This is great - had no idea you could have this level of control with
Ceph authentication.
On Wed, Feb 1, 2017 at 12:29 PM, John Spray <jspray@xxxxxxxxxx> wrote:
> On Wed, Feb 1, 2017 at 8:55 AM, Michael Hartz <michael.hartz@xxxxxxxxxx> wrote:
>> I am running ceph as part of a Proxmox Virtualization cluster, which is doing great.
>>
>> However for monitoring purpose I would like to periodically check with 'ceph health' as a non-root user.
>> This fails with the following message:
>>> su -c 'ceph health' -s /bin/bash nagios
>> Error initializing cluster client: PermissionDeniedError('error calling conf_read_file',)
>>
>> Please note: running the command as root user works as intended.
>>
>> Someone else suggested to allow group permissions on the admin keyring, i.e. chmod 660 /etc/ceph/ceph.client.admin.keyring
>> Link: https://github.com/thelan/ceph-zabbix/issues/12
>> This didn't work.
>
> Nobody should ever need to give their unprivileged users sudo access
> to the ceph CLI or access to the the ceph admin key, just to run the
> status command.
>
> Ceph's own authentication system has fine grained control over
> execution of mon commands. You can create a special user that can
> only run the status command like this:
> ceph auth get-or-create client.status mon 'allow command "status"' >
> ./status.keyring
>
> ...and then invoke status as that user like this:
> ceph --name client.status --keyring ./status.keyring status
>
> You can then make sure your unprivileged user has read access to
> status.keyring and to ceph.conf (or give it its own copy of
> ceph.conf).
>
> John
>
>
>>
>> Has anyone hints on this?
>> _______________________________________________
>> ceph-users mailing list
>> ceph-users@xxxxxxxxxxxxxx
>> http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
> _______________________________________________
> ceph-users mailing list
> ceph-users@xxxxxxxxxxxxxx
> http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
