Fetch quota information without sharing the secret key

[ysagon]

Dear Team,
I'm not sure if this is an issue or not.
According to the documentation, we have to allow users to read the conn.auth file if they need to interact with BeeGFS, for example to fetch quota information.

https://doc.beegfs.io/latest/advanced_topics/authentication.html

I would like to understand the risks of sharing the secret key. I always thought it had to be kept secret.

In V7, if I recall correctly, it was possible to do so without having access to the key.

In our cluster, for example, where we have a lot of users, would it be acceptable to give them the right to access this file? What are the risks involved?

Thanks for the clarification.

[iamjoemccormick]

@ysagon , you generally don't want to share the secret key with most users. That could (for example) be used to mount BeeGFS on a new client where the user has root permissions.

However users don't need to be able to read the secret to interact with BeeGFS using the beegfs tool. Have a look at the note in the page you linked and let me know if that does what you need:

Note On nodes where the beegfs-tools package is installed and you want non-root users to be able to run a subset of beegfs commands, configure the conn.auth file to be owned by user “root” and group “beegfs” (chown root:beegfs /etc/beegfs/conn.auth). The “beegfs” system group is created automatically during package installation.
This setup enables non-root users in the “beegfs” group to run commands that inspect the file system (e.g., listing nodes or storage pools), check their own quota/usage information, and view file system entries they have access to based on standard Linux permissions.

Non-root access is generally read-only. One exception is when the metadata server has the sysAllowUserSetPattern option enabled, which allows non-root users to configure striping on entries they are allowed to access.