About CHAP Authentication

In computing, the Challenge-Handshake Authentication Protocol (CHAP) authenticates a user or network host to an authenticating entity.

CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret, although it is never sent over the network. Thus, CHAP provides better security as compared to Password Authentication Protocol (PAP) which is vulnerable for both these reasons.
The below steps allow you to apply CHAP Authentication to iSCSI ACLs, improving the security of your SoftNAS volumes.

Setting up ACLs

1. Set up iSCSI as per the documentation.
   
   

2. Use SSH to access the system and login as root.
   
   

3. Perform the following commands:
   

   Setting up ACLs

   targetcli
   cd /
   cd iscsi
   cd <"iQN for iSCSI needing ACLs">
   cd tpg1/acls
   create <"iQN for iSCSI Initiator, Windows iSCSI Initiator Configure Tab">
   cd /
   saveconfig
   exit

• You should now be able to see the ACL listed for iQN.
• Repeat the process as required for any other iQN's.

CHAP Authentication Setup

1. Set up iSCSI as described in the documentation for SoftNAS v3.2.3 and higher.
   
   

2. Use SSH to access the system, logging in as root. Perform the following commands:

   Setting up CHAP Authentication

   targetcli
   cd /
   cd iscsi
   cd <"iQN for iSCSI Target">
   ls
   cd tpg1
   get attribute authentication

3. At this point, authentication should be 0(zero) by default:

   Setting Attribute Authentication

   set attribute authentication=1
   get attribute authentication

4. Confirm CHAP Authentication via the following commands:

   Confirm CHAP Authentication

   cd acls
   ls
   cd <"ACL created earlier(iQN)">
   set userid=<"for Windows use iQN of initiator">
   set password=<"secret target password">
   set mutual_userid=<"for Mutual CHAP, target iQN">
   set mutual_password=<"secret CHAP password">
   cd /
   saveconfig
   exit
   service fcoe-target restart