Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a few computers on my network that boot via iSCSI (due to dead HDDs) using chainloaded iPXE over DHCP. I wanted to enable CHAP for my iSCSI target to increase security (and learn). However, iPXE does not appear to support CHAP...

Is it possible to boot from iSCSI and use CHAP at the same time?

share|improve this question
    
I'm fairly sure the answer is NO because the only way to transmit the CHAP credentials would be over any insecure channel, defeating the purpose. –  Chris S Jan 20 '12 at 19:27
    
If you can't use CHAP, than what is the security model for SAN booting using iSCSI? –  Soviero Jan 20 '12 at 19:46
    
Normally you'd have an iSCSI HBA so you can configure the CHAP security on the card's firmware. iPXE to be iSCSI is an ugly hack IMHO. –  Chris S Jan 20 '12 at 21:14
    
If you post that as an answer, I'll mark it as correct. –  Soviero Jan 21 '12 at 17:31

1 Answer 1

up vote 4 down vote accepted

Yes, it is possible to use iPXE and CHAP at the same time.

You need to set iPXE options, either in script or through your DHCP server. The relevant options are (from http://ipxe.org/cfg):

**Authentication settings**
username     (string)    User name
password     (string)    Password
reverse-username     (string)    Reverse user name
reverse-password     (string)    Reverse password
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.