Configuring Access

1. As root, on all Ceph Monitor nodes, open port 6789 on the public network:

   $ sudo iptables -I INPUT 1 -i <iface> -p tcp -s <IP-address>/<prefix> --dport 6789 -j ACCEPT

2. If calamari-lite is running on the Ceph Monitor node, as root, open port 8002 on the public network:

   $ sudo iptables -I INPUT 1 -i <iface> -p tcp -s <IP-address>/<prefix> --dport 8002 -j ACCEPT

3. As root, on all OSD nodes, open ports 6800-7300:

   $ sudo iptables -I INPUT 1 -i <iface> -m multiport -p tcp -s <IP-address>/<prefix> --dports 6800:7300 -j ACCEPT

   Where <ip-address> is the network address of the OSD nodes.

4. As root, on all object gateway nodes, open the relevant port or ports on the public network.

   1. To open the default port 7480:

      $ sudo iptables -I INPUT 1 -i <iface> -p tcp -s <IP-address>/<prefix> --dport 7480 -j ACCEPT

   2. Optionally, as root, if you changed the default Ceph object gateway port, for example to port 80, open this port:

      $ sudo iptables -I INPUT 1 -i <iface> -p tcp -s <IP-address>/<prefix> --dport 80 -j ACCEPT

   3. Optionally, as root, to use SSL/TLS, open port 443:

      $ sudo iptables -I INPUT 1 -i <iface> -p tcp -s <IP-address>/<prefix> --dport 443 -j ACCEPT

5. As root, make the changes persistent on each node:

   1. Install the iptables-persistent package:

      $ sudo apt-get install iptables-persistent

   2. In the terminal UI that appears, select yes to save current IPv4 iptables rules to the /etc/iptables/rules.v4 file and current IPv6 iptables rules to the /etc/iptables/rules.v6 file.

      Note

      If you add a new iptables rule after installing iptables-persistent, add the new rule to the rules file:

      $ sudo iptables-save > /etc/iptables/rules.v4

1. As root, install the ntp package:

   $ sudo apt-get install ntp

2. As root, start the NTP service and ensure it is running:

   $ sudo service ntp start
   $ sudo service ntp status

3. Ensure that NTP is synchronizing Ceph monitor node clocks properly:

   $ ntpq -p

1. Use the ssh command to log in to a Ceph node:

   $ ssh <user_name>@<hostname>

   Replace <hostname> with the host name of the Ceph node.

2. Create a new Ansible user and set a new password for this user:

   $sudo adduser <username>

3. Ensure that the user you added has the root privileges:

   $ sudo cat << EOF >/etc/sudoers.d/<username>
   <username> ALL = (root) NOPASSWD:ALL
   EOF

4. Ensure the correct file permissions:

   $ sudo chmod 0440 /etc/sudoers.d/<username>

1. Generate the SSH keys, but do not use sudo or the root user. Instead, use the Ansible user you created in Creating an Ansible User with Sudo Access. Leave the passphrase empty:

   $ ssh-keygen
   
   Generating public/private key pair.
   Enter file in which to save the key (/ceph-admin/.ssh/id_rsa):
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /ceph-admin/.ssh/id_rsa.
   Your public key has been saved in /ceph-admin/.ssh/id_rsa.pub.

2. Copy the key to each Ceph Node, replacing <username> with the user name you created in Creating an Ansible User with Sudo Access and <hostname> with a host name of a Ceph node:

   $ ssh-copy-id <username>@<hostname>

3. Modify or create (using a utility such as vi) the ~/.ssh/config file of the Ansible administration node so that Ansible can log in to Ceph nodes as the user you created without requiring you to specify the -u <username> option each time you execute the ansible-playbook command. Replace <username> with the name of the user you created and <hostname> with a host name of a Ceph node:

   Host node1
      Hostname <hostname>
      User <username>
   Host node2
      Hostname <hostname>
      User <username>
   Host node3
      Hostname <hostname>
      User <username>

   After editing the ~/.ssh/config file on the Ansible administration node, ensure the permissions are correct:

   $ chmod 600 ~/.ssh/config