1

I have a few computers on my network that boot via iSCSI (due to dead HDDs) using chainloaded iPXE over DHCP. I wanted to enable CHAP for my iSCSI target to increase security (and learn). However, iPXE does not appear to support CHAP...

Is it possible to boot from iSCSI and use CHAP at the same time?

4
  • I'm fairly sure the answer is NO because the only way to transmit the CHAP credentials would be over any insecure channel, defeating the purpose.
    – Chris S
    Jan 20, 2012 at 19:27
  • If you can't use CHAP, than what is the security model for SAN booting using iSCSI?
    – Soviero
    Jan 20, 2012 at 19:46
  • Normally you'd have an iSCSI HBA so you can configure the CHAP security on the card's firmware. iPXE to be iSCSI is an ugly hack IMHO.
    – Chris S
    Jan 20, 2012 at 21:14
  • If you post that as an answer, I'll mark it as correct.
    – Soviero
    Jan 21, 2012 at 17:31

1 Answer 1

5

Yes, it is possible to use iPXE and CHAP at the same time.

You need to set iPXE options, either in script or through your DHCP server. The relevant options are (from http://ipxe.org/cfg):

**Authentication settings**
username     (string)    User name
password     (string)    Password
reverse-username     (string)    Reverse user name
reverse-password     (string)    Reverse password

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .