Show Table of Contents
20.7. Deauthorizing a Client
To revoke the authorization of a client to access the Red Hat Gluster Storage trusted storage pool, you can do any of the following:
- Remove an authorized client from the allowed list
- Revoke SSL/TLS certificate authorization through a certificate revocation list (CRL)
20.7.1. To Remove an Authorized Client From the Allowed List
Procedure 20.12. Removing an authorized client from the allowed list
List currently authorized clients and servers
$ gluster volume get VOLNAME auth.ssl-allowFor example, the following command shows that there are three authorized servers and five authorized clients.
$ gluster volume get sample_volname auth.ssl-allow server1,server2,server3,client1,client2,client3,client4,client5
Remove clients to deauthorize from the outputFor example, if you want to deauthorize client2 and client4, copy the string and remove those clients from the list.
Set the new list of authorized clients and serversSet the value of
auth.ssl-allowto your updated string.
$ gluster volume set VOLNAME auth.ssl-allow <list_of_systems>For example, the updated list shows three servers and three clients.
$ gluster volume set sample_volname auth.ssl-allow server1,server2,server3,client1,client3,client5
20.7.2. To Revoke SSL/TLS Certificate Authorization Using a SSL Certificate Revocation List
To protect the cluster from malicious or unauthorized network entities, you can specify a path to a directory containing SSL certificate revocation list (CRL) using the
ssl.crl-pathoption. The path containing the list of revoked certificates enables server nodes to stop the nodes with revoked certificates from accessing the cluster.
For example, you can provide the path to a directory containing CRL with the
volume setcommand as follows:
$ gluster volume set vm-images ssl.crl-path /etc/ssl/
Only the CA signed certificates can be revoked and not the self-signed certificates
To set up the CRL files, perform the following:
- Copy the CRL files to a directory.
- Change directory to the directory containing CRL files.
- Compute hashes to the CRL files using the
$ c_rehash .The hash and symbolic linking can be done using the
c_rehashutility, which is available through the
openssl-perlRPM. The name of the symbolic link must be the hash of the Common Name. For more information, see the
- Set the
$ gluster volume set VOLNAME ssl.crl-path path-to-directorywhere, path-to-directory has to be an absolute name of the directory that hosts the CRL files.