Virtualization on Linux is easy with KVM, QEMU, and virt-manager. Debian/Ubuntu provides these tools through its official repositories, allowing you to create and manage virtual machines locally or on a remote server.
1. Check virtualization support
Verify that hardware virtualization is available:
lscpu | grep -E 'Virtualization|Architecture'
ls -l /dev/kvm
On an Intel system, VT-x should appear, and /dev/kvm should exist.
2. Install KVM and virt-manager
Update Debian and install the required packages:
sudo apt update
sudo apt install qemu-system-x86 qemu-utils \
libvirt-daemon-system libvirt-clients \
virt-manager virtinst ovmf dnsmasq-base
Enable the libvirt service:
sudo systemctl enable --now libvirtd
Add your user to the required groups:
sudo usermod -aG libvirt,kvm "$USER"
Log out and log back in to apply the group changes.
3. Verify the installation
Check whether libvirt is accessible:
virsh -c qemu:///system list --all
Launch Virtual Machine Manager:
virt-manager --connect qemu:///system
You can now create and manage virtual machines through the graphical interface.
4. Manage virtual machines on a remote server via SSH
One of virt-manager's useful features is the ability to manage virtual machines hosted on another Linux system. The graphical interface runs on your desktop, while the VMs run on the remote server.
Prepare the remote server
On the Debian server hosting the virtual machines, install SSH and the virtualization components:
sudo apt update
sudo apt install qemu-system-x86 libvirt-daemon-system \
libvirt-clients openssh-server
Enable the services:
sudo systemctl enable --now ssh
sudo systemctl enable --now libvirtd
Add your remote user to the required groups:
sudo usermod -aG libvirt,kvm "$USER"
Log out and back in to apply the changes.
5. Configure SSH key authentication
In this example, Ubuntu is the virt-manager client and Debian is the remote virtualization server. SSH key authentication allows Ubuntu to connect securely without repeatedly entering the remote account password.
Generate the SSH key on Ubuntu
Open a terminal on Ubuntu and run:
ssh-keygen -t ed25519 -f ~/.ssh/virtmanager
You can set a passphrase for additional security or press Enter twice to leave it empty.
Two files will be created:
~/.ssh/virtmanager — private key, which must remain on Ubuntu.
~/.ssh/virtmanager.pub — public key, which can be copied to Debian.
Copy the public key to Debian
On Ubuntu, run:
ssh-copy-id -i ~/.ssh/virtmanager.pub shec@DEBIAN_SERVER_IP
Replace DEBIAN_SERVER_IP with the remote server's LAN or Tailscale IP address. Enter the password for the shec account on Debian when prompted.
Test the SSH connection
From Ubuntu, run:
ssh -i ~/.ssh/virtmanager shec@DEBIAN_SERVER_IP
If authentication succeeds, type exit to return to Ubuntu.
Configure an SSH alias
On Ubuntu, edit the SSH configuration:
nano ~/.ssh/config
Add the following configuration:
Host debian-vm
HostName DEBIAN_SERVER_IP
User shec
IdentityFile ~/.ssh/virtmanager
IdentitiesOnly yes
Replace DEBIAN_SERVER_IP with the actual server address. Save the file and set the permissions:
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/virtmanager
Test the alias:
ssh debian-vm
You should now be able to connect using your SSH key.
Install the virt-manager client
On the local Linux desktop, install virt-manager and the SSH client:
sudo apt update
sudo apt install virt-manager openssh-client
If this computer is only used to manage remote VMs, it does not need its own QEMU/KVM installation.
Connect to the remote server
Launch virt-manager:
virt-manager
In the graphical interface:
- Select File → Add Connection.
- Choose QEMU/KVM.
- Enable Connect to remote host over SSH.
- Enter the remote username and hostname or IP address.
- Finish the connection setup.
Alternatively, connect directly from the terminal:
virt-manager --connect qemu+ssh://username@SERVER_IP/system
To verify the connection without opening the graphical interface, run:
virsh -c qemu+ssh://username@SERVER_IP/system list --all
The remote virtual machines should appear in virt-manager once the connection is successful.
5. Access remote VMs over Tailscale
If your server is connected to Tailscale, you can use its Tailscale IP address instead of its LAN IP or public IP.
For example:
virt-manager --connect qemu+ssh://username@100.x.y.z/system
Replace the example address with the server's actual Tailscale IP. Ensure SSH is accessible over the Tailscale connection.
This approach avoids exposing the libvirt management interface directly to the internet. You only need SSH connectivity between your desktop and the remote host.
