0

I'm trying to setup my iSCSI server using targetcli. Initial setup went fine and my Windows iSCSI initiator can connect to my first target / portal / LUN.

Now I'm trying to setup another LUN. I want it to be separate, such that my Windows client won't even attempt to mount it and such that my Ubntu client would only mount the new LUN.

So I created another target under iscsi, added a tpg and set up a new acl there and bound a iblock backstore to it. As far as I can tell, the setup is completely the same as the original target. I also added a portal to 0.0.0.0:3260, same as the original target.

Now, issuing discovery (iscsiadm -m discovey -t st -p myserver) in my client Ubuntu correctly identifies both targets.

However, my next step, trying to log in (iscsiadm -m node --login) fails with message 24 - iSCSI login failed due to authorization failure.

  • I have tried adding the credential info as suggested here with no success.
  • Removing the target ACL also gives me no joy.
  • Setting up two different ACLs within the original target as well.

Anyway, at this point I'm now stuck unable to complete the second step (login). If I understand this correctly, that would also attach all LUNs on the target to my ubuntu initiator. I'm obviously missing some detail here and would appreciate any pointers.

My current targetcli configuration: enter image description here

Each of the acls has auth userid set to same name as acl name and password set to something between 12 and 16 characters long. ACL name is in one instance the same one as suggested by the Windows iSCSI initiator, in the other, I just made up some name using same format, but different company name and initiator machine name. tpg is set such that ACL authentication takes precedence.

  • 1
    Did you create two different ACLs (one for each initiator with the respective iqn) and map the respective LUN (see mankier.com/8/targetcli#Configuring_Iscsi-Acls)? When in targetcli, cd iscsiand lsand add the output to your question. – ridgy Jan 29 '17 at 13:09
  • Added current configuration – velis Jan 29 '17 at 16:42
  • 1
    As far as I can see the configuration seems correct: The initiator with iqn.1991...should only see lun0 and iqn.20... should only see lun1. In this case you should not need credentials. But I did not work with targetcli so far (only different iSCSI targets, who all worked this way); if it is different in targetcli, I'd have to test it out. – ridgy Jan 29 '17 at 16:54
  • 1
    I read again in the manual (mankier.com/8/targetcli#Configuring_Iscsi-Authentication). It seems that you have to configure ACL authentication (and therefore maybe the mapping) with additionally setting attributes like generate_node_acls. Just play around with those parameters. – ridgy Jan 29 '17 at 17:05
  • maybe so, but I think my problem is that my ubuntu initiator (iscsiadm) uses an id that is not what is set at the target. I'm setting auth.username, but there's probably also an auth.userid which is "baked" into the initiator itself that I'm missing. Maybe - no guide mentions this, so maybe I'm wrong. Edit: yep: dmesg on target machine says my initiator is using a different user id. trying to modify the ACLs accordingly – velis Jan 29 '17 at 17:49
0

The problem turned out to be in the fact that open-iscsi initiator I'm using - iscsiadm - (naturally) provides its own initiator id.

I got this ID by examining dmesg output immediately after an unsuccessful login attempt. The entries said something like:

[1246730.912317] iSCSI Initiator Node: iqn.1993-08.org.debian:zz:xxxxxxxxxxx is not authorized to access iSCSI target portal group: 1.
[1246730.912387] iSCSI Login negotiation failed.

Edit: the id is located in /etc/iscsi/initiatorname.iscsi

The entire procedure for logging into the configuration specified in the question goes like this:

iscsiadm -m discovery -t st -p server_name_or_ip
(check initiator id on the client /etc/iscsi/initiatorname.iscsi)
create an ACL at server named same as initiator id. set its auth userid and password to whatever you want
iscsiadm -m node --op=update --name node.session.auth.authmethod --value=CHAP
iscsiadm -m node --op=update --name node.session.auth.username --value=(whatever you have set your userid in ACL auth settings)
iscsiadm -m node --op=update --name node.session.auth.password --value=(whatever you have set your password in ACL auth settings)
iscsiadm -m node --login

The last (login) command will now work and will attach the LUNs that are mapped for the ACL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.