iSCSI Security with CHAP28 June '07 - 04:54 by benr
The first line of defense in iSCSI deployments is to properly define and bind targets to a target portal group (TPG) via a tag on the target (TPGT). ACL's then provide yet more security by not only restricting how you get to the target, but which initiators are even allowed to connect to a given target.
Beyond that, you can use password authentication via CHAP to ensure only the persons you want connecting can. This can be useful in environments when ACL security isn't sufficient and untrusted users have root access on a system capable of accessing the target.
Two forms of CHAP security are available:
- Uni-directional Authentication: Enables the target to validate the initiator.
- Bi-directional Authentication: Additionally enables the initiator to authenticate the target.
Configuring OpenSolaris iSCSI Initiators and Targets for CHAP is easy, but might be a bit counter intuitive at first. Practice makes perfect.
Before you begin, please remember that iSCSI CHAP passwords must be between 12 and 16 chars long. Spaces are fine, so "I Love iSCSI!!!!" is a valid password.
Here are the high level steps:
- Set a CHAP name and secret of your choosing on the initiator node (iscsiadm modify initiator-node)
- Set a CHAP name and secret of your choosing on the target node (iscsitadm modify admin)
- UNI-DIRECTIONAL: Create an initiator entry on the target node and map to target
- BI-DIRECTIONAL: Set target node CHAP name and secret as a target-param on initiator and enable Bi-Directional Auth (iscsiadm modify target-param)
Uni-Directional CHAP Authentication in Solaris
On the initiator:
- Optional Set the CHAP Name of the initiator if you want one other than the default (IQN of the initiator)
- Set the password (secret) for this initiator (use whatever you like)
- Enable CHAP authentication for the initiator
root@aeon ~$ iscsiadm modify initiator-node --CHAP-name aeon root@aeon ~$ iscsiadm modify initiator-node --CHAP-secret Enter secret: Re-enter secret: root@aeon ~$ iscsiadm modify initiator-node --authentication CHAP
On the target:
- Set the global CHAP username for the Target Node (You must do this!)
- Set the global CHAP password for the Target Node
- Create an entry for the initiator
- Set the name of the initiator entry
- Set the password of the initiator entry
- Associate the initiator entry with a target
root@fisheye ~$ iscsitadm modify admin --chap-name fisheye root@fisheye ~$ iscsitadm modify admin --chap-secret Enter secret: Re-enter secret: root@fisheye ~$ iscsitadm create initiator --iqn iqn.1986-03.com.sun:01:e00000000000.464d05f9 aeon root@fisheye ~$ iscsitadm modify initiator --chap-name aeon aeon root@fisheye ~$ iscsitadm modify initiator --chap-secret aeon Enter secret: Re-enter secret: root@fisheye ~$ iscsitadm modify target --acl aeon fisheye/luns/lun0
Bi-Direction CHAP Authentication in Solaris
Bi-Directional auth is setup using all the steps above, followed by these steps on the initiator:
- Set the CHAP name of the target as a target-param
- Set the CHAP secret of the target as a target-param
- Enable bi-directional authentication on the target
root@aeon ~$ iscsiadm modify target-param --CHAP-name fisheye iqn.1986-03.com.sun:02:44783840-bce2-4101-f79f-fbf3a3242ea1 root@aeon ~$ iscsiadm modify target-param --CHAP-secret iqn.1986-03.com.sun:02:44783840-bce2-4101-f79f-fbf3a3242ea1 Enter secret: Re-enter secret: root@aeon ~$ iscsiadm modify target-param --bi-directional-authentication enable iqn.1986-03.com.sun:02:44783840-bce2-4101-f79f-fbf3a3242ea1 root@aeon ~$ iscsiadm list target-param -v iqn.1986-03.com.sun:02:44783840-bce2-4101-f79f-fbf3a3242ea1 Target: iqn.1986-03.com.sun:02:44783840-bce2-4101-f79f-fbf3a3242ea1 Alias: fisheye/luns/lun0 Bi-directional Authentication: enabled Authentication Type: CHAP CHAP Name: fisheye ....
When Things Go Wrong...
Example of failed authentication (bad password in initiator entry on target node):
Jun 19 05:52:18 aeon iscsi: [ID 953209 kern.warning] WARNING: iscsi connection(157) login failed - login failed to authenticate with target Jun 19 05:52:18 aeon iscsi: [ID 372941 kern.warning] WARNING: iscsi connection(157) login failed - Initiator could not be successfully authenticated. (0x02/0x01)
Example of error when target node CHAP name and secret not set:
Jun 19 05:19:37 aeon iscsi: [ID 632887 kern.warning] WARNING: iscsi connection(54) login failed - authentication failed with target
A Word About RADIUS Support
RADIUS support is available in the Solaris Initiator and Target... but you still have to enable passwords like above and RADIUS is only for bi-directional auth. In other words, don't bother. If you think setting up RADIUS (I suggest FreeRADIUS if you must) for your iSCSI deployment would be fun, trust me, just shoot yourself in the head and be done with it.
Ever thought about the use of ipsec for host authentication?
pel (Email) - 28 June '07 - 16:10G’day,
Have you had much exp using iscsi devices under vxvm?
andrew: VxVM is dead. ZFS all the way. Regardless, its easy enough I suppose, I can blog that up of you like.
benr - 29 June '07 - 05:02Perfect timing Ben.
Might be worth pointing out the iqn you’re setting up is the initiator, aeons, IQN. But a lot clearer than the official docs (which use single character options in their command lines).
I meant that this line:
root@fisheye ~$ iscsitadm create initiator—iqn iqn.1986-03.com.sun:01:e00000000000.464d05f9 aeon
in the unidirectional method refers to aeons IQN.
I have had some issue’s in the past with iscsi and vxvm. In particular when shutting down a machine the network gets dropped before vxvm has dealt with its devices properly.
I have been using iscsi on linux since before the standard was ratified but have never rolled out iscsi & vxvm in production before.
Any blogs etc would be great! :)
ZFS: I hear you, unfortunately its just not available on all platforms yet :)
Keep up the good work. I have been using cuddletech for years and years! [[http://google5.com.com]] ]ancor1ancor2ancor3ancor4ancor5[/URL] .
They are simply looking for a better ancor1ancor2ancor3ancor4ancor5 .
He got his first [[http://google5.com.org]] ancor1ancor2ancor3ancor4ancor5 free, he once told me.
Great Site – really useful information! [[http://google3.com.com]] ]ancor1ancor2ancor3ancor4ancor5[/URL] .
He departed earth by way of a ancor1ancor2ancor3ancor4ancor5 of his won design, many years before his birth.
The form was looked proud with a ting of [[http://google3.com.org]] ancor1ancor2ancor3ancor4ancor5 wiki .
Your work is marvelous!!
[[http://allmednews.org/med/pills/paxil/]] – paxil [[http://allmednews.org/med/pills/xanax/]] – xanax
Jules - 18 May '08 - 05:58xanax
philly daily news paper for 12 31 05
kanye west work summerlands audition in what direction does the moon rise cia fact book south africa feel my horney feed my sting
black female american poets ufos in the bible kark and comcast nflsalaries man with the golden gun
contractor tradesmen insurance coverage lasalle apartment ratings birmingham european time zones urinetown hope cladwell monologue james van der hooven loan to george washington
knso apa bibliography purchase confront weed killer personilize desk plate how to do an a project
it’s 2010 now, VxVM is still alive and ZFS is still not as stable.
darkfader (URL) - 05 April '10 - 01:58I very intersted in the article
As we know, now sunglasses are loved by more and more people, and everyone would like to have a pair of comfortable sunglasses,save up to 47%.welcome to [[http://www.eyewear-rayban.com]]
of a gym membership,P90x workout . The cost for P90X is
about three months of a paid gym membership but you get to
keep the program foreverP90x . You can try many of the
online sites, but it will be the same as buying from the
company or a Beachbody Coach. Make sure you are getting
original DVD’s. People are selling copies all over. The
problem is how long will they last, P90x workout ,and you
truly need the exercise and nutrition guide to even follow
the program. You can go to any site or you can go to
[[http://www.p90xmall.com]] and click on products. P90x dvd You can
order directly from the site,P90x dvd. [[http://www.thesuitshoes.com]] [[http://www.offerreplicawatches.com.The..]] sell Chanel Watches, Replica BRM Watches,offer Cartier Watches, Copy Ebel Watches, Replica Hublot Watches, Fake Tag Heuer Watches, wholesale Richard Mille Watches.
They also sell some very fashion watches, such as Montblanc Watches for sale,Chopard Watches, Dior Watches and Gucci Watches. Rolex watches are hot sell. If u are Armani Watches and Breitling Watches fan. You can still look at Omega Watches and Longines Watches, many new arrivals watches just come here.You can have a try on 58338312391273913. :[url=[[http://www.offerreplicawatches.com]www..]]]. [[http://www.adapterlist.com/dell/inspir..]] [[http://www.globallaptopbattery.co.uk/d..]] [[http://www.gpscardvd.com]] the usefulness and significance is overwhelming. [[http://www.iofferitems.com,]], 40-70% Off. Cheap Air Max 90 Shoes, Free Shipping! Buy Air Max 90 Now! [[http://www.iofferitems.com,]], 40-70% Off. Cheap Air Max 90 Shoes, Free Shipping! Buy Air Max 90 Now! [[http://www.airjordanshoescheap.com/]] [[http://www.vibramfivefinger.us/]] vibram five fingers [[http://www.mbtshoeslatest.com]]
[[http://www.idealhere.com]] [[http://www.p90x-buying.com,]], have competitive pricing($59.99) and free shipping as well. Even with the shipping cost, you could end up paying less than you would in a local store. [[http://www.p90x-buying.com,]], have competitive pricing($59.99) and free shipping as well. Even with the shipping cost, you could end up paying less than you would in a local store.
products at [[http://www.jeans-edhardy.com]] are 100% high quality, competitive price, free shipping with best and timely
service, 100% satisfaction. Big discount for big order. Welcome to make your choose. [[http://www.china-wholesale-directory.c..]] Top China Wholesalers category.. thanks for sharing the article!
uCoolStuff is the leading China wholesaler for [[http://www.ucoolstuff.com]] cool stuff [[http://www.ucoolstuff.com]] cool gifts , unusual gadgets and other unique gift ideas. We provide the very latest cool stuff and cool gifts for you [[http://www.gucci-buying.com]] are 100% high
quality, competitive price, free shipping with best and timely service, 100% satisfaction. Big discount for big order. Welcome to make your choose. [[http://www.wmvconverterformac.com]] WMV converter for Mac guide shall be showed in its own webpage, you can gotheir special column to get more detailed information, Just choose the title in the right
[[http://www.wmvconverterformac.com/wmv-..]] [[http://www.toponlinestores.org]] free directory where you can find the best online shopping stores selected by hand and sorted by category [[http://www.china-wholesale-directory.c..]] china wholesale .
cheap ugg boots[[http://www.cheapuggbootssale.co.uk]]
Timberland boots sale[[http://www.timberlandboots4sale.co.uk]]
Ed Hardy Swimwear (Email) - 21 December '10 - 09:23Your point of view a lot of benefit to me, thank you!
Ed Hardy Women Hoodies (Email) - 22 December '10 - 12:38