22 Dec
2023
22 Dec
'23
4:58 p.m.
Hello,
I would like to share a quite worrying experience I’ve just found on one of my production
clusters.
User successfully created a bucket with name of a bucket that already exists!
He is not bucket owner - the original user is, but he is able to see it when he does
ListBuckets over s3 api. (Both accounts are able to do it now - only the original owner is
able to interact with it)
This bucket is also counted to the new users usage stats.
Has anyone noticed this before? This cluster is running on Quincy - 17.2.6.
Is there a way to detach the bucket from the new owner so he doesn’t have a bucket that
doesn’t belong to him?
Regards,
Ondrej
24 Dec
24 Dec
7:14 p.m.
Hi Ondřej,
I've not tried it myself, but see if you can use *# radosgw-admin bucket
unlink* [1] command to achieve it. It is strange that the user was somehow
able to create the bucket with the same name. We've also got v17.2.6 and
have not encountered this so far. Maybe devs from RGW can answer this.
[1] https://docs.ceph.com/en/quincy/man/8/radosgw-admin/#commands
Thanks,
Jayanth
On Fri, Dec 22, 2023 at 7:29 PM Ondřej Kukla <ondrej(a)kuuk.la> wrote:
Hello,
I would like to share a quite worrying experience I’ve just found on one
of my production clusters.
User successfully created a bucket with name of a bucket that already
exists!
He is not bucket owner - the original user is, but he is able to see it
when he does ListBuckets over s3 api. (Both accounts are able to do it now
- only the original owner is able to interact with it)
This bucket is also counted to the new users usage stats.
Has anyone noticed this before? This cluster is running on Quincy - 17.2.6.
Is there a way to detach the bucket from the new owner so he doesn’t have
a bucket that doesn’t belong to him?
Regards,
Ondrej
_______________________________________________
ceph-users mailing list -- ceph-users(a)ceph.io
To unsubscribe send an email to ceph-users-leave(a)ceph.io
12 Jan
12 Jan
1:49 p.m.
Thanks Jayanth,
I’ve tried this but unfortunately the unlink fails as the it checks against the bucket
owner id which is not the user I’m trying to unlink.
So I’m still stuck here with two users with same bucket name :(
Ondrej
On 24. 12. 2023, at 17:14, Jayanth Reddy
<jayanthreddy5666(a)gmail.com> wrote:
Hi Ondřej,
I've not tried it myself, but see if you can use # radosgw-admin bucket unlink [1]
command to achieve it. It is strange that the user was somehow able to create the bucket
with the same name. We've also got v17.2.6 and have not encountered this so far. Maybe
devs from RGW can answer this.
[1] https://docs.ceph.com/en/quincy/man/8/radosgw-admin/#commands
Thanks,
Jayanth
On Fri, Dec 22, 2023 at 7:29 PM Ondřej Kukla <ondrej(a)kuuk.la
<mailto:ondrej@kuuk.la>> wrote:
> Hello,
>
> I would like to share a quite worrying experience I’ve just found on one of my
production clusters.
>
> User successfully created a bucket with name of a bucket that already exists!
>
> He is not bucket owner - the original user is, but he is able to see it when he does
ListBuckets over s3 api. (Both accounts are able to do it now - only the original owner is
able to interact with it)
>
> This bucket is also counted to the new users usage stats.
>
> Has anyone noticed this before? This cluster is running on Quincy - 17.2.6.
>
> Is there a way to detach the bucket from the new owner so he doesn’t have a bucket
that doesn’t belong to him?
>
> Regards,
>
> Ondrej
>
>
>
> _______________________________________________
> ceph-users mailing list -- ceph-users(a)ceph.io <mailto:ceph-users@ceph.io>
> To unsubscribe send an email to ceph-users-leave(a)ceph.io
<mailto:ceph-users-leave@ceph.io>
15 Jan
15 Jan
8:41 a.m.
Hello Ondrej,
Does renaming the bucket help? I see the command [1] takes the UID.
How about you take the maintenance window from your both of the users and try renaming
usernames or bucket names to see if either helps?
[1] https://www.ibm.com/docs/en/storage-ceph/7?topic=management-renaming-buckets
Regards,
Jayanth
________________________________
From: Ondřej Kukla <ondrej(a)kuuk.la>
Sent: Friday, January 12, 2024 4:19:32 PM
To: Jayanth Reddy <jayanthreddy5666(a)gmail.com>
Cc: ceph-users(a)ceph.io <ceph-users(a)ceph.io>
Subject: Re: [ceph-users] RGW - user created bucket with name of already created bucket
Thanks Jayanth,
I’ve tried this but unfortunately the unlink fails as the it checks against the bucket
owner id which is not the user I’m trying to unlink.
So I’m still stuck here with two users with same bucket name :(
Ondrej
On 24. 12. 2023, at 17:14, Jayanth Reddy <jayanthreddy5666(a)gmail.com> wrote:
Hi Ondřej,
I've not tried it myself, but see if you can use # radosgw-admin bucket unlink [1]
command to achieve it. It is strange that the user was somehow able to create the bucket
with the same name. We've also got v17.2.6 and have not encountered this so far. Maybe
devs from RGW can answer this.
[1] https://docs.ceph.com/en/quincy/man/8/radosgw-admin/#commands
Thanks,
Jayanth
On Fri, Dec 22, 2023 at 7:29 PM Ondřej Kukla
<ondrej@kuuk.la<mailto:ondrej@kuuk.la>> wrote:
Hello,
I would like to share a quite worrying experience I’ve just found on one of my production
clusters.
User successfully created a bucket with name of a bucket that already exists!
He is not bucket owner - the original user is, but he is able to see it when he does
ListBuckets over s3 api. (Both accounts are able to do it now - only the original owner is
able to interact with it)
This bucket is also counted to the new users usage stats.
Has anyone noticed this before? This cluster is running on Quincy - 17.2.6.
Is there a way to detach the bucket from the new owner so he doesn’t have a bucket that
doesn’t belong to him?
Regards,
Ondrej
_______________________________________________
ceph-users mailing list -- ceph-users@ceph.io<mailto:ceph-users@ceph.io>
To unsubscribe send an email to
ceph-users-leave@ceph.io<mailto:ceph-users-leave@ceph.io>
126
days inactive
150
days old
3 comments
2 participants
participants (2)
-
Jayanth Reddy -
Ondřej Kukla