Managing security for iSCSI initiators

Ways to manage initiator security with authentication methods

You can manage the security for iSCSI initiators by performing the following tasks:

Define iSCSI initiator authentication methods that are kept in an authentication list
Display the authentication methods in the list
Define iSCSI initiator authentication methods for initiators not in the list
Add initiators to the authentication list
Remove initiators from the authentication list

How iSCSI authentication works

During the initial stage of an iSCSI session, the initiator sends a login request to the filer to begin an iSCSI session. The filer permits or denies the login request according to one of the following authentication methods:

Challenge Handshake Authentication Protocol (CHAP)--The initiator logs in using a CHAP user name and password. You can specify a CHAP password or generate a random password.
There are two types of CHAP user names and passwords:
- Inbound--The filer authenticates the initiator. Inbound settings are required if you are using CHAP authentication.
- Outbound--This is an optional setting to enable the initiator to authenticate the filer. You can use outbound settings only if you defined an inbound user name and password on the filer.
deny--The initiator is denied access to the filer.
none--The filer does not require authentication for the initiator.

You can define a list of initiators and their authentication methods. You can also define a default authentication method for initiators that are not on this list. If you do not specify a list of initiators and authentication methods, the default method is none--any initiator can access the filer without authentication.

Guidelines for using CHAP authentication

The following guidelines apply to CHAP authentication:

If you define an inbound user name and password on the filer, you must use the same user name and password for outbound CHAP settings on the initiator.
If you also define an outbound user name and password on the filer to enable bidirectional authentication, you must use the same user name and password for inbound CHAP settings on the initiator.
You cannot use the same user name and password for inbound and outbound settings on the filer.

Defining an authentication method for an initiator

To define an authentication method for initiator that are in the authentication list, complete the following steps.

Step	Action
1	If you want to...	Then...
	Use CHAP authentication and generate a random password	Enter the following command: `iscsi security generate` Result: The filer generates a 128-bit random password. Proceed to Step 2.
	Use CHAP authentication and specify a password Use another security method	Proceed to Step 2.
2	For each initiator, enter the following command: iscsi security add -i initiator -s method -p inpassword -n inname [-o outpassword -m outname] initiator is the initiator name in the iSCSI nodename format. method is one of the following: CHAP--Authenticate using a CHAP user name and password. none--The initiator can access the filer without authentication. deny--The initiator cannot access the filer. inpassword is the inbound password for CHAP authentication. The filer uses the inbound password to authenticate the initiator. inname is a user name for inbound CHAP authentication. The filer uses the inbound user name to authenticate the initiator. outpassword is a password for outbound CHAP authentication. The filer uses this password for authentication by the initiator. outname is a user name for outbound CHAP authentication. The filer uses this user name for authentication by the initiator. Note If you generated a random password in Step 1, you can use this string for either inpassword or outpassword. If you enter a string, the filer interprets an ASCII string as an ASCII value and a hexadecimal string, such as 0x1345, as a binary value.

Displaying initiator authentication methods

To view a list of initiators and their authentication methods, complete the following step.

Step	Action
1	Enter the following command: iscsi security show

Defining a default authentication method

To define a default authentication method for initiators that are not on the authentication list, complete the following step.

Step	Action
1	Enter the following command: iscsi security default -s method -p inpassword -n inname [-o outpassword -m outname] method is one of the following: CHAP--Authenticate using a CHAP user name and password. none--Initiators that are not on the list do not require authentication to access the filer. deny--Initiators that are not on the list are denied access to the filer. inpassword is the inbound password for CHAP authentication. The filer uses the inbound password to authenticate the initiator. inname is a user name for inbound CHAP authentication. The filer uses the inbound user name to authenticate the initiator. outpassword is a password for outbound CHAP authentication. The filer uses this password for authentication by the initiator. outname is a user name for outbound CHAP authentication. The filer uses this user name for authentication by the initiator.

Step

Action

Enter the following command:

iscsi security default -s method -p inpassword -n inname 

[-o outpassword -m outname]

method is one of the following:

CHAP--Authenticate using a CHAP user name and password.
none--Initiators that are not on the list do not require authentication to access the filer.
deny--Initiators that are not on the list are denied access to the filer.

inpassword is the inbound password for CHAP authentication. The filer uses the inbound password to authenticate the initiator.

inname is a user name for inbound CHAP authentication. The filer uses the inbound user name to authenticate the initiator.

outpassword is a password for outbound CHAP authentication. The filer uses this password for authentication by the initiator.

outname is a user name for outbound CHAP authentication. The filer uses this user name for authentication by the initiator.

Removing an initiator from the authentication list

To remove an initiator from the authentication list, complete the following step.

Step	Action
1	Enter the following command: iscsi security delete -i initiator -i initiator is the initiator name in the iSCSI node name format. Result The initiator is removed from the authentication list and logs in to the filer using the default authentication method.