Password in plain text required for the connection between XOCE and XO-SERVER. Is this normal ?

FACE_DVLP

Hi,

I’ve updated XOCE 6 but I’m getting the error message “Unable to connect to the XO server” in the GUI.

I ran the command redis-cli followed by the command
GET xo:server:7315c3b1-d9c6-4cba-a207-e80ee4070e8f

Command output with plain text password:
‘{\’allowUnauthorized\‘:\’true\‘,\’enabled\‘:\’true\‘,\’host\‘:\’192.168.100.100\‘,\’ label\‘:\’sxcp01\‘,\’password\‘:\’E ;\‘,\’username\‘:\’root\‘,\’poolNameDescription\‘:\’XCP-Ng Server S01\‘,\’poolMembersAddresses\‘:\’[\" 192.168.100.100\\‘]\’,\‘error\’:\‘{\\’poolId\\‘:\\’75d19959-fe1f-ed43-f731-77d4ac6d5ec6\\‘,\\’connectedServerId\\‘:\\’ 1f612313-c8ec-4767-97c1-03347d510759\\‘,\\’connectingServerId\\‘:\\’7315c3b1-d9c6-4cba-a207-e80ee4070e8f\\‘}\’}"

Is it normal ?

Second problem
I checked the log files
root@MLMS06:/home/administrateur# sudo journalctl -u xo-server -f -n 50
août 30 06:06:35 MLMS06 xo-server[812077]: }
août 30 06:06:35 MLMS06 xo-server[812077]: 2026-08-30T04:06:35.273Z xo:xo-mixins:xen-servers INFO auto-reconnect stopped {
août 30 06:06:35 MLMS06 xo-server[812077]: serverId: '7315c3b1-d9c6-4cba-a207-e80ee4070e8f',
août 30 06:06:35 MLMS06 xo-server[812077]: outcome: 'permanent error'
août 30 06:06:35 MLMS06 xo-server[812077]: }
août 30 06:06:36 MLMS06 xo-server[812077]: 2026-08-30T04:06:36.412Z xo:xo-mixins:xen-servers WARN auto-reconnect aborted: permanent error {
août 30 06:06:36 MLMS06 xo-server[812077]: serverId: '7315c3b1-d9c6-4cba-a207-e80ee4070e8f',
août 30 06:06:36 MLMS06 xo-server[812077]: error: PoolAlreadyConnected: this pool is already connected
août 30 06:06:36 MLMS06 xo-server[812077]: at XenServers._connectXenServer (file:///opt/xen-orchestra/packages/xo-server/src/xo-mixins/xen-servers.mjs:473:15)
août 30 06:06:36 MLMS06 xo-server[812077]: at XenServers.connectXenServer (file:///opt/xen-orchestra/packages/xo-server/src/xo-mixins/xen-servers.mjs:423:7)
août 30 06:06:36 MLMS06 xo-server[812077]: at autoReconnect (file:///opt/xen-orchestra/packages/xo-server/src/_xenServerAutoReconnect.mjs:49:7) {
août 30 06:06:36 MLMS06 xo-server[812077]: poolId: '75d19959-fe1f-ed43-f731-77d4ac6d5ec6',
août 30 06:06:36 MLMS06 xo-server[812077]: connectedServerId: '1f612313-c8ec-4767-97c1-03347d510759',
août 30 06:06:36 MLMS06 xo-server[812077]: connectingServerId: '7315c3b1-d9c6-4cba-a207-e80ee4070e8f'
août 30 06:06:36 MLMS06 xo-server[812077]: }
août 30 06:06:36 MLMS06 xo-server[812077]: }
août 30 06:06:36 MLMS06 xo-server[812077]: 2026-08-30T04:06:36.413Z xo:xo-mixins:xen-servers INFO auto-reconnect stopped {
août 30 06:06:36 MLMS06 xo-server[812077]: serverId: '7315c3b1-d9c6-4cba-a207-e80ee4070e8f',
août 30 06:06:36 MLMS06 xo-server[812077]: outcome: 'permanent error'
août 30 06:06:36 MLMS06 xo-server[812077]: }
août 30 06:06:37 MLMS06 xo-server[812077]: 2026-08-30T04:06:37.537Z xo:xo-mixins:xen-servers WARN auto-reconnect aborted: permanent error {
août 30 06:06:37 MLMS06 xo-server[812077]: serverId: '7315c3b1-d9c6-4cba-a207-e80ee4070e8f',
août 30 06:06:37 MLMS06 xo-server[812077]: error: PoolAlreadyConnected: this pool is already connected
août 30 06:06:37 MLMS06 xo-server[812077]: at XenServers._connectXenServer (file:///opt/xen-orchestra/packages/xo-server/src/xo-mixins/xen-servers.mjs:473:15)
août 30 06:06:37 MLMS06 xo-server[812077]: at XenServers.connectXenServer (file:///opt/xen-orchestra/packages/xo-server/src/xo-mixins/xen-servers.mjs:423:7)
août 30 06:06:37 MLMS06 xo-server[812077]: at autoReconnect (file:///opt/xen-orchestra/packages/xo-server/src/_xenServerAutoReconnect.mjs:49:7) {
août 30 06:06:37 MLMS06 xo-server[812077]: poolId: '75d19959-fe1f-ed43-f731-77d4ac6d5ec6',
août 30 06:06:37 MLMS06 xo-server[812077]: connectedServerId: '1f612313-c8ec-4767-97c1-03347d510759',
août 30 06:06:37 MLMS06 xo-server[812077]: connectingServerId: '7315c3b1-d9c6-4cba-a207-e80ee4070e8f'

I deleted the entry using the command
DEL xo:server:7315c3b1-d9c6-4cba-a207-e80ee4070e8f

The xo-server service is running and I restarted it

but I’m still getting the error message
“Unable to connect to the XO server” in the GUI.

Best regards

olivierlambert

Hi!

It is not the XOCE to xo-server link, it is the credential xo-server uses to log into XAPI on your host.
It has to be reversible, not hashed, because xo-server replays it to XAPI on every connect and auto-reconnect. So yes, plaintext by default is expected. The security perimeter here is Redis itself (bound to localhost or a unix socket, never exposed) and root access on the XO VM.

That said, since XO 6.5 there is an opt-in encryption at rest. In your xo-server config:

[redis]
encryptCredentialDatabase = true

On the next start, every record is encrypted with AES-256-GCM (values get an enc: prefix) and index keys become HMAC-SHA256 blind indexes, so hostnames and emails are not readable either. The key is split in two halves, one in XenStore (vm-data/xo-encryption-key) and one in /var/lib/xo-server/data/xo-encryption-key.

Caveats for a source install:

XO must run as a VM on XCP-ng/XenServer with xen-tools, and xo-server needs access to the xenstored socket (root, typically).
Config export then requires a passphrase.
If you lose one key half while encryption is on, do not restart: XO would regenerate both halves and the existing records would become undecryptable.

Full doc: https://docs.xen-orchestra.com/credential-encryption

About the PoolAlreadyConnected part, that is a separate issue. It means two server entries resolve to the same pool, typically a slave host registered next to the master, or the pool re-added after a master change. Removing the entry with DEL xo:server:<id> is not the right fix: it drops the hash but leaves the id in xo:server_ids and in the host index. Remove the server from the UI instead. If the error persists, it is the other entry pointing to that same pool that needs to go.