Alright, so it's not cephadm managed then. Yeah, you can set auth_service_cipher to aes256k, just make sure to keep auth_allowed_ciphers aes, aes256k for your clients. You probably should also keep auth_preferred_ciphers aes, so if you create new keyrings without specifying --key-type you'll automatically get the old type. But that really depends if you have to create new keyrings for older clients. I kept it in our cluster. Zitat von Christopher Durham <caduceus42@aol.com>:
Eugen, Here is what you requested. # ceph mon dump | grep cipherdumped monmap epoch 5auth_service_cipher aesauth_allowed_ciphers aes, aes256kauth_preferred_ciphers aes I suspect that I am able set set auth_service_cipher to aes256k but wanted to be sure before I do so. -Chris
On Friday, August 28, 2026 at 11:14:57 AM MDT, Eugen Block <eblock@nde.ag> wrote:
Hi,
can you share 'ceph mon dump |grep cipher'? If you use cephadm, the orchestrator should already have that done for you. The warning you're seeing will clear after a few hours automatically.
If you don't use cephadm, you can safely set 'ceph mon set auth_service_cipher aes256k' because it really does only affect the core services, otherwise I'd have a problem. ;-) I upgraded our production (cephadm) cluster this week and all went well. We also can't upgrade our clients at this time, so we're all in the same boat, I guess. :-)
Regards, Eugen
Zitat von Christopher Durham <ceph-users@ceph.io>:
Hi: After update to 19.2.6 I am so far successfully updating key types for various daemons. I have the following messages in the output of 'ceph health detail':
[WRN] AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE: 4 rotating auth service keys using insecure key types rotating service keys for mon using insecure key type: aes rotating service keys for mds using insecure key type: aes rotating service keys for osd using insecure key type: aes rotating service keys for mgr using insecure key type: aes The doc says to set auth_service_cipher to aes256k. Before I change that, I have a question: Is this setting ONLY for mon/mds/osd/mgr? I ask because i have several client keys that cannot be updated to aes256k yet, such as the keys for ceph-csi in kubernetes. I want to be sure that if update auth_service_cipher to aes256k, I am ONLY affecting the rotating keys for mon/mds/osd/mgr. I do not want to set auth_service_cipher to aes256k and then have the ceph-csi still able to authenticate with older aes keys but not able to do rotating keys after authentication ( I do not know if it does ).. Thanks for any information -Chris
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io