mirror of
https://github.com/minio/docs.git
synced 2025-08-06 14:42:56 +03:00
3a52f00cb7
Release work for Server RELEASE.2024-03-03T17-50-39Z
- Adds new NATS config
- Adds new ilm configs
- Adds info on having a KMS auto generate root credentials
Closes #1144
Release work for Server RELEASE.2024-03-10T02-53-48Z
- Corrects a missing URL excludes line for some builds
- Adds new webhook options
Closes #1155
Staged:
- [Webhook
config](http://192.241.195.202:9000/staging/release-work/linux/reference/minio-server/settings/metrics-and-logging.html#envvar.MINIO_AUDIT_WEBHOOK_BATCH_SIZE)
- [NATS
config](http://192.241.195.202:9000/staging/release-work/linux/reference/minio-server/settings/notifications/nats.html#user-credentials-file)
- [Root
credentials](http://192.241.195.202:9000/staging/release-work/linux/operations/install-deploy-manage/deploy-minio-single-node-single-drive.html#create-the-environment-variable-file)
- [ILM
config](http://192.241.195.202:9000/staging/release-work/linux/reference/minio-server/settings/ilm.html)
110 lines
3.5 KiB
ReStructuredText
110 lines
3.5 KiB
ReStructuredText
.. _minio-server-envvar-root:
|
|
|
|
====================
|
|
Root Access Settings
|
|
====================
|
|
|
|
.. default-domain:: minio
|
|
|
|
.. contents:: Table of Contents
|
|
:local:
|
|
:depth: 2
|
|
|
|
This page covers settings that control root (superuser) access for the MinIO process.
|
|
The root user has complete access and permissions to perform operations on the MinIO deployment.
|
|
|
|
.. include:: /includes/common-mc-admin-config.rst
|
|
:start-after: start-minio-settings-defined
|
|
:end-before: end-minio-settings-defined
|
|
|
|
.. include:: /includes/common-mc-admin-config.rst
|
|
:start-after: start-minio-settings-test-before-prod
|
|
:end-before: end-minio-settings-test-before-prod
|
|
|
|
Root User
|
|
---------
|
|
|
|
.. tab-set::
|
|
|
|
.. tab-item:: Environment Variable
|
|
:sync: envvar
|
|
|
|
.. envvar:: MINIO_ROOT_USER
|
|
|
|
The access key for the :ref:`root <minio-users-root>` user.
|
|
|
|
.. warning::
|
|
|
|
If :envvar:`MINIO_ROOT_USER` is unset, :mc:`minio` defaults to ``minioadmin``.
|
|
|
|
**NEVER** use the default credentials in production environments.
|
|
MinIO strongly recommends specifying a unique, long, and random :envvar:`MINIO_ROOT_USER` value for all environments.
|
|
|
|
.. tab-item:: Configuration Setting
|
|
:sync: config
|
|
|
|
This setting does not have a configuration variable setting.
|
|
Use the Environment Variable instead.
|
|
|
|
Root Password
|
|
-------------
|
|
|
|
.. tab-set::
|
|
|
|
.. tab-item:: Environment Variable
|
|
:selected:
|
|
|
|
.. envvar:: MINIO_ROOT_PASSWORD
|
|
|
|
The secret key for the :ref:`root <minio-users-root>` user.
|
|
|
|
.. warning::
|
|
|
|
If :envvar:`MINIO_ROOT_PASSWORD` is unset, :mc:`minio` defaults to ``minioadmin``.
|
|
|
|
**NEVER** use the default credentials in production environments.
|
|
MinIO strongly recommends specifying a unique, long, and random :envvar:`MINIO_ROOT_PASSWORD` value for all environments.
|
|
|
|
.. tab-item:: Configuration Setting
|
|
|
|
This setting does not have a configuration variable setting.
|
|
Use the Environment Variable instead.
|
|
|
|
.. _minio-disable-root-access:
|
|
|
|
Root Access
|
|
-----------
|
|
|
|
.. tab-set::
|
|
|
|
.. tab-item:: Environment Variable
|
|
:sync: envvar
|
|
|
|
.. envvar:: MINIO_API_ROOT_ACCESS
|
|
|
|
.. tab-item:: Configuration Setting
|
|
:sync: config
|
|
|
|
.. mc-conf:: api root-access
|
|
:delimiter: " "
|
|
|
|
.. versionadded:: MinIO Server RELEASE.2023-05-04T21-44-30Z
|
|
|
|
Specify ``on`` to enable and ``off`` to disable the :ref:`root <minio-users-root>` user account.
|
|
Disabling the root service account also disables all service accounts associated with root, excluding those used by site replication.
|
|
Defaults to ``on``.
|
|
|
|
Ensure you have at least one other admin user, such as one with the :userpolicy:`consoleAdmin` policy, before disabling the root account.
|
|
If you do not have another admin user, disabling the root account locks administrative access to the deployment.
|
|
|
|
You can use this variable to temporarily override the configuration setting and re-enable root access to the deployment.
|
|
|
|
To reset after an unintentional lock, set :envvar:`MINIO_API_ROOT_ACCESS` ``on`` to override this setting and temporarily re-enable the root account.
|
|
You can then change this setting to ``on`` *or* make the necessary user/policy changes to ensure normal administrative access through other non-root accounts.
|
|
|
|
Unique Root Credentials
|
|
-----------------------
|
|
|
|
.. include:: /includes/common/common-deploy.rst
|
|
:start-after: start-common-deploy-create-unique-root-credentials
|
|
:end-before: end-common-deploy-create-unique-root-credentials |