Is there a command to update a client with a new generated key?
Is there a command to update a client with a new generated key? Something like: ceph auth new-key client.rbd Could be usefull if you accidentaly did a ceph auth ls, because that still displays keys ;)
I played with ceph-authtool and this seems to work: host1:/etc/ceph # ceph-authtool ceph.client.user1.keyring -g -n client.user1 --cap mon "allow r" --cap mds "allow rw path=/dir1" --cap osd "allow rw tag cephfs data=cephfs" where "ceph.client.user1.keyring" is obviously the client's keyring file. host1:/etc/ceph # sdiff ceph.client.user1.keyring.old ceph.client.user1.keyring [client.user1] [client.user1] key = AQDd03Vf0moFLxAA1TPKfbAsxi+JLxju9+GP6w== | key = AQBEZuBfd5trDxAA2vxhcZARbOix5+Hnln8ZMQ== caps mds = "allow rw path=/dir1" caps mds = "allow rw path=/dir1" caps mon = "allow r" caps mon = "allow r" caps osd = "allow rw tag cephfs data=cephfs" caps osd = "allow rw tag cephfs data=cephfs" Then I import the new keyring file: host1:/etc/ceph # ceph auth import -i ceph.client.user1.keyring imported keyring Using the old key doesn't work anymore: host1:/etc/ceph # mount -t ceph mon1:/dir1 /mnt -o name=user1,secret=AQDd03Vf0moFLxAA1TPKfbAsxi+JLxju9+GP6w== mount error: no mds server is up or the cluster is laggy But the new key works: host1:/etc/ceph # mount -t ceph mon1:/dir1 /mnt -o name=user1,secret=AQBEZuBfd5trDxAA2vxhcZARbOix5+Hnln8ZMQ== host1:/etc/ceph # touch /mnt/file2 host1:/etc/ceph # ls -l /mnt/ insgesamt 0 -rw-r--r-- 1 root root 0 21. Dez 10:14 file2 Zitat von Marc Roos <M.Roos@f1-outsourcing.eu>:
Is there a command to update a client with a new generated key? Something like:
ceph auth new-key client.rbd
Could be usefull if you accidentaly did a ceph auth ls, because that still displays keys ;) _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Pffff, I guess it is time to create issue feature request for 'ceph auth new-key <entity>' -----Original Message----- From: Eugen Block [mailto:eblock@nde.ag] Sent: 21 December 2020 10:20 To: ceph-users@ceph.io Subject: [ceph-users] Re: Is there a command to update a client with a new generated key? I played with ceph-authtool and this seems to work: host1:/etc/ceph # ceph-authtool ceph.client.user1.keyring -g -n client.user1 --cap mon "allow r" --cap mds "allow rw path=/dir1" --cap osd "allow rw tag cephfs data=cephfs" where "ceph.client.user1.keyring" is obviously the client's keyring file. host1:/etc/ceph # sdiff ceph.client.user1.keyring.old ceph.client.user1.keyring [client.user1] [client.user1] key = AQDd03Vf0moFLxAA1TPKfbAsxi+JLxju9+GP6w== | key = AQBEZuBfd5trDxAA2vxhcZARbOix5+Hnln8ZMQ== caps mds = "allow rw path=/dir1" caps mds = "allow rw path=/dir1" caps mon = "allow r" caps mon = "allow r" caps osd = "allow rw tag cephfs data=cephfs" caps osd = "allow rw tag cephfs data=cephfs" Then I import the new keyring file: host1:/etc/ceph # ceph auth import -i ceph.client.user1.keyring imported keyring Using the old key doesn't work anymore: host1:/etc/ceph # mount -t ceph mon1:/dir1 /mnt -o name=user1,secret=AQDd03Vf0moFLxAA1TPKfbAsxi+JLxju9+GP6w== mount error: no mds server is up or the cluster is laggy But the new key works: host1:/etc/ceph # mount -t ceph mon1:/dir1 /mnt -o name=user1,secret=AQBEZuBfd5trDxAA2vxhcZARbOix5+Hnln8ZMQ== host1:/etc/ceph # touch /mnt/file2 host1:/etc/ceph # ls -l /mnt/ insgesamt 0 -rw-r--r-- 1 root root 0 21. Dez 10:14 file2 Zitat von Marc Roos <M.Roos@f1-outsourcing.eu>:
Is there a command to update a client with a new generated key? Something like:
ceph auth new-key client.rbd
Could be usefull if you accidentaly did a ceph auth ls, because that still displays keys ;) _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
participants (2)
-
Eugen Block
-
Marc Roos