Hi, I was trying to use the mon_auth_emergency_allowed_ciphers setting to rescue a test cluster as described in the docs [0]. It's a cephadm managed cluster where I set auth_allowed_ciphers to aes256k before rotating the admin keyring. Then I added mon_auth_emergency_allowed_ciphers = true to all mon's config files: reef1:~ # vi /var/lib/ceph/{FSID}/mon.reef1/config and restarted the mon services. According to the config dump the setting is active (for all 3 daemons): [ceph: root@reef2 /]# ceph daemon mon.reef2 config show | grep cipher "mon_auth_emergency_allowed_ciphers": "true", The daemon logs this during startup but I'm not sure if it's relevant right now: Sep 11 10:25:08 reef2 ceph-{FSID}-mon-reef2[88175]: 2026-09-11T08:25:08.611+0000 7f0a8765bd80 -1 mon.reef2@-1(???) e6 init: invalid cipher: true I can't use the unrotated admin keyring although the docs state that I should be able to:
This will allow your existing client.admin or other administrative key to authenticate as normal.
What am I missing? Thanks. Eugen [0] https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
Hi Eugen I read that as meaning that you should set it to the list of emergency ciphers to use, e.g aes. That's reinforced by its type being str not bool. I haven't tried it though. Regards, Chris On 11/09/2026 09:54, Eugen Block wrote:
Hi,
I was trying to use the mon_auth_emergency_allowed_ciphers setting to rescue a test cluster as described in the docs [0].
It's a cephadm managed cluster where I set auth_allowed_ciphers to aes256k before rotating the admin keyring.
Then I added mon_auth_emergency_allowed_ciphers = true to all mon's config files:
reef1:~ # vi /var/lib/ceph/{FSID}/mon.reef1/config
and restarted the mon services. According to the config dump the setting is active (for all 3 daemons):
[ceph: root@reef2 /]# ceph daemon mon.reef2 config show | grep cipher "mon_auth_emergency_allowed_ciphers": "true",
The daemon logs this during startup but I'm not sure if it's relevant right now:
Sep 11 10:25:08 reef2 ceph-{FSID}-mon-reef2[88175]: 2026-09-11T08:25:08.611+0000 7f0a8765bd80 -1 mon.reef2@-1(???) e6 init: invalid cipher: true
I can't use the unrotated admin keyring although the docs state that I should be able to:
This will allow your existing client.admin or other administrative key to authenticate as normal.
What am I missing?
Thanks. Eugen
[0] https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Hi, that did the trick! I should have read more carefully that it's a string, not a boolean. :-D Thank you very much! Eugen Zitat von Chris Palmer <chris.palmer@idnet.com>:
Hi Eugen
I read that as meaning that you should set it to the list of emergency ciphers to use, e.g aes. That's reinforced by its type being str not bool. I haven't tried it though.
Regards, Chris
On 11/09/2026 09:54, Eugen Block wrote:
Hi,
I was trying to use the mon_auth_emergency_allowed_ciphers setting to rescue a test cluster as described in the docs [0].
It's a cephadm managed cluster where I set auth_allowed_ciphers to aes256k before rotating the admin keyring.
Then I added mon_auth_emergency_allowed_ciphers = true to all mon's config files:
reef1:~ # vi /var/lib/ceph/{FSID}/mon.reef1/config
and restarted the mon services. According to the config dump the setting is active (for all 3 daemons):
[ceph: root@reef2 /]# ceph daemon mon.reef2 config show | grep cipher "mon_auth_emergency_allowed_ciphers": "true",
The daemon logs this during startup but I'm not sure if it's relevant right now:
Sep 11 10:25:08 reef2 ceph-{FSID}-mon-reef2[88175]: 2026-09-11T08:25:08.611+0000 7f0a8765bd80 -1 mon.reef2@-1(???) e6 init: invalid cipher: true
I can't use the unrotated admin keyring although the docs state that I should be able to:
This will allow your existing client.admin or other administrative key to authenticate as normal.
What am I missing?
Thanks. Eugen
[0] https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Thanks for the feedback. Documentation fix here: https://github.com/ceph/ceph/pull/71724 Patrick On Fri, Sep 11, 2026 at 5:55 AM Eugen Block <ceph-users@ceph.io> wrote:
Hi,
that did the trick! I should have read more carefully that it's a string, not a boolean. :-D
Thank you very much! Eugen
Zitat von Chris Palmer <chris.palmer@idnet.com>:
Hi Eugen
I read that as meaning that you should set it to the list of emergency ciphers to use, e.g aes. That's reinforced by its type being str not bool. I haven't tried it though.
Regards, Chris
On 11/09/2026 09:54, Eugen Block wrote:
Hi,
I was trying to use the mon_auth_emergency_allowed_ciphers setting to rescue a test cluster as described in the docs [0].
It's a cephadm managed cluster where I set auth_allowed_ciphers to aes256k before rotating the admin keyring.
Then I added mon_auth_emergency_allowed_ciphers = true to all mon's config files:
reef1:~ # vi /var/lib/ceph/{FSID}/mon.reef1/config
and restarted the mon services. According to the config dump the setting is active (for all 3 daemons):
[ceph: root@reef2 /]# ceph daemon mon.reef2 config show | grep cipher "mon_auth_emergency_allowed_ciphers": "true",
The daemon logs this during startup but I'm not sure if it's relevant right now:
Sep 11 10:25:08 reef2 ceph-{FSID}-mon-reef2[88175]: 2026-09-11T08:25:08.611+0000 7f0a8765bd80 -1 mon.reef2@-1(???) e6 init: invalid cipher: true
I can't use the unrotated admin keyring although the docs state that I should be able to:
This will allow your existing client.admin or other administrative key to authenticate as normal.
What am I missing?
Thanks. Eugen
[0] https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
-- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D
Thanks a lot for picking that up so quickly. I appreciate it! Zitat von Patrick Donnelly <pdonnell@redhat.com>:
Thanks for the feedback. Documentation fix here:
https://github.com/ceph/ceph/pull/71724
Patrick
On Fri, Sep 11, 2026 at 5:55 AM Eugen Block <ceph-users@ceph.io> wrote:
Hi,
that did the trick! I should have read more carefully that it's a string, not a boolean. :-D
Thank you very much! Eugen
Zitat von Chris Palmer <chris.palmer@idnet.com>:
Hi Eugen
I read that as meaning that you should set it to the list of emergency ciphers to use, e.g aes. That's reinforced by its type being str not bool. I haven't tried it though.
Regards, Chris
On 11/09/2026 09:54, Eugen Block wrote:
Hi,
I was trying to use the mon_auth_emergency_allowed_ciphers setting to rescue a test cluster as described in the docs [0].
It's a cephadm managed cluster where I set auth_allowed_ciphers to aes256k before rotating the admin keyring.
Then I added mon_auth_emergency_allowed_ciphers = true to all mon's config files:
reef1:~ # vi /var/lib/ceph/{FSID}/mon.reef1/config
and restarted the mon services. According to the config dump the setting is active (for all 3 daemons):
[ceph: root@reef2 /]# ceph daemon mon.reef2 config show | grep cipher "mon_auth_emergency_allowed_ciphers": "true",
The daemon logs this during startup but I'm not sure if it's relevant right now:
Sep 11 10:25:08 reef2 ceph-{FSID}-mon-reef2[88175]: 2026-09-11T08:25:08.611+0000 7f0a8765bd80 -1 mon.reef2@-1(???) e6 init: invalid cipher: true
I can't use the unrotated admin keyring although the docs state that I should be able to:
This will allow your existing client.admin or other administrative key to authenticate as normal.
What am I missing?
Thanks. Eugen
[0]
https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht...
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
-- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D
participants (3)
-
Chris Palmer
-
Eugen Block
-
Patrick Donnelly