Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explanations on possible values for transport.socket.ssl-cert-depth are missing #754

Open
johanneskastl opened this issue Jul 14, 2022 · 0 comments
Assignees

Comments

@johanneskastl
Copy link
Contributor

johanneskastl commented Jul 14, 2022

## Enabling TLS on the Management Path

The file /var/lib/glusterd/secure-access may or may not contain a line with the transport.socket.ssl-cert-depth option.

The Guide is missing something like the following:

Creating an empty file is enough to enable TLS encryption of the management traffic.

By specifying 'option transport.socket.ssl-cert-depth X' inside that file you can influence the verification of TLS certificates:
- a value of '0' means ...
- a value of '1' (which is the default) means that '/etc/ssl/glusterfs.ca' contains a list of TLS certificates that are to be allowed
- a value of '2' means that  '/etc/ssl/glusterfs.ca' contains a CA certificate, and all TLS certificates that are signed by this CA are to be allowed
- a value of '3' means that  '/etc/ssl/glusterfs.ca' contains a CA certificate, and all TLS certificates that are signed by this CA's intermediae CA are to be allowed 
...

I am fishy on the exact details, as there does not seem to be a comprehensive list of the values in the docs. When using an empty file, the value seems to default to 1 according to the output on one of our servers.

Edit:
It would make sense to point out that apparently (at least in our tests) an empty file is enough for a client, but the server needs the right setting, otherwise clients may not be allowed to mount...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants