About CHAP Authentication

In computing, the Challenge-Handshake Authentication Protocol (CHAP) authenticates a user or network host to an authenticating entity.

CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret, although it is never sent over the network. Thus, CHAP provides better security as compared to Password Authentication Protocol (PAP) which is vulnerable for both these reasons.
The below steps allow you to apply CHAP Authentication to iSCSI ACLs, improving the security of your SoftNAS volumes.

Setting up ACLs

1. Set up iSCSI as per the documentation for SoftNAS v3.2.3 and higher.
   
   

2. Use SSH to access the system

   ,

   and login as root.
   
   

3. Perform the following commands:
   

   Code Block
   language bash theme Eclipse title Setting up ACLs linenumbers true
   targetcli

   cd /

   cd iscsi

4. cd <iQN for iSCSI needing ACL's>
5. ls
cd

cd <"iQN for iSCSI needing ACLs"> cd tpg1/acls

6. create <iQN for iSCSI Initiator, windows iSCSI Initiator Configure Tab>
7. cd ../../
8. ls
9. cd /
10. saveconfig
exit
 

create <"iQN for iSCSI Initiator, Windows iSCSI Initiator Configure Tab"> cd / saveconfig exit

•  You should now be able to see the ACL listed for iQN.

•  Repeat the process as required for any other iQN's.

CHAP Authentication Setup

1. Set up iSCSI as described in the documentation for SoftNAS v3.2.3 and higher.
   
   

2. Use SSH to access the system, logging in as root. Perform the following commands:

   Code Block
   language bash theme Eclipse title Setting up CHAP Authentication linenumbers true
   targetcli

   cd /

   cd iscsi

3. cd <iQN for iSCSI Target>
4. ls
5. cd tpg1
get attribute

cd <"iQN for iSCSI Target"> ls cd tpg1 get attribute authentication




6. At this point, authentication should be 0(zero) by default

   .

   :

   Code Block
   language bash theme Eclipse title Setting Attribute Authentication linenumbers true
   set attribute authentication=1

   get attribute authentication

   
   

7. Confirm CHAP Authentication via the following commands

   .

   :

   Code Block
   language bash theme Eclipse title Confirm CHAP Authentication linenumbers true
   cd acls

   ls

   cd <ACL created

   cd <"ACL created earlier(iQN)">

   set userid=

   <for windows use iQN of initiator>
8. set password=<Secret Target Password>
set

<"for Windows use iQN of initiator"> set password=<"secret target password"> set mutual_userid=

<for

<"for Mutual CHAP,

target iQN>set

target iQN"> set mutual_password=

<Secret CHAP Password>
9. cd /
10. saveconfig
11. exit
service

<"secret CHAP password"> cd / saveconfig exit service fcoe-target restart