Managing the iSCSI SAN

Managing security for iSCSI initiators

How iSCSI security works

During the initial stage of an iSCSI session, the initiator sends a login request to the filer to begin an iSCSI session. The filer permits or denies the login request according to one of the following security methods:

Challenge Handshake Authentication Protocol (CHAP)--The initiator logs in using a CHAP user name and password. You can specify a CHAP password or generate a random password.
deny--The initiator is denied access to the filer.
none--The filer does not require authentication for the initiator.

You can define a list of initiators and their security methods. You can also define a default security method for initiators that are not on this list. If you do not specify a list of initiators and security methods, the default security method is none--any initiator can access the filer without authentication.

Displaying the security list

To view a list of initiators and their security methods, complete the following step.

Step	Action
1	Enter the following command: iscsi security show

Adding initiators to the security list

To add an initiator to the security list, complete the following step.

Step	Action
1	If you want to...	Then...
	Use CHAP authentication and generate a random password	Enter the following command: iscsi security generate Result The filer generates a 128-bit random password. Proceed to Step 2.
	Use CHAP authentication and specify a password Use another security method	Proceed to Step 2.
2	For each initiator, enter the following command: iscsi security add -i initiator -s method -p password -n name initiator is the initiator name in the iSCSI nodename format. method is one of the following: CHAP--Authenticate using a CHAP user name and password. none--The initiator can access the filer without authentication. deny--The initiator cannot access the filer. -p password is a password when the security method is CHAP authentication. If you generated a random password, password is the string you generated in Step 1. If you enter a string of your own, the filer interprets an ASCII string as a ASCII value and a hexadecimal string, such as 0x1345, as a binary value. -n name is a user name when the security method is CHAP authentication.

Defining the default security method

To define a default security method for initiators that are not on the security list, complete the following step.

Step	Action
1	Enter the following command: iscsi default -s method -p password -n name method is one of the following: CHAP--Authenticate using a CHAP user name and password. none--Initiators that are not on the security list do not require authentication to access the filer. deny--Initiators that are not on the security list are denied access to the filer. -p password is a password when the security method is CHAP authentication. If you generated a random password, password is the string you generated in Step 1. -n name is a user name when the security method is CHAP authentication.

Step

Action

Enter the following command:

iscsi default -s method -p password -n name

method is one of the following:

CHAP--Authenticate using a CHAP user name and password.
none--Initiators that are not on the security list do not require authentication to access the filer.
deny--Initiators that are not on the security list are denied access to the filer.

-p password is a password when the security method is CHAP authentication. If you generated a random password, password is the string you generated in Step 1.

-n name is a user name when the security method is CHAP authentication.

Removing an initiator from the security list

To remove an initiator from the security list, complete the following step.

Step	Action
1	Enter the following command: iscsi security delete -i initiator -i initiator is the initiator name in the iSCSI node name format. Result The initiator is removed from the security list and logs in to the filer using the default security method.