Cephx configuration options

The following are Cephx configuration options that can be set up during deployment.

auth_cluster_required

Description
Valid settings are cephx or none.

Type
String

Required
No

Default
cephx.

auth_service_required

Description
Valid settings are cephx or none.

Type
String

Required
No

Default
cephx.

auth_client_required

Description
If enabled, the IBM Storage Ceph cluster daemons require Ceph clients to authenticate with the IBM Storage Ceph cluster in order to access Ceph services. Valid settings are cephx or none.

Type
String

Required
No

Default
cephx.

keyring

Description
The path to the keyring file.

Type
String

Required
No

Default
/etc/ceph/$cluster.$name.keyring, /etc/ceph/$cluster.keyring, /etc/ceph/keyring, /etc/ceph/keyring.bin

keyfile

Description
The path to a key file (that is. a file containing only the key).

Type
String

Required
No

Default
None

key

Description
The key (that is, the text string of the key itself). Not recommended.

Type
String

Required
No

Default
None

ceph-mon

Location
$mon_data/keyring

Capabilities
mon 'allow *'

ceph-osd

Location
$osd_data/keyring

Capabilities
mon 'allow profile osd' osd 'allow *'

radosgw

Location
$rgw_data/keyring

Capabilities
mon 'allow rwx' osd 'allow rwx'

cephx_require_signatures

Description
If set to true, Ceph requires signatures on all message traffic between the Ceph client and the IBM Storage Ceph cluster, and between daemons comprising the IBM Storage Ceph cluster.

Type
Boolean

Required
No

Default
false

cephx_cluster_require_signatures

Description
If set to true, Ceph requires signatures on all message traffic between Ceph daemons comprising the IBM Storage Ceph cluster.

Type
Boolean

Required
No

Default
false

cephx_service_require_signatures

Description
If set to true, Ceph requires signatures on all message traffic between Ceph clients and the IBM Storage Ceph cluster.

Type
Boolean

Required
No

Default
false

cephx_sign_messages

Description
If the Ceph version supports message signing, Ceph will sign all messages so they cannot be spoofed.

Type
Boolean

Default
true

auth_service_ticket_ttl

Description
When the IBM Storage Ceph cluster sends a Ceph client a ticket for authentication, the cluster assigns the ticket a time to live.

Type
Double

Default
60*60