Cephx configuration options

Understand the various Cephx configuration options that can be set up during deployment.

auth_cluster_required

Description: Valid settings are cephx or none.

Type: String

Required: No

Default: cephx.

auth_service_required

Description: Valid settings are cephx or none.

Type: String

Required: No

Default: cephx.

auth_client_required

Description: If enabled, the IBM Storage Ceph cluster daemons require Ceph clients to authenticate with the IBM Storage Ceph cluster in order to access Ceph services. Valid settings are cephx or none.

Type: String

Required: No

Default: cephx.

keyring

Description: The path to the keyring file.

Type: String

Required: No

Default: /etc/ceph/$cluster.$name.keyring, /etc/ceph/$cluster.keyring, /etc/ceph/keyring, /etc/ceph/keyring.bin

keyfile

Description: The path to a key file (that is. a file containing only the key).

Type: String

Required: No

Default: None

key

Description: The key (that is, the text string of the key itself). Not recommended.

Type: String

Required: No

Default: None

ceph-mon

Location: $mon_data/keyring

Capabilities: mon 'allow *'

ceph-osd

Location: $osd_data/keyring

Capabilities: mon 'allow profile osd' osd 'allow *'

radosgw

Location: $rgw_data/keyring

Capabilities: mon 'allow rwx' osd 'allow rwx'

cephx_require_signatures

Description: If set to true, Ceph requires signatures on all message traffic between the Ceph client and the IBM Storage Ceph cluster, and between daemons comprising the IBM Storage Ceph cluster.

Type: Boolean

Required: No

Default: false

cephx_cluster_require_signatures

Description: If set to true, Ceph requires signatures on all message traffic between Ceph daemons comprising the IBM Storage Ceph cluster.

Type: Boolean

Required: No

Default: false

cephx_service_require_signatures

Description: If set to true, Ceph requires signatures on all message traffic between Ceph clients and the IBM Storage Ceph cluster.

Type: Boolean

Required: No

Default: false

cephx_sign_messages

Description: If the Ceph version supports message signing, Ceph will sign all messages so they cannot be spoofed.

Type: Boolean

Default: true

auth_service_ticket_ttl

Description: When the IBM Storage Ceph cluster sends a Ceph client a ticket for authentication, the cluster assigns the ticket a time to live.

Type: Double

Default: 60*60