Managing
iSCSI TargetsThe Challenge Handshake Authentication Protocol (CHAP) is a security mechanism that one entity uses to verify the identity of another entity, without revealing a secret password that is shared by the two entities. In this way, CHAP prevents an unauthorized system from using an authorized system's iSCSI name to access storage.
CHAP involves configuring a secret (acts like a password) that both a Hitachi Simple Modular Storage system and the host server must know. You enable and configure CHAP with Navigator 2. CHAP is not enabled by default, but it is strongly recommended. This help page describes the first step to enable and configure CHAP.
The following sequence describes how CHAP works when it is configured and enabled on a Hitachi Simple Modular Storage system.
During negotiations between the iSCSI initiator and target, the initiator sends a ”challenge” message to the target.
The target responds with a calculated value.
The initiator compares the response against its own calculation of the value. If the values match, the initiator acknowledges the authentication. Otherwise, it terminates the connection.
At random intervals, the initiator sends a new challenge to the target and repeats steps 1 through 3 to ensure that it is communicating with the authorized peer.
To register a new CHAP user, in CHAP Users tab of iSCSI Targets window, click Create CHAP User button. Create CHAP User window is displayed. Enter the User name, type Secret and retype Secret. Click one or more to the left of the Port (iSCSI Port) where you want to create the CHAP user in the Available Port list.
Notes:
When the host is using iSCSI, a CHAP user is not related the actual user and the user name is the same as the iSCSI name of the host.
Create CHAP User registers a CHAP user to one or more iSCSI ports. You must assign an iSCSI target to the CHAP user to authenticate a host before that host will be allowed to communicate with the target with the user name and the secret of the CHAP user. To assign an iSCSI target to a CHAP user:
Create a CHAP user.
In the list of CHAP users, select the to the left of the name of the CHAP user and click Edit CHAP User.
To view the details of a CHAP user you create, select the to the left of the name of the CHAP user and click Show Details in the CHAP User list.
The following topics within this online help provide information that may be helpful in understanding the information on this page, and/or may provide additional information that is related, but not required to understand this topic.