Cluster status shows a "mons are allowing insecure global_id reclaim" health warning

This document (000019960) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Enterprise Storage 6
ceph-14.2.20.402+g6aa76c6815-3.60.1.x86_64

Situation

The cluster health status (for example "ceph -s" output) shows the following warning, excerpt:

...

health: HEALTH_WARN
mons are allowing insecure global_id reclaim

...

Resolution

Until all clients have been patched with the current latest Ceph version, the warning should simply be silenced for now using:

ceph config set mon mon_warn_on_insecure_global_id_reclaim false
ceph config set mon mon_warn_on_insecure_global_id_reclaim_allowed false

Once it is verified that all clients are updated, re-enable the warnings and disable the setting to not allow insecure global_id reclaim by executing the following command:

ceph config set mon mon_warn_on_insecure_global_id_reclaim true
ceph config set mon mon_warn_on_insecure_global_id_reclaim_allowed true

ceph config set mon auth_allow_insecure_global_id_reclaim false

IMPORTANT: Do NOT enable / allow insecure_global_id_reclaim until it is sure that ALL clients have been patched to the latest version, this includes kernel clients via the "ceph-common" package.

Also see the additional information section.

Cause

With the release of Ceph 14.2.20 a security vulnerability is addressed in the Ceph authentication framework, resulting in the new warning to be seen once a cluster is patched.

Additional Information

If the reclaim is enabled and all clients are not patched, this will result in the non patched clients being unable to access the cluster anymore. If this is the case messages similar to the following will be logged in the MON log files:

2021-05-06 10:04:54.460 7fc595c5b700 0 cephx server client.<client_name>: attempt to reclaim global_id xxxxxxx without presenting ticket
2021-05-06 10:04:54.460 7fc595c5b700 0 cephx server client.<client_name>: could not verify old ticket

Currently updated "ceph-common" packages are not available for all clients, for example SLES12 SP5 clients. In such cases the only option for now is to disable the warnings.

Also see: https://ceph.io/releases/v14-2-20-nautilus-released/

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.