cauthtool
is a utility to create, view, and modify a Ceph keyring file. A keyring
file stores one or more Ceph authentication keys and possibly an
associated capability specification. Each key is associated with an
entity name, of the form {client,mon,mds,osd}.name.
OPTIONS
-l, --list
will list all keys and capabilities present in the keyring.
-p, --print
will print an encoded key for the specified entityname. This is suitable for the mount -o secret= argument.
-c, --create-keyring
will create a new keyring, overwriting any existing keyringfile.
--gen-key
will generate a new secret key for the specified entityname:
--add-key
will add an encoded key to the keyring.
--cap subsystem capability
will set the capability for given subsystem.
--caps capsfile
will set all of capabilities associated with a given key, for all subsystems.
CAPABILITIES
The subsystem is the name of a Ceph subsystem: mon, mds, or osd.
The capability is a string describing what the given user is
allowed to do. This takes the form of a comma separated list of
allow, deny clauses with a permission specifier containing one or more
of rwx for read, write, and execute permission. The "allow *" grants
full superuser permissions for the given subsystem.
For example,
osd = "allow rwx [pool=foo[,bar]]|[uid=baz[,bay]]" # can read, write, and execute objects
mds = "allow" # can access mds server
mon = "allow rwx" # can modify cluster state (i.e., is a server daemon)
A librados user restricted to a single pool might look like
osd = "allow rw pool foo"
A client mounting the file system with minimal permissions would need caps like
mds = "allow"
osd = "allow rw pool=data"
mon = "allow r"
CAPS FILE FORMAT
The caps file format consists of zero or more key/value pairs, one per line. The key and value are separated by an '=', and the value must be quoted (with ' or ") if it contains any whitespace. The key is the name of the Ceph
subsystem (osd, mds, mon), and the value is the capability string (see above).
EXAMPLE
To create a new keyring containing a key for client.foo:
cauthtool -c -n client.foo --gen-key keyring.bin
To associate some capabilities with the key (namely, the ability to mount a Ceph filesystem):