Man Linux: Main Page and Category List

NAME

       cauthtool - ceph keyring manipulation tool

SYNOPSIS

       cauthtool  keyringfile [ -l | --list ] [ -c | --create-keyring ] [ -p |
       --print ] [ -n | --name entityname ] [ --gen-key ]  [  -a  |  --add-key
       base64_key ] [ --caps capfils ]

DESCRIPTION

       cauthtool is a utility to create, view, and modify a Ceph keyring file.
       A keyring file stores one or more Ceph authentication keys and possibly
       an associated capability specification.  Each key is associated with an
       entity name, of the form {client,mon,mds,osd}.name.

OPTIONS

       -l, --list
              will list all keys and capabilities present in the keyring.

       -p, --print
              will print an encoded key for the specified entityname.  This is
              suitable for the mount -o secret= argument.

       -c, --create-keyring
              will create a new keyring, overwriting any existing keyringfile.

       --gen-key
              will generate a new secret key for the specified entityname:

       --add-key
              will add an encoded key to the keyring.

       --caps capsfile
              will set the capabilities associated with a given key.

CAPS FILE FORMAT

       The caps file format consists of zero or more key/value pairs.  The key
       is  the  name  of  the  Ceph subsystem (osd, mds, mon).  The value is a
       comma separated list of allow, deny clauses with a permission specifier
       containing one or more of rwx, for read, write, and execute permission.
       If you want to declare the key an administrator (with  full  privileges
       on everything), use the shorthand 'subsystem = "allow *"'. For example,

              osd = "allow rwx [pool=foo[,bar]]|[uid=baz[,bay]]"  # can  read,
              write, and execute objects

              mds = "allow"      # can access mds server

              mon = "allow rwx"  # can modify cluster state (i.e., is a server
              daemon)

       A librados user restricted to a single pool might look like

              osd = "allow rw pool foo"

       A client mounting the file system with minimal permissions  would  need
       caps like

              mds = "allow"

              osd = "allow rw; allow rw pool = data_pool_num"

              mon = "allow r"

EXAMPLE

       To create a new keyring containing a key for client.foo:

              cauthtool -c -n client.foo --gen-key keyring.bin

       To associate some capabilities with the key:

              cauthtool -n client.foo --caps foocaps.conf keyring.bin

       To display the contents of the keyring:

              cauthtool -l keyring.bin

       When  mount  a Ceph file system, you can grab the appropriately encoded
       secret key with

              mount     -t      ceph      serverhost:/      mountpoint      -o
              name=foo,secret=`cauthtool -p -n client.foo keyring.bin`

AVAILABILITY

       cauthtool is part of the Ceph distributed file system.  Please refer to
       the Ceph wiki at http://ceph.newdream.net/wiki for more information.

SEE ALSO

       ceph(8)