• Know what are the HTTP verbs
• Know the name of our ceph

Our ceph/s3 object storage can be publicly accessed but is very restricted, the more restricted the higher security.

So what is open?

• HTTP verb GET
• Any bucket that has been requested to be open to the internet (you still must give explicit access to the objects)

What is NOT open:

• All the rest HTTP verbs (PUT/HEAD/DELETE/POST…)
• All the rest of buckets that are not explicitly requested to be opened.
• All the objects in a published bucket not explicitly published as public/timed/hashed.

Just 1 thing:

curl http://larry.ciberterminal.net/monguitest/status.txt

That is:

• you should know the name of the file that you want to access.
• the file must be public or have any ACL setup that allow access to it without authentication (public, timed public, hash key based acces…)

• Only GET is available you won't be able to:
  • bucket.list as it uses HTTP/HEAD.
  • bucket.delete as it uses HTTP/DELETE.
  • Any other operation
• You'll still have to manage the object ACL so anyone can access it, by default all the objects inside the bucket are private.