ThatGuyB's rants

Communities Blog
89

I just finished setting up iSCSI targets in FreeBSD and iSCSI initiator in linux, using authentication. It’s not difficult at all, I’m actually surprised how easy it was. Why didn’t I use this before?

FreeBSD part

zfs create -V 8G tank/test-target
echo ctld_enable=\"YES\" >> /etc/rc.conf
  • edit /etc/ctl.conf
auth-group ag0 {
  chap user1 password1
  chap user2 password2
# in freebsd, password needs to be at least 12 characters long, at most 16
}

auth-group ag1 {
  chap user1 password1_new
  chap user2 password2_new
# not the same password as ag0
}

portal-group pg0 {
  discovery-auth-group ag0
  listen 192.168.4.7
\# only listening on a single interface, you may want to add more interfaces, or just use 0.0.0.0
}

target iqn.20221228.192.168.4.10:test-target {
  auth-group ag1
  portal-group pg0
  lun 0 {
    path /dev/zvol/tank/test-target
  }
}
  • change permissions of the file and start the service
chmod 600 /etc/ctl.conf
service ctld start

Linux part

  • install open-iscsi (on rhel, it’s “iscsi-initiator-utils”)
  • edit /etc/iscsi/iscsid.conf
node.session.auth.authmethod = CHAP
node.session.auth.username = user1
node.session.auth.password = password1_new
discovery.sendtargets.auth.authmethod = CHAP
discovery.sendtargets.auth.username = user1
discovery.sendtargets.auth.password = password1
  • edit /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.20221228.192.168.4.10:test-target
  • enable the iscsid service, or create your own service file in case it doesn’t exist, like so:
mkdir /etc/sv/iscsid
cd /etc/sv/iscsid
cat > run <<EOF
#!/bin/sh
[ -r conf ] && . ./conf
exec iscsid -f
EOF


ln -s /run/runit/supervise.iscsid supervise
ls -lh /etc/sv/iscsid/

# -rwxr-xr-x 1 root root   49 Dec 28 00:21 run
# lrwxrwxrwx 1 root root   27 Dec 28 00:22 supervise -> /run/runit/supervise.iscsid
  • start the process
sv start iscsid
# or 
# systemctl enable --now iscsid
# with systemd, you're on your own, lol, although I would be surprised if any distro that has open-iscsi in its repo doesn't ship with a systemd unit file
  • discover the targets
doas iscsiadm --mode discovery --type sendtargets --portal 192.168.4.7 --discover --login
  • happy formatting
ls -lh /dev/sd*
fdisk -l
  • to unmount iscsi
doas iscsiadm --mode node --portal 192.168.190.20 --logout
1 Like