From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 9746A1FF0AA for ; Mon, 21 Sep 2026 09:40:29 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 9EADB2158F; Mon, 21 Sep 2026 09:40:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsec.com; s=201809; t=1789975888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cZvOsUJo40CBE64ktEmsYa7VwjGhnIijIuNkNeigBUY=; b=W5KYuVuy8lPUFKv/iI4v4uOwOH1XxwFnu2BIsl88V00EPR0Ui7I43x3snejV2qufgoK9T6 T+4Mwp6eXhPWHuVjYJgNHSkKkuhJYsA3hTezUbbHGANzIU1MAjViYbOZH3IWPnnq2JvJs8 tTtctQzH9QTIIhsXjhus5ctvwy0k4utZgZzGMEfML5fNWXkB9wG3xBPDkO0dwgJs9j4PSR qGLDKRc05Y6u8bgM5vH92Cx32eVHdhIUhKSvIJxf6BDCNSMI9bsSuypNP1o3y03zsDH1ZO 6T4U1AZWAk1TPbJ3CZxTqFfIL+HWY0F9E5Df9ZheANEvKc86+V8XK9yiOyA24g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsec.com; s=dkim; t=1789975887; h=from:subject:date:message-id:to:mime-version:content-type: content-transfer-encoding; bh=cZvOsUJo40CBE64ktEmsYa7VwjGhnIijIuNkNeigBUY=; b=tMiYX7hn6GJFCLG7bZ4lZfYewi+r+CIQ5PBlvLuEXGnMu1u+goNR9EORTA6fH7JlEhvFvA OgaFWZyXu9f+Vq60CLyD8bpAuVEAw/y9YfrCw2ma5G+OE9US7Hm/YEm3WhwlrsBfndFkih i8jpsHiGMi811OWTewtSJ9qQJni4Wioq/7Llyw5w5MRg87eI8IwdEMy/KB2hfq1Mq4MSck 7vyfGs7Z8Sy2uiozwoV+1cFgCX8UdnOgsYHm/Xw/l9GMBKeqUFT83dQ6eIPkSDZ1tGIFGX 77TCmRaIxsJHPX+zKYK9ulUvG8z591ArQXCiAvuc5/bdeqc0gQdO709qbvRtSw== From: "Martin Konold" To: pve-user@lists.proxmox.com User-Agent: SOGoMail 5.12.10 MIME-Version: 1.0 Date: Mon, 21 Sep 2026 09:31:26 +0200 Subject: aes -> aes256k Message-ID: <21ac004b-8975-2808-43c3-ee6dec9368bc@konsec.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Last-TLS-Session-Version: None X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy MIME_QP_LONG_LINE 0.001 Quoted-printable line longer than 76 chars SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: FDSNN5HKQOVQZXE4FNAWFNWISI6PN4IB X-Message-ID-Hash: FDSNN5HKQOVQZXE4FNAWFNWISI6PN4IB X-MailFrom: martin.konold@konsec.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE user list List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi there, after experiencing severe trouble with a non critical cluster after applying "-= -restrict-ciphers" as I followed the instructions from https://pve-41.kosu.ag/p= ve-docs/chapter-pveceph.html#pveceph_cephx_migration. I then further examined the situation with another ceph cluster and saw that th= e following settings apply after following the instructions. auth_allowed_ciphers: aes, aes256k (permitted for authentication) auth_preferred_cipher: aes (default for new keys) as outputted from=20 pveceph auth status This time I set auth_preferred_cipher explicitly to aes256k not aes and resolve= d this issue. IMHO this should be mentioned in the instructions. Regards --martin --=20 martin.konold@konsec.com Phone: +49 711 21 72 74-90 KONSEC GmbH -=E2=81=A0 make things real Amtsgericht Stuttgart, HRB 23690 Gesch=C3=A4ftsf=C3=BChrer: Andreas Mack Im K=C3=B6ller 3, 70794 Filderstadt, Germany