SSH access to incus VM

[mark-harsch]

Hi,

I'm trying to setup a Linux environment for development on my Mac.
I use colima with incus to spin up a Linux VM (using vz virtualization with nesting enabled).
This works so far and I can start a terminal by incus exec, push/pull files by incus file and also can ping the VM with the IPv4 address shown by incus list:

➜  ~ incus list
+--------------+---------+-----------------------+-------------------------------------------------+-----------------+-----------+
|     NAME     |  STATE  |         IPV4          |                      IPV6                       |      TYPE       | SNAPSHOTS |
+--------------+---------+-----------------------+-------------------------------------------------+-----------------+-----------+
| linux-dev-vm | RUNNING | 192.100.0.33 (enp5s0) | fd42:76bb:941a:7734:216:3eff:fe29:d7e7 (enp5s0) | VIRTUAL-MACHINE | 0         |
+--------------+---------+-----------------------+-------------------------------------------------+-----------------+-----------+

Now I want to connect my VS code running on the Mac through ssh with the VM. Therefore I have installed the openssh server in the VM and did following configuration beyond the default in /etc/ssh/sshd_config for it (since I'm still using root user in VM):

ListenAddress 192.100.0.33:25
PermitRootLogin yes
PasswordAuthentication yes
PermitEmptyPasswords yes

However, I always get "connection refused" errors when I do ssh [email protected] -p 25.

ping 192.100.0.33 gives proper results.
netstat on the VM shows that the ssh server listens on the port:

➜  ~ netstat -tulpn          
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.54:53           0.0.0.0:*               LISTEN      282/systemd-resolve 
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      282/systemd-resolve 
tcp        0      0 192.100.0.33:25         0.0.0.0:*               LISTEN      1/init

...

and I also checked logs /var/log/auth.log that show that the sshd is listening (but nothing else pops up here):

2024-12-17T06:21:18.256228+00:00 linux-dev-vm sshd[351]: Server listening on 192.100.0.33 port 25.

What am I doing or getting wrong with my setup to not being able to connect to the VM through ssh?

[abiosoft]

The behaviour on Linux and macOS are slightly different, because the Incus instance is abstracted behind a VM on macOS.

To be able to access your Incus instances directly from macOS host, you need to do two things.

1. Start with network address enabled

This will likely prompt you for a sudo password for the initial setup.

colima start --network-address --runtime incus

2. Ensure your Incus instance is using the colima network

By default, instances use the default incusbr0 bridge network, which would not make them reachable from the macOS host.
However, there is a custom col0 network that can be used to make the instance accessible to the host.

incus launch images:ubuntu/noble c1 --network=col0

Afterwards, the instance should be accessible from the host.

Note

The col0 network is not directly from Incus, it is a custom network specific to Colima to work around the limitations of accessing the VM from the host.

The experience can be improved based on user feedback.

[mark-harsch]

Thanks for your fast reply 😃

I have tried as you proposed (needed to create a new instance in incus for the VM). The problem now is that I'm not able to pull any packages through apt from the internet. Since I can not install anything like wget, curl or git, I can not verify if it is related to apt only.
A ping google.com however works, so VM seems to be able to access the internet.

root@linux-dev-vm:~# apt install wget
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  libpsl5t64 publicsuffix
The following NEW packages will be installed:
  libpsl5t64 publicsuffix wget
0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.
Need to get 516 kB of archives.
After this operation, 1489 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Ign:1 http://ports.ubuntu.com/ubuntu-ports noble/main arm64 libpsl5t64 arm64 0.21.2-1.1build1
Ign:2 http://ports.ubuntu.com/ubuntu-ports noble/main arm64 publicsuffix all 20231001.0357-0.1
Ign:3 http://ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 wget arm64 1.21.4-1ubuntu4.1
Ign:1 http://ports.ubuntu.com/ubuntu-ports noble/main arm64 libpsl5t64 arm64 0.21.2-1.1build1
0% [Waiting for headers]

[abiosoft]

What version of Colima are you on? If it's not 0.8.1, kindly update as there is slight improvement with network routes.
Do a colima stop and colima start afterwards.

If you're already on the latest version, then we can try some other things.

For testing sake, what happens if you temporarily change the DNS server?
I think changing the values in /etc/resolv.conf should achieve that.

As a last resort, you can have two network interfaces, one on the incusbr0 network and one on the col0 network.
Retaining the default behaviour for internet access, and col0 simply for access to the host.
But that's a stretch, and you shouldn't need to do that.

I am not entirely sure what the issue is, so I'll be relying on your feedback to diagnose and improve this.

[abiosoft]

Also bear in mind, you can simply use a Proxy Device or Network Forwards to forward the SSH port of the VM to an open port on the host.

[mark-harsch]

I'm still on colima 0.8.0 still and was on 0.7.6 some weeks ago. Maybe there are also some things that were caused by the update to 0.8.0.
I will try to do a clean install with 0.8.1 and also check Proxy Device or Network Forwards of incus.

Thanks for now 👍 , I will let you know about progress I make.