Least-privilege cephx users and capabilities
Giving each client only what it needs: per-application users, pool-scoped capabilities and profiles, keyring distribution and auditing existing keys.
Ceph security hardening
Specific hardening tasks for a production Ceph cluster: client authentication, encryption in transit, the dashboard, patching and cephadm host access.
Encrypting Ceph traffic in transit with msgr2 secure mode
Turning on secure mode for cluster and client traffic: crc versus secure modes, CPU cost, client support and checking what is actually encrypted.
Hardening the Ceph Dashboard
Limiting dashboard risk: role assignment, password policy and lockout, enabling API audit logging, SSO and keeping the dashboard off untrusted networks.
Ceph security updates and CVE patching
Keeping a cluster on a release that still gets security fixes, tracking advisories, and rolling security point releases with cephadm.
Securing cephadm SSH access
cephadm manages hosts over SSH: non-root users with sudo, protecting the cluster SSH key, restricting where admin keyrings live and limiting _admin hosts.
