About CHAP Authentication

In computing, the Challenge-Handshake Authentication Protocol (CHAP) authenticates a user or network host to an authenticating entity.

CHAP provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. CHAP requires that both the client and server know the plaintext of the secret, although it is never sent over the network. Thus, CHAP provides better security as compared to Password Authentication Protocol (PAP) which is vulnerable for both these reasons.
The below steps allow you to apply CHAP Authentication to iSCSI ACLs, improving the security of your SoftNAS volumes.

Setting up ACLs

1. Set up iSCSI as per the documentation for SoftNAS v3.2.3 and higher.
   
2. Use SSH to access the system, login as root. Perform the following commands:
   1. targetcli
   2. cd /
   3. cd iscsi
   4. cd <iQN for iSCSI needing ACL's>
   5. ls
   6. cd tpg1/acls
   7. create <iQN for iSCSI Initiator, windows iSCSI Initiator Configure Tab>
   8. cd ../../
   9. ls
   10. cd /
   11. saveconfig
   12. exi
       
        
3. You should now be able to see the ACL listed for iQN.
   
   
4. Repeat the process as required for any other iQN's.

Note: Determine whether the portal needs to be reconfigured prior to moving beyond the above steps. 

CHAP Authentication Setup

1. Set up iSCSI as described in the documentation for SoftNAS v3.2.3 and higher.
   
2. Use SSH to access the system, logging in as root.Perform the following commands:
   
   1. targetcli
   2. cd /
   3. cd iscsi
   4. cd <iQN for iSCSI Target>
   5. ls
   6. cd tpg1
   7. get attribute authentication
      
      
3. At this point, authentication should be 0(zero) by default.
   
   
   1. set attribute authentication=1
   2. get attribute authentication
      
4. Confirm CHAP Authentication via the following commands.
   1. cd acls
   2. ls
   3. cd <ACL created earlier(iQN)>
   4. set userid=<for windows use iQN of initiator>
   5. set password=<Secret Target Password>
   6. set mutual_userid=<for Mutual CHAP, trget iQN>
   7. set mutual_password=<Secret CHAP Password>
   8. cd /
   9. saveconfig
   10. exit
   11. service fcoe-target restart