Thomas Lamprecht 0dd48804e1 api: ceph/monitor: automatically disable insecure global ID reclaim after creating first monitor ... nautilus 14.2.20 and octopus 15.2.11 fixed a security issue with reclaiming the global ID auth (CVE-2021-20288). As fixing this issue means that older client won't be able to connect anymore, the fix was done behind a switch, with a HEALTH warning if it was not active (i.e., disallowed connection from older clients). New installations have this switch also at the insecure level, for compat reasons, so lets deactivate it ourself after monitor creation to avoid the health warning and slightly insecure setup (in default PVE ceph the whole issue was of rather low impact/risk). But, only do so when creating the first monitor of a ceph cluster, to avoid breaking existing setups by accident. An admin can always switch it back again, e.g., if they're recovering from some failure and need to setup fresh monitors but have still old clients. Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>		2021-04-27 12:35:34 +02:00
..
FS.pm	ceph tools: factor out frequent keyring and config init check	2019-07-23 07:48:45 +02:00
Makefile	api: ceph: subclass pools	2021-02-06 14:17:53 +01:00
MDS.pm	ceph: make all service name regexes the same	2020-03-04 15:38:09 +01:00
MGR.pm	ceph: make all service name regexes the same	2020-03-04 15:38:09 +01:00
MON.pm	api: ceph/monitor: automatically disable insecure global ID reclaim after creating first monitor	2021-04-27 12:35:34 +02:00
OSD.pm	ceph: osd_belongs_to_node: only check tree-entries of type host, refactor	2021-04-20 18:06:07 +02:00
Pools.pm	api: ceph pool create: replace left-over complex error handling	2021-04-21 17:34:23 +02:00