"Load a cert in the command line flags" in v8 - how?

[scaleoutsean]

v8 says to "load" a cert.

Error: rpc error: code = Unauthenticated desc = Create pool: Feature verification failed: no certificate loaded. Please load a certificate first

The docs don't say how. There's stuff like this:

These paths can be overridden by specifying the associated key in the command line flags or configuration file used to start the service.

Can the docs explan how that actually works (command line flags)?
beegfs pool list work both for a user and root, i.e. it seems loaded just fine from BeeGFS client configuration file.
beegfs pool create throws the above error. Global flag (beegfs --tls-cert-file /etc/beegfs/conn.auth pool create...) doesn't have effect when added and neither does beegfs --auth-file /etc/beegfs/key.pem --tls-cert-file /etc/beegfs/cert.pem ....

Since this TLS stuff is always an area with problems, this part of the docs should be especially verbose to avoid these ambiguities.

In another place we have this note:

On nodes where the beegfs-tools package is installed and you want non-root users to be able to run beegfs commands, configure the conn.auth file to be owned by user “root” and group “beegfs” (chown root:beegfs /etc/beegfs/conn.auth). The “beegfs” system group is automatically created when installing beegfs-tools.

Well, that allows me to run some beegfs commands as a non-root user (e.g. beegfs pool list), but that's not enough for all commands.

It is highly recommended to secure the BeeGFS installation by enabling connection based authentication. Services will not start if no connAuthFile is configured. To run a system without connection authentication, connDisableAuthentication must be set to true in all service configuration files and auth-disable must be set to true in the Management Service configuration file.

So services cannot start w/o a connAuthFile?
Or will they start anyway (i.e. that statement is not true) as long as connDisableAuthentication is set to 1|True?

After trying 15 different ways of configuring services I still couldn't get create pool to work as any user.

The TLS/auth area of the docs should be clarified or a working example of both TLS and non-TLS, auth and non-auth, config files should be provided in an Appendix if the docs are considered clear enough (they're not to me, so I could use a set of working config files).

[iamjoemccormick]

Good feedback. It sounds like the bulk of the trouble come down to the beegfs tool not doing a good job of differentiating between TLS certificates (for encryption) and license certificates (used to enable certain features like pools).

Here are the specific improvements I plan to make based on your feedback (that should also answer your questions):

Certificate Error

Error: rpc error: code = Unauthenticated desc = Create pool: Feature verification failed: no certificate loaded. Please load a certificate first

Here certificate refers to a “license certificate” but I see how that is easily confused with a TLS certificate. I’m going to propose rewriting the error as:

Error: rpc error: code = Unauthenticated desc = Create pool: Feature verification failed: no license loaded. Please load a license first

Running Commands as a non-root user

Non-root users are limited to running a subset of the beegfs commands, but that is not clear. I’ll adjust it like so:

On nodes where the ``beegfs-tools`` package is installed and you want non-root users to be
able to run a subset of ``beegfs`` commands, configure the ``conn.auth`` file to be owned by
user "root" and group "beegfs" (``chown root:beegfs /etc/beegfs/conn.auth``). The "beegfs"
system group is created automatically during package installation.

This setup enables non-root users in the "beegfs" group to run commands that inspect the file
system (e.g., listing nodes or storage pools), check their own quota/usage information, and
view file system entries they have access to based on standard Linux permissions.

Non-root access is generally read-only. One exception is when the metadata server has the
``sysAllowUserSetPattern`` option enabled, which allows non-root users to configure striping
on entries they are allowed to access.

Starting services w/o a connAuthFile

I agree that paragraph is confusing, I’ll reword it like:

It is highly recommended to secure your BeeGFS installation by enabling connection-based
authentication using a shared secret. To start successfully, all server services and clients must be
configured in one of the following two ways:

* Enable authentication by distributing a shared secret to all nodes and setting the
  ``connAuthFile`` parameter in each service/client configuration file. Starting with BeeGFS 8, by
  default, services and clients expect the secret at ``/etc/beegfs/conn.auth``, so it is typically
  sufficient to simply install the secret at this path on all nodes and everything will "just work".
* Disable authentication explicitly by setting ``connDisableAuthentication=true`` in all service and
  client configuration files, and setting ``auth-disable=true`` in the :ref:`ManagementService`
  configuration.

If neither a connAuthFile nor the disable flags are set correctly, services will fail to start.

I’m also going to improve the example section to better distinguish the process for enabling connection authentication on a new BeeGFS 8 deployment, versus an existing system.

Let me know if this helps or if you have any other suggestions!

[trothgsi]

• There is no such thing as auth-disable (in the /etc/beegfs/ config files of beegfs-7.4.1)
• Creating an /etc/beegfs/connauthfile on all participating hosts and setting connAuthFile = /etc/beegfs/connauthfile in every config file which contains the string connAuthFile will result in

Unrecoverable error: No connAuthFile configured. Using BeeGFS without connection authentication is considered insecure and is not recommended. If you really want or need to run BeeGFS without connection authentication, please set connDisableAuthentication to true.

• Setting connDisableAuthentication = true in every config file on all participating hosts will result in

Unrecoverable error: No connAuthFile configured. Using BeeGFS without connection authentication is considered insecure and is not recommended. If you really want or need to run BeeGFS without connection authentication, please set connDisableAuthentication to true.

You don't actually mean that the name of that connAuthFile must be /etc/beegfs/conn.auth, although it is an explicit option to name that file in the config files?

[scaleoutsean]

That's great, thank you.

Note for others: upon re-reading other sections of the docs, I realized pools can be created and used only in Enterprise Edition v8 so one also needs EE (eval or permanent) license for this particular feature/command to work.