if necessary. See Migrating Virtual Machines Between Hosts . Select each host and click Management Maintenance and OK . Connect to the command line of the machine where the Manager is running. Standalone Manager: # ssh root@rhvm Self-hosted engine: Click Compute Virtual Machines to select the self-hosted engine virtual machine, named HostedEngine by default, and then click Console . Run the VNC SASL Ansible playbook for each host: # cd /usr/share/ovirt-engine/ansible-runner-service-project/project/ # ansible-playbook --ask-pass --inventory=<hostname> ovirt-vnc-sasl.yml <1> Specify the Hostname displayed on Compute Hosts . Select the host and click Installation Reinstall . After reinstallation, select the host and click Management Restart . After rebooting, select the host and click Management Activate . VNC SASL Ansible playbook error message When running the VNC SASL Ansible playbook, the task might fail with the following error message: Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host. To solve this problem, disable host key checking by doing one of the following: Disable host key checking permanently by uncommenting the following line in /etc/ansible/ansible.cfg : #host_key_checking = False Disable host key checking temporarily by running the following command: export ANSIBLE_HOST_KEY_CHECKING=False Additional resources Configuring and Applying SCAP Policies During Installation Installers and Images for Red Hat Virtualization Manager (v. 4.3 for x86_64) E.3.3. Configuring the Remote Viewer to trust the Manager's CA certificate Configure the Remote Viewer console on your client machine, virt-viewer or remote-viewer , to trust the RHV Manager's certificate authority (CA) Procedure Navigate to https://< engine_address >/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA . Enable all the trust settings. On the client machine where you plan to run the VNC console, create a directory for the certificate file: USD mkdir ~/.pki/CA Warning If this step generates an error such as mkdir: cannot create directory '/home/example_user/.pki/CA': File exists , take precautions to avoid overwriting ~/.pki/CA/cacert.pem in the step. For example, include the current date in the filename. Download the certificate: USD curl -k -o ~/.pki/CA/cacert-<today's date>.pem '\https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA' Install the certificate authority in your browser: Firefox Internet Explorer Google Chrome . Install the SASL SCRAM libraries on the client machine: USD sudo dnf install cyrus-sasl-scram Verification steps Run a virtual machine on one of the FIPS-enabled hosts you created. Connect to the virtual machine using a VNC console. Additional resources Installing Console Components Replacing the Manager CA Certificate

Commands:
ssh root@rhvm
cd /usr/share/ovirt-engine/ansible-runner-service-project/project/ ansible-playbook --ask-pass --inventory=<hostname> ovirt-vnc-sasl.yml <1>
Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host.
#host_key_checking = False
export ANSIBLE_HOST_KEY_CHECKING=False
mkdir ~/.pki/CA
curl -k -o ~/.pki/CA/cacert-<today's date>.pem '\https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA'
sudo dnf install cyrus-sasl-scram