Managing security for iSCSI initiators

Ways to manage initiator security with authentication methods  

You can manage the security for iSCSI initiators by performing the following tasks:

• Define iSCSI initiator authentication methods that are kept in an authentication list
• Display the authentication methods in the list
• Define iSCSI initiator authentication methods for initiators not in the list
• Add initiators to the authentication list
• Remove initiators from the authentication list

How iSCSI authentication works  

During the initial stage of an iSCSI session, the initiator sends a login request to the storage system to begin an iSCSI session. The storage system permits or denies the login request according to one of the following authentication methods:

• Challenge Handshake Authentication Protocol (CHAP)--The initiator logs in using a CHAP user name and password. You can specify a CHAP password or generate a random password.

  There are two types of CHAP user names and passwords:

  • Inbound--The storage system authenticates the initiator. Inbound settings are required if you are using CHAP authentication.
  • Outbound--This is an optional setting to enable the initiator to authenticate the storage system. You can use outbound settings only if you defined an inbound user name and password on the storage system.
• deny--The initiator is denied access to the storage system.
• none--The storage system does not require authentication for the initiator.

You can define a list of initiators and their authentication methods. You can also define a default authentication method for initiators that are not on this list. If you do not specify a list of initiators and authentication methods, the default method is none--any initiator can access the storage system without authentication.

Authentication with vFiler units  

If you use iSCSI with vFiler units, the CHAP authentication settings are configured separately for each vFiler. Each vFiler has its own default authentication mode and list of initiators and passwords.

To configure CHAP settings for vFiler units, you must use the command line.

Note
For information about managing vFiler units, see the sections on iSCSI service on vFiler units in the MultiStore Management Guide.

Guidelines for using CHAP authentication  

The following guidelines apply to CHAP authentication:

• If you define an inbound user name and password on the storage system, you must use the same user name and password for outbound CHAP settings on the initiator.
• If you also define an outbound user name and password on the storage system to enable bidirectional authentication, you must use the same user name and password for inbound CHAP settings on the initiator.
• You cannot use the same user name and password for inbound and outbound settings on the storage system.
• CHAP user names can be 1 to 128 bytes. A null user name is not allowed.
• CHAP passwords (secrets) can be 1 to 512 bytes. Passwords can be hexadecimal values or strings. For hexadecimal values, enter the value with a prefix of "0x" or "0X". A null password is not allowed.
• See the initiator's documentation for additional restrictions. For example, the Microsoft iSCSI software initiator requires both the initiator and target CHAP passwords to be at least 12 bytes if IPsec encryption is not being used. The maximum password length is 16 bytes regardless of whether IPsec is used.

Upgrading from a previous release  

If you upgrade from Data ONTAP 6.4.x to Data ONTAP 6.5 or later, and you have CHAP authentication configured, the CHAP configuration from the previous release is not saved. The CHAP configuration file in Data ONTAP 6.5 and later uses a new format that is not compatible with the CHAP configuration file format of the previous release. When you upgrade, you must use the iscsi security command to reconfigure CHAP settings.

If you do not reconfigure CHAP after the upgrade, Data ONTAP displays the following message when the initiator sends a login message to the storage system:

"ISCSI: Incorrect iSCSI configuration file version"

Defining an authentication method for an initiator  

Defining an authentication method using the command line

To define an authentication method for an initiator that is in the authentication list, complete the following steps.

iscsi security add -i initiator -s method -p inpassword 

-n inname [-o outpassword -m outname]

Defining an authentication method using FilerView

To define an authentication method for an initiator, complete the following steps.

Displaying initiator authentication methods  

Displaying initiator authentication methods using the command line

To view a list of initiators and their authentication methods, complete the following step.

iscsi security show 

Displaying initiator authentication methods using FilerView

To view a list of initiators and their authentication methods, complete the following step.

Defining a default authentication method  

To define a default authentication method for initiators that are not on the authentication list, complete the following step. You must use the command line to define a default method.

iscsi security default -s method -p inpassword -n inname 

[-o outpassword -m outname]

Removing specific authentication settings for an initiator  

Removing specific authentication settings using the command line

To remove specific authentication settings for an initiator, complete the following step.

iscsi security delete -i initiator 

Removing specific authentication settings using FilerView

To remove an initiator from the authentication list, complete the following steps.

Copyright © 1994-2005, Network Appliance, Inc. All rights reserved.
Part No. 210-01094_B0
File: c11mgt-6.htm
Last updated: 08-Dec-2005 13:25:39