CEPH mon/mds/mgr/osd "using insecure key type: aes"

W

wursti

New Member
Dec 19, 2025
3
0
1
Hi there,
I am having an Issue after updating my PVE Cluster.
Ceph got an update too, from [19.2.5-pve2] to [19.2.6-pve4]

After restarting everything, I am having some Ceph Errors.
It says:

Code: 
root@hv1:~# ceph health detail
HEALTH_ERR 8 auth client entities with insecure key types; Monitors are configured to allow auth using insecure key types; Monitors are configured to allow creation of insecure key types; 4 rotating auth service keys using insecure key types; 40 auth service entities with insecure key types; Monitors are configured to issue insecure service tickets
[WRN] AUTH_INSECURE_CLIENT_KEY_TYPE: 8 auth client entities with insecure key types
    entity client.admin using insecure key type: aes
    entity client.bootstrap-mds using insecure key type: aes
    entity client.bootstrap-mgr using insecure key type: aes
    entity client.bootstrap-osd using insecure key type: aes
    entity client.bootstrap-rbd using insecure key type: aes
    entity client.bootstrap-rbd-mirror using insecure key type: aes
    entity client.bootstrap-rgw using insecure key type: aes
    entity client.crash using insecure key type: aes
[WRN] AUTH_INSECURE_KEYS_ALLOWED: Monitors are configured to allow auth using insecure key types
    insecure cipher aes allowed for auth
[WRN] AUTH_INSECURE_KEYS_CREATABLE: Monitors are configured to allow creation of insecure key types
[WRN] AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE: 4 rotating auth service keys using insecure key types
    rotating service keys for mon using insecure key type: aes
    rotating service keys for mds using insecure key type: aes
    rotating service keys for osd using insecure key type: aes
    rotating service keys for mgr using insecure key type: aes
[ERR] AUTH_INSECURE_SERVICE_KEY_TYPE: 40 auth service entities with insecure key types
    entity mds.pve1 using insecure key type: aes
    entity mds.pve2 using insecure key type: aes
    entity mds.pve3 using insecure key type: aes
    entity mds.pve4 using insecure key type: aes
    entity osd.0 using insecure key type: aes
    entity osd.1 using insecure key type: aes
    entity osd.10 using insecure key type: aes
    entity osd.11 using insecure key type: aes
    entity osd.12 using insecure key type: aes
    entity osd.13 using insecure key type: aes
    entity osd.14 using insecure key type: aes
    entity osd.15 using insecure key type: aes
    entity osd.16 using insecure key type: aes
    entity osd.17 using insecure key type: aes
    entity osd.18 using insecure key type: aes
    entity osd.19 using insecure key type: aes
    entity osd.2 using insecure key type: aes
    entity osd.20 using insecure key type: aes
    entity osd.21 using insecure key type: aes
    entity osd.22 using insecure key type: aes
    entity osd.23 using insecure key type: aes
    entity osd.24 using insecure key type: aes
    entity osd.25 using insecure key type: aes
    entity osd.26 using insecure key type: aes
    entity osd.27 using insecure key type: aes
    entity osd.28 using insecure key type: aes
    entity osd.29 using insecure key type: aes
    entity osd.3 using insecure key type: aes
    entity osd.30 using insecure key type: aes
    entity osd.31 using insecure key type: aes
    entity osd.4 using insecure key type: aes
    entity osd.5 using insecure key type: aes
    entity osd.6 using insecure key type: aes
    entity osd.7 using insecure key type: aes
    entity osd.8 using insecure key type: aes
    entity osd.9 using insecure key type: aes
    entity mgr.pve1 using insecure key type: aes
    entity mgr.pve2 using insecure key type: aes
    entity mgr.pve3 using insecure key type: aes
    entity mgr.pve4 using insecure key type: aes
[ERR] AUTH_INSECURE_SERVICE_TICKETS: Monitors are configured to issue insecure service tickets

WEB UI shows it too:
1788965043066.png

I found something, it looks like a solution, but I am not sure wether I shoud shoot or not:
https://docs.ceph.com/en/latest/rados/operations/health-checks/
Now I became that kind of shy guy.^^

CEPH runs, it seems to be configured to accept "insecure key types".
Lucky me.

Anyone else having this issue?
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back