Hi, you can disable the old cipher by setting auth_allowed_ciphers to aes256k only: ceph mon set auth_allowed_ciphers aes256k See step 10 in the docs: https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.ht... Regards, Eugen Zitat von "GLE, Vivien" <ceph-users@ceph.io>:

Hi,

I just upgrade (from tentacle 20.2.1 to 20.2.4) and rolled CephX keys for a Cephadm cluster but there is still an error concerning the use of insecure keys

#ceph config get mon mon_auth_allow_insecure_key false

#ceph health detail

HEALTH_WARN Monitors are configured to allow auth using insecure key types [WRN] AUTH_INSECURE_KEYS_ALLOWED: Monitors are configured to allow auth using insecure key types insecure cipher aes allowed for auth

Didn't found any keys named like this in the ceph configuration but in the ceph mon dump

#ceph mon dump

auth_epoch 0 auth_service_cipher aes256k auth_allowed_ciphers aes, aes256k <= = auth_preferred_cipher aes256k dumped monmap epoch 15

Is the only way to get rid of this error is to manipulate the mon map ? How can I do it safely ?

Thanks

_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io