SUSE Enterprise Storage 6
The cluster health status (for example "ceph -s" output
) shows the following warning, excerpt: ...
mons are allowing insecure global_id reclaim
Until all clients have been patched with the current latest Ceph version, the warning should simply be silenced for now using:
ceph config set mon mon_warn_on_insecure_global_id_reclaim false
ceph config set mon mon_warn_on_insecure_global_id_reclaim_allowed false
Once it is verified that all clients are updated, re-enable the warnings and disable the setting to not allow insecure global_id reclaim by executing the following command:
ceph config set mon mon_warn_on_insecure_global_id_reclaim true
ceph config set mon mon_warn_on_insecure_global_id_reclaim_allowed true
ceph config set mon auth_allow_insecure_global_id_reclaim false
IMPORTANT: Do NOT enable / allow insecure_global_id_reclaim until it is sure that ALL clients have been patched to the latest version, this includes kernel clients via the "ceph-common" package.
Also see the additional information section.
With the release of Ceph 14.2.20 a security vulnerability is addressed in the Ceph authentication framework, resulting in the new warning to be seen once a cluster is patched.
If the reclaim is enabled and all clients are not patched, this will result in the non patched clients being unable to access the cluster anymore. If this is the case messages similar to the following will be logged in the MON log files:
2021-05-06 10:04:54.460 7fc595c5b700 0 cephx server client.<client_name>: attempt to reclaim global_id xxxxxxx without presenting ticket
2021-05-06 10:04:54.460 7fc595c5b700 0 cephx server client.<client_name>: could not verify old ticket
Currently updated "ceph-common" packages are not available for all clients, for example SLES12 SP5 clients. In such cases the only option for now is to disable the warnings.
Also see: https://ceph.io/releases/v14-2-20-nautilus-released/
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.