Accidentally removed client.admin caps - fix via mon doesn't work
Hello Guys, Unfortunately, I''ve deleted some caps from client.admin and tried the following solution so set them back: http://lists.ceph.com/pipermail/ceph-users-ceph.com/2017-January/015474.html I’ve tried the following: # ssh’d to a mon node and changed dir to the mon directory cd /var/lib/ceph/mon/<monname> # tried to authenticate with the monitor keyring and set the client.admin caps to give back full permissions ceph -n mon.<monid> --keyring keyring auth caps client.admin mds 'allow *' osd 'allow *' mon 'allow *' When i try to modify the client.admin caps, the command just hangs at the shell until i press ctrl-c, which gets aknowledged with "Cluster connection aborted” Also i can’t see the the connection in the ceph.audit.log Do i make a mistake here or is this "workaround" not supported anymore in nautilus (14.2.6)? Regards
There's only one mon keyring that's shared by all mons, the mon user therefore doesn't contain the mon name. Try "-n mon." Paul -- Paul Emmerich Looking for help with your Ceph cluster? Contact us at https://croit.io croit GmbH Freseniusstr. 31h 81247 München www.croit.io Tel: +49 89 1896585 90 On Mon, Mar 9, 2020 at 10:35 AM <wittler@appvisory.com> wrote:
Hello Guys,
Unfortunately, I''ve deleted some caps from client.admin and tried the following solution so set them back: http://lists.ceph.com/pipermail/ceph-users-ceph.com/2017-January/015474.html
I’ve tried the following:
# ssh’d to a mon node and changed dir to the mon directory cd /var/lib/ceph/mon/<monname>
# tried to authenticate with the monitor keyring and set the client.admin caps to give back full permissions ceph -n mon.<monid> --keyring keyring auth caps client.admin mds 'allow *' osd 'allow *' mon 'allow *'
When i try to modify the client.admin caps, the command just hangs at the shell until i press ctrl-c, which gets aknowledged with "Cluster connection aborted” Also i can’t see the the connection in the ceph.audit.log
Do i make a mistake here or is this "workaround" not supported anymore in nautilus (14.2.6)?
Regards _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Paul Emmerich wrote:
There's only one mon keyring that's shared by all mons, the mon user therefore doesn't contain the mon name.
Try "-n mon."
Hi Paul, Thanks for the clarification regarding the mon key. Unfortunately, with "-n mon." i get the same result: Shell hanging and "Cluster connection aborted" when i press ctrl-c
I resolved this Issue by copying the mon Keyring to a Non-Monitor Node. From there the command worked and i have my Admin Caps back. Thanks again for your Support, Paul
This indicates that there's something wrong with the config on that mon node. The command should work on any Ceph node that has the keyring. You should check ceph.conf on the monitor node, maybe there's some kind of misconfiguration that might cause other problems in the future. Paul -- Paul Emmerich Looking for help with your Ceph cluster? Contact us at https://croit.io croit GmbH Freseniusstr. 31h 81247 München www.croit.io Tel: +49 89 1896585 90 On Wed, Mar 11, 2020 at 10:46 AM Julian Wittler <wittler@appvisory.com> wrote:
I resolved this Issue by copying the mon Keyring to a Non-Monitor Node. From there the command worked and i have my Admin Caps back. Thanks again for your Support, Paul _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
participants (3)
-
Julian Wittler
-
Paul Emmerich
-
wittler＠appvisory.com