Root Access Settings

This page covers settings that control root (superuser) access for the AIStor process. The root user has complete access and permissions to perform operations on the AIStor deployment.

Root User and Root Password are required even if you use the MinIO Key Encryption Service or other key management utility.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the AIStor Server. Refer to your operating system’s documentation for how to define an environment variable.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, AIStor uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

Each configuration setting controls fundamental AIStor behavior and functionality. Test configuration changes in a lower environment, such as DEV or QA, before applying to production.

Settings

Root User

Environment Variable Configuration Setting

The access key for the root user.

Omitting this value results in using the default minioadmin

NEVER use the default credentials in production environments. AIStor strongly recommends specifying a unique, long, and random MINIO_ROOT_USER value for all environments.

Root Password

Environment Variable Configuration Setting

The secret key for the root user.

Omitting this value results in using the default minioadmin

NEVER use the default credentials in production environments. AIStor strongly recommends specifying a unique, long, and random MINIO_ROOT_PASSWORD value for all environments.

Root API Access

Environment Variable Configuration Setting

Specify on to enable and off to disable the root user account. Disabling the root service account also disables all service accounts associated with root, excluding those used by site replication. Defaults to on.

Ensure you have at least one other admin user, such as one with the consoleAdmin policy, before disabling the root account. If you do not have another admin user, disabling the root account locks administrative access to the deployment.

You can use this variable to temporarily override the configuration setting and re-enable root access to the deployment.

To reset after an unintentional lock, set MINIO_API_ROOT_ACCESS on to override this setting and temporarily re-enable the root account. You can then change this setting to on or make the necessary user/policy changes to ensure normal administrative access through other non-root accounts.

Unique Root Credentials

For systems with the API root access disabled, AIStor supports further obfuscation of the root credentials by generating a unique value using a configured external Key Management Service (KMS). These credentials are exclusively for internode authentication and related operations.

AIStor automatically generates unique root credentials if all of the following conditions are true:

KES Release 2024-03-01T18-06-46Z or later running
Have not defined:
- MINIO_ROOT_USER variable
- MINIO_ROOT_PASSWORD variable
Have:
- set up KES with a supported KMS target
- disabled root access with the AIStor environment variable

When those conditions are met at startup, AIStor uses the KMS to generate unique root credentials for the deployment using a hash-based message authentication code (HMAC). These credentials provide a fully obfuscated root credential configuration for infrastructures with specific security requirements.

If AIStor generates such credentials, the key used to generate the credentials must remain the same and continue to exist. All data on the deployment is encrypted with this key.

To rotate the generated root credentials, generate a new key in the KMS, then update the value of the MINIO_KMS_KES_KEY_NAME with the new key.