Ceph
Cephcloud2 credentials
CephX Client Keyring
ceph / cephx-keyring
Ceph users authenticate with secret keys stored in keyrings. Ceph documents that clients specify a user name and a keyring containing the secret key, and that client.admin is assumed if no user is specified.
Looks like
patternkey\s*=\s*[A-Za-z0-9+/=]{20,}Location
/etc/ceph/ceph.client.admin.keyring, /etc/ceph/ceph.keyring, ~/.ceph/ceph.client.admin.keyring, ceph.client.admin.keyring, ceph.client.rgw.keyringExact Ceph keyring files containing user names and secret keys
Kubernetes Secrets, Rook secrets, cloud secret managers, and deployment vaults
accidentally committed keyrings, test clusters, and deployment manifests
host backups, VM images, and container images containing /etc/ceph
command history, debugging output, and CI traces
Notes
Keyrings are bearer-like secrets for Ceph capabilities. client.admin keys are highly privileged.
RADOS Gateway S3 Access / Secret Key
ceph / radosgw-s3-key
Ceph Object Gateway users can have S3-style access keys and secret keys. These credentials authenticate S3 clients to RGW and are managed as Ceph object gateway user credentials.
Looks like
pattern(?i)(rgw|radosgw|ceph)(?:[ \w.-]{0,30})(access[_-]?key|secret[_-]?key)\s*[=:]\s*[^\s,}\]]{8,255}Location
ceph.conf, radosgw-admin.json, rclone.confCeph/RGW administration exports and product-local object-gateway client config; generic AWS env vars belong to canonical AWS scanning
Kubernetes Secrets, cloud secret managers, CI/CD variables, and object-store vault entries
S3 client scripts, tests, and accidentally committed configs
S3 client debug logs and CI output
AuthorizationS3 Signature authentication headers derived from access and secret keys
Notes
RGW key blast radius depends on the user's bucket and capability grants.
Scope
Authorized use
LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.