Hi, that did the trick! I should have read more carefully that it's a string, not a boolean. :-D Thank you very much! Eugen Zitat von Chris Palmer <chris.palmer@idnet.com>:
Hi Eugen
I read that as meaning that you should set it to the list of emergency ciphers to use, e.g aes. That's reinforced by its type being str not bool. I haven't tried it though.
Regards, Chris
On 11/09/2026 09:54, Eugen Block wrote:
Hi,
I was trying to use the mon_auth_emergency_allowed_ciphers setting to rescue a test cluster as described in the docs [0].
It's a cephadm managed cluster where I set auth_allowed_ciphers to aes256k before rotating the admin keyring.
Then I added mon_auth_emergency_allowed_ciphers = true to all mon's config files:
reef1:~ # vi /var/lib/ceph/{FSID}/mon.reef1/config
and restarted the mon services. According to the config dump the setting is active (for all 3 daemons):
[ceph: root@reef2 /]# ceph daemon mon.reef2 config show | grep cipher "mon_auth_emergency_allowed_ciphers": "true",
The daemon logs this during startup but I'm not sure if it's relevant right now:
Sep 11 10:25:08 reef2 ceph-{FSID}-mon-reef2[88175]: 2026-09-11T08:25:08.611+0000 7f0a8765bd80 -1 mon.reef2@-1(???) e6 init: invalid cipher: true
I can't use the unrotated admin keyring although the docs state that I should be able to:
This will allow your existing client.admin or other administrative key to authenticate as normal.
What am I missing?
Thanks. Eugen
[0] https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io