Re: [Ceph-community] Need help related to ceph client authentication

[David Turner <drakonstein@xxxxxxxxx>]

The Ceph-users ML is the correct list to ask questions like this.  Did you figure out the problems/questions you had?

On Tue, Dec 4, 2018 at 11:39 PM Rishabh S <talktorishabh18@xxxxxxxxx> wrote:

Hi Gaurav,

Thank You.

Yes, I am using boto, though I was looking for suggestions on how my ceph client should get access and secret keys.

Another thing where I need help is regarding encryption 

http://docs.ceph.com/docs/mimic/radosgw/encryption/#

I am little confused what does these statement means.

The Ceph Object Gateway supports server-side encryption of uploaded objects, with 3 options for the management of encryption keys. Server-side encryption means that the data is sent over HTTP in its unencrypted form, and the Ceph Object Gateway stores that data in the Ceph Storage Cluster in encrypted form.

Note

 

Requests for server-side encryption must be sent over a secure HTTPS connection to avoid sending secrets in plaintext. 

CUSTOMER-PROVIDED KEYS

In this mode, the client passes an encryption key along with each request to read or write encrypted data. It is the client’s responsibility to manage those keys and remember which key was used to encrypt each object.

My understanding is when ceph client is trying to upload a file/object to Ceph cluster then client request should be https and will include  “customer-provided-key”.

Then Ceph will use customer-provided-key to encrypt file/object before storing data into Ceph cluster.

Please correct and suggest best approach to store files/object in Ceph cluster.

Any code example of initial handshake to upload a file/object with encryption-key will be of great help.

Regards,

Rishabh

 

On 05-Dec-2018, at 2:15 AM, Gaurav Sitlani <sitlanigaurav7@xxxxxxxxx> wrote:

Hi Rishabh,

You can refer the ceph RGW doc and search for boto : http://docs.ceph.com/docs/master/install/install-ceph-gateway/?highlight=boto

You can get a basic python boto script where you can mention your access and secret key and connect to your S3 cluster.

I hope you know how to get your keys right.

Regards,

Gaurav Sitlani

_______________________________________________
Ceph-community mailing list
Ceph-community@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-community-ceph.com

_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com