...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
About CHAP Authentication
In computing, the Challenge-Handshake Authentication Protocol (CHAP) authenticates a user or network host to an authenticating entity.
CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret, although it is never sent over the network. Thus, CHAP provides better security as compared to Password Authentication Protocol (PAP) which is vulnerable for both these reasons.
The below steps allow you to apply CHAP Authentication to iSCSI ACLs, improving the security of your SoftNAS volumes.
Setting up ACLs
- Set up iSCSI as per the documentation
...
- .
...
Use SSH to access the system
...
and login as root.
Perform the following commands:
Code Block language bash theme Eclipse title Setting up ACLs linenumbers true targetcli
...
cd /
...
cd iscsi
...
cd <"iQN for iSCSI needing ACLs"> cd tpg1/acls
...
create <"iQN for iSCSI Initiator, Windows iSCSI Initiator Configure Tab"> cd / saveconfig exit
- You should now be able to see the ACL listed for iQN.
...
- Repeat the process as required for any other iQN's.
...
| Note |
|---|
| Determine whether the portal needs to be reconfigured prior to moving beyond the above steps. |
...
CHAP Authentication Setup
- Set up iSCSI as described in the documentation for SoftNAS v3.2.3 and higher.
Use SSH to access the system, logging in as root. Perform the following commands:
Code Block language bash
...
theme Eclipse title Setting up CHAP Authentication linenumbers true targetcli cd / cd iscsi cd <"iQN for iSCSI Target"> ls cd tpg1 get attribute authentication
At this point, authentication should be 0(zero) by default
...
:
Code Block language bash theme Eclipse title Setting Attribute Authentication linenumbers true set attribute authentication=1
...
get attribute authentication
Confirm CHAP Authentication via the following commands
...
:
Code Block language bash theme Eclipse title Confirm CHAP Authentication linenumbers true cd acls
...
ls
...
cd <"ACL created earlier(iQN)">
...
set userid=
...
<"for Windows use iQN of initiator"> set password=<"secret target password"> set mutual_userid=
...
<"for Mutual CHAP,
...
target iQN"> set mutual_password=
...
