cauthtool(8)

1CAUTHTOOL(8)                System Manager's Manual               CAUTHTOOL(8)
2
3
4

NAME

6       cauthtool - ceph keyring manipulation tool
7

SYNOPSIS

9       cauthtool  keyringfile [ -l | --list ] [ -c | --create-keyring ] [ -p |
10       --print ] [ -n | --name entityname ] [ --gen-key ]  [  -a  |  --add-key
11       base64_key ] [ --caps capfils ]
12

DESCRIPTION

14       cauthtool is a utility to create, view, and modify a Ceph keyring file.
15       A keyring file stores one or more Ceph authentication keys and possibly
16       an associated capability specification.  Each key is associated with an
17       entity name, of the form {client,mon,mds,osd}.name.
18

OPTIONS

20       -l, --list
21              will list all keys and capabilities present in the keyring.
22
23       -p, --print
24              will print an encoded key for the specified entityname.  This is
25              suitable for the mount -o secret= argument.
26
27       -c, --create-keyring
28              will create a new keyring, overwriting any existing keyringfile.
29
30       --gen-key
31              will generate a new secret key for the specified entityname:
32
33       --add-key
34              will add an encoded key to the keyring.
35
36       --caps capsfile
37              will set the capabilities associated with a given key.
38

CAPS FILE FORMAT

40       The caps file format consists of zero or more key/value pairs.  The key
41       is the name of the Ceph subsystem (osd, mds,  mon).   The  value  is  a
42       comma separated list of allow, deny clauses with a permission specifier
43       containing one or more of rwx, for read, write, and execute permission.
44       If  you  want to declare the key an administrator (with full privileges
45       on everything), use the shorthand 'subsystem = "allow *"'. For example,
46
47              osd = "allow rwx [pool=foo[,bar]]|[uid=baz[,bay]]"  # can  read,
48              write, and execute objects
49
50              mds = "allow"      # can access mds server
51
52              mon = "allow rwx"  # can modify cluster state (i.e., is a server
53              daemon)
54
55       A librados user restricted to a single pool might look like
56
57              osd = "allow rw pool foo"
58
59       A client mounting the file system with minimal permissions  would  need
60       caps like
61
62              mds = "allow"
63
64              osd = "allow rw; allow rw pool = data_pool_num"
65
66              mon = "allow r"
67

EXAMPLE

69       To create a new keyring containing a key for client.foo:
70
71              cauthtool -c -n client.foo --gen-key keyring.bin
72
73       To associate some capabilities with the key:
74
75              cauthtool -n client.foo --caps foocaps.conf keyring.bin
76
77       To display the contents of the keyring:
78
79              cauthtool -l keyring.bin
80
81       When  mount  a Ceph file system, you can grab the appropriately encoded
82       secret key with
83
84              mount -t ceph serverhost:/ mountpoint -o name=foo,secret=`cauth‐
85              tool -p -n client.foo keyring.bin`
86

AVAILABILITY

88       cauthtool is part of the Ceph distributed file system.  Please refer to
89       the Ceph wiki at http://ceph.newdream.net/wiki for more information.
90