Securing the Ceph dashboard

Intermediate⏱ ~18 minceph

What you'll learn

Configure dashboard authentication
Terminate TLS correctly
Restrict where it is reachable
Understand what a dashboard account can do

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Why this matters in production

The dashboard is a web interface to a storage cluster, reachable over the network, with its own account system separate from cephx.

Authentication

# Substitute your own dashboard account name before running:
DASH_USER=storage-admin

ceph dashboard ac-user-create "$DASH_USER" -i /path/to/password-file administrator
ceph dashboard ac-user-show

# the built-in roles
ceph dashboard ac-role-show

Role	Grants
`administrator`	everything the dashboard exposes
`read-only`	viewing without modification
`block-manager`, `rgw-manager`, `cephfs-manager`	scoped to that subsystem
`cluster-manager`, `pool-manager`	scoped operational roles

# Substitute your own dashboard account name before running:
DASH_USER=noc-viewer

ceph dashboard ac-user-create "$DASH_USER" -i /path/to/pw read-only

Create scoped accounts rather than administrator accounts for people who
only need to look.

# password policy
ceph dashboard set-pwd-policy-enabled true
ceph dashboard set-pwd-policy-check-length-enabled true
ceph dashboard set-pwd-policy-check-complexity-enabled true

# and single sign-on where an IdP exists
ceph dashboard sso status

TLS

ceph dashboard create-self-signed-cert       # development only

# a real certificate
ceph dashboard set-ssl-certificate -i /path/to/cert.pem
ceph dashboard set-ssl-certificate-key -i /path/to/key.pem
ceph mgr module disable dashboard && ceph mgr module enable dashboard

ceph config get mgr mgr/dashboard/ssl
ceph mgr services

A self-signed certificate trains operators to click through certificate
warnings, which is the behaviour that makes a real interception
succeed.

Restricting exposure

ceph config get mgr mgr/dashboard/server_addr
ceph config set mgr mgr/dashboard/server_addr 10.10.5.11

ceph config get mgr mgr/dashboard/ssl_server_port

Binding to a management interface rather than 0.0.0.0 is the single
most effective restriction, because it removes the dashboard from the
client-facing network entirely.

Layer	Control
Bind address	`server_addr` on a management interface
Firewall	source-restrict the port
Reverse proxy	authentication and rate limiting in front
Network	management VLAN only

ss -ltn | grep -E ':8443|:8080'

What a dashboard account can do

An administrator role can create and delete pools, modify OSD state,
change configuration, and manage RGW users — the same class of action as
client.admin, through a browser.

Action	Available
Create and delete pools	yes
Mark OSDs out or down	yes
Change cluster configuration	yes
Manage RGW users and keys	yes
Read cluster state	yes
Read cephx keys	limited, but RGW keys are exposed

So a dashboard administrator account is a full-control credential, and
it protects itself with a password rather than a keyring file.

Quiz

Knowledge check · 4 questions

Q1. Why is binding the dashboard to a management address more robust than firewalling the port?

The listening socket then exists only on that interface, so there is no rule that can be reordered, flushed, or forgotten The dashboard responds faster on a management interface, because it no longer queues behind recovery traffic on the client network Host firewalls cannot restrict the dashboard port, because the manager rebinds it on a different port after every manager failover Setting a management bind address enables TLS automatically, so the dashboard stops accepting plain HTTP on any interface at all
Q2. A self-signed dashboard certificate is acceptable for production since the traffic is still encrypted.

True False
Q3. Secure a dashboard deployment.

A dashboard is bound to 0.0.0.0 with a self-signed certificate and three administrator accounts, one shared by the team.
Q4. What can a dashboard administrator account do?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Set mgr/dashboard/server_addr to a management interface rather than relying on firewall rules — the socket then exists only there. Use scoped dashboard roles by default; an administrator account is full cluster control protected by a password.

Cross-course references

Kubernetes: the dashboard has historically been the most exposed control-plane surface
Linux: binding to a specific interface is more durable than a firewall rule