How to use system privilege
This article mainly explains "how to use system privilege". The content in the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn how to use system privilege.
Turn on system privileges
Root@demohost:/home/user# radosgw-admin user modify-system=1-uid=s3user {"user_id": "s3user", "display_name": "s3user", "email": "", "suspended": 0, "max_buckets": 1000, "auid": 0, "subusers": [], "keys": [{"user": "s3user" "access_key": "," secret_key ":"}]," swift_keys ": []," caps ": []," op_mask ":" read, write, delete "," system ":" true ", # enabled system privilege" default_placement ":", "placement_tags": [] "bucket_quota": {"enabled": false, "max_size_kb":-1, "max_objects":-1}, "user_quota": {"enabled": false, "max_size_kb":-1, "max_objects":-1}, "temp_url_keys": []}
Turn off system privileges
Root@demohost:/home/user# radosgw-admin user modify-system=0-uid=s3user {"user_id": "s3user", "display_name": "s3user", "email": "", "suspended": 0, "max_buckets": 1000, "auid": 0, "subusers": [], "keys": [{"user": "s3user" "access_key": "," secret_key ":"}]," swift_keys ": []," caps ": []," op_mask ":" read, write, delete "," default_placement ":"," placement_tags ": []," bucket_quota ": {" enabled ": false Max_size_kb:-1, max_objects:-1}, user_quota: {"enabled": false, "max_size_kb":-1, "max_objects":-1}, "temp_url_keys": []}
When the system privilege is turned on, the body of the create_bucket request returns various hidden attributes of the corresponding bucket
The test code for python is as follows
#-*-coding: utf-8-*-from boto.s3.connection import S3Connectionimport botoimport osbucket_name = 'user-bucket1'access_key =' secret_key =''endpoint =' s3.ceph.work'conn = boto.connect_s3 (aws_access_key_id=access_key, aws_secret_access_key=secret_key, host=endpoint, is_secure=False, calling_format=boto.s3.connection.OrdinaryCallingFormat (), validate_certs=True,) bucket = conn.create_bucket (bucket_name)
The body content of response is empty before enabling it.
After opening it, all the hidden metadata of bucket was exposed.
Finally, the authority of this system is very large, do not open it casually, it is easy to expand the authority and hide the disclosure of information.
Thank you for your reading, the above is the content of "how to use system privileges". After the study of this article, I believe you have a deeper understanding of how to use system privileges, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!
