Hi, you can disable the old cipher by setting auth_allowed_ciphers to aes256k only: ceph mon set auth_allowed_ciphers aes256k See step 10 in the docs: https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht... Regards, Eugen Zitat von "GLE, Vivien" <ceph-users@ceph.io>:
Hi,
I just upgrade (from tentacle 20.2.1 to 20.2.4) and rolled CephX keys for a Cephadm cluster but there is still an error concerning the use of insecure keys
#ceph config get mon mon_auth_allow_insecure_key false
#ceph health detail
HEALTH_WARN Monitors are configured to allow auth using insecure key types [WRN] AUTH_INSECURE_KEYS_ALLOWED: Monitors are configured to allow auth using insecure key types insecure cipher aes allowed for auth
Didn't found any keys named like this in the ceph configuration but in the ceph mon dump
#ceph mon dump
auth_epoch 0 auth_service_cipher aes256k auth_allowed_ciphers aes, aes256k <= = auth_preferred_cipher aes256k dumped monmap epoch 15
Is the only way to get rid of this error is to manipulate the mon map ? How can I do it safely ?
Thanks
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io