Public bug reported:
Package: ceph-common
Version: 20.2.0-0ubuntu1 (Ubuntu 26.04 LTS / Resolute)
Component: auth / keyring parser
Severity: High (breaks default cephadm cluster management on stock
Ubuntu)
Summary
On a fresh installation of Ubuntu 26.04, running cephadm bootstrap pulls the
upstream container image tracking Ceph Tentacle stable (quay.io/ceph/ceph:v20,
currently Ceph 20.2.4). By default, Ceph 20.2.4 generates admin keys using the
newer 256-bit aes256k key format (keys prefixed with AgBB...).
However, the host binary provided by the standard Ubuntu package archive
(ceph-common version 20.2.0) does not contain the upstream patches supporting
aes256k key parsing. As a result, any native host invocation (ceph -s, ceph
orch apply, etc.) fails immediately with an authentication parse failure and an
I/O error when reading /etc/ceph/ceph.client.admin.keyring.
Steps to Reproduce
Install cephadm and ceph-common on a clean Ubuntu 26.04 node:
Bash
apt install -y cephadm ceph-common podman
Bootstrap a cluster using standard cephadm:
Bash
cephadm bootstrap --mon-ip <HOST_IP>
Inspect /etc/ceph/ceph.client.admin.keyring:
Notice the generated key string begins with AgBB (256-bit key).
Run ceph -s directly from the host CLI.
Expected Behavior
The host's ceph CLI tool should successfully parse the keyring generated by
cephadm bootstrap and connect to the cluster monitor to report cluster health.
Actual Behavior
The CLI fails immediately with buffer parsing errors and exits with [errno 5]
RADOS I/O error:
Plaintext
2026-10-22T13:44:21.146-0700 7ff89b89d6c0 -1 auth: error parsing file
/etc/ceph/ceph.client.admin.keyring: error setting modifier for [client.admin]
type=key val=AgBBddpqPVmjJCAA56YrkX/PW+Fi8xUc04suITSO5zNWrZkNAGwzkJQuWcM=:
Malformed input [buffer:3]
2026-10-22T13:44:21.146-0700 7ff89b89d6c0 -1 auth: failed to load
/etc/ceph/ceph.client.admin.keyring: (5) Input/output error
2026-10-22T13:44:21.149-0700 7ff89b89d6c0 -1 monclient: keyring not found
[errno 5] RADOS I/O error (error connecting to the cluster)
Root Cause
Upstream Ceph introduced default aes256k auth key generation in the 20.2.x
Tentacle development cycle. Support for parsing these keys in the client
libraries (librados / ceph-common) was merged into later point releases (Ceph
20.2.4+).
Because the Ubuntu archive froze ceph-common at 20.2.0, the host utility
lacks the decoding logic for aes256k (type 2) tokens, while cephadm
pulls the latest container (20.2.4) which generates them by default.
Proposed Solution / Request
Provide an SRU (Stable Release Update) bumping or backporting the aes256k auth
parser patch from upstream Ceph 20.2.4 to ceph-common in resolute-updates.
Alternatively, backport ceph 20.2.4 point-release packages into
resolute-updates to ensure parity with official quay.io/ceph/ceph:v20
images deployed by cephadm.
** Affects: ceph (Ubuntu)
Importance: Undecided
Status: New
** Project changed: launchpad => ceph (Ubuntu)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171989
Title:
ceph-common (20.2.0) fails with Malformed input [buffer:3] when
parsing aes256k (AgBB...) keys generated by cephadm / Ceph 20.2.4+
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/2171989/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
