Linux服务管理-基于CHAP认证的ISCSI

基于CHAP认证的ISCSI

参考文档：https://blog.51cto.com/zhuxu91313/2154819

9.12. 为目标设置 Challenge-Handshake 验证协议 Red Hat Enterprise Linux 8 | Red Hat Customer Portal

一、单向认证

认证分为发现端（discovery）和session（session又分为acl级别和tpg级别）

# tpd级别
/> iscsi/iqn.2024-04.com.a:server1/tpg1/ set attribute generate_node_acls=1 authentication=1
# 之后添加用户的命令都是一样的

下面为ACL级别

target服务器

# 配置discover单向chap认证
/> iscsi/ set discovery_auth enable=1 userid=target password=redhat
Parameter enable is now 'True'.
Parameter userid is now 'target'.
Parameter password is now 'redhat'.
/> iscsi/ get discovery_auth 
DISCOVERY_AUTH CONFIG GROUP
===========================
enable=True
-----------
The enable discovery_auth parameter.
mutual_password=
----------------
The mutual_password discovery_auth parameter.
mutual_userid=
--------------
The mutual_userid discovery_auth parameter.
password=redhat_passwd
----------------------
The password discovery_auth parameter.
userid=redhat
-------------
The userid discovery_auth parameter.
/> 
# 配置session chap单向认证
/> iscsi/iqn.2024-04.com.a:server1/tpg1/acls/iqn.2024-04.com.a:client/ set auth userid=redhat password=redhat_passwd
Parameter userid is now 'redhat'.
Parameter password is now 'redhat_passwd'.
/> iscsi/iqn.2024-04.com.a:server1/tpg1/acls/iqn.2024-04.com.a:client/ get auth 
AUTH CONFIG GROUP
=================
mutual_password=
----------------
The mutual_password auth parameter.
mutual_userid=
--------------
The mutual_userid auth parameter.
password=redhat_passwd
----------------------
The password auth parameter.
userid=redhat
-------------
The userid auth parameter.
/> 

客户端

[root@vm2 ~]# cat /etc/iscsi/iscsid.conf | egrep '^discovery.sendtargets.auth.|^node.session.auth.'
node.session.auth.authmethod = CHAP
node.session.auth.username = redhat
node.session.auth.password = redhat_passwd
discovery.sendtargets.auth.authmethod = CHAP
discovery.sendtargets.auth.username = redhat
discovery.sendtargets.auth.password = redhat_passwd
[root@vm2 ~]# systemctl restart iscsi iscsid
[root@vm2 ~]# 
[root@vm2 ~]# iscsiadm -m discovery -t sendtargets -p 172.31.31.49
172.31.31.49:3260,1 iqn.2024-04.com.a:server1
[root@vm2 ~]# 
[root@vm2 ~]# iscsiadm -m node -T iqn.2024-04.com.a:server1 -p 172.31.31.49:3260 -l
Logging in to [iface: default, target: iqn.2024-04.com.a:server1, portal: 172.31.31.49,3260]
Login to [iface: default, target: iqn.2024-04.com.a:server1, portal: 172.31.31.49,3260] successful.
[root@vm2 ~]# 
[root@vm2 ~]# iscsiadm -m node -T iqn.2024-04.com.a:server1 -p 172.31.31.49:3260 -u
Logging out of session [sid: 6, target: iqn.2024-04.com.a:server1, portal: 172.31.31.49,3260]
Logout of [sid: 6, target: iqn.2024-04.com.a:server1, portal: 172.31.31.49,3260] successful.
[root@vm2 ~]#

二、双向认证

注：此处的双向认证只是配置了发现服务的认证，客户端登录认证略，可参照单向认证 ↑

target服务器

# 配置discover双向chap认证
/> iscsi/ set discovery_auth enable=1 userid=target password=redhat mutual_userid=initiator mutual_password=redhat
Parameter enable is now 'True'.
Parameter userid is now 'target'.
Parameter password is now 'redhat'.
Parameter mutual_userid is now 'initiator'.
Parameter mutual_password is now 'redhat'.
/> exit

客户端

[root@vm2 ~]# cat /etc/iscsi/iscsid.conf | egrep '^discovery.sendtargets.auth.' 
discovery.sendtargets.auth.authmethod = CHAP
discovery.sendtargets.auth.username = target
discovery.sendtargets.auth.password = redhat
discovery.sendtargets.auth.username_in = initiator
discovery.sendtargets.auth.password_in = redhat
[root@vm2 ~]# 
[root@vm2 ~]# systemctl restart iscsi iscsid

注：在服务端自动生成acl时，如果没有chap认证，则几乎所有不被防火墙拦截的客户端都可以注册连接，但是如果启用chap认证，则无法直接连接，客户端需配置对应的用户名和密码。