up vote 0 down vote favorite
share [g+] share [fb]

I have a few computers on my network that boot via iSCSI (due to dead HDDs) using chainloaded iPXE over DHCP. I wanted to enable CHAP for my iSCSI target to increase security (and learn). However, iPXE does not appear to support CHAP...

Is it possible to boot from iSCSI and use CHAP at the same time?

link|improve this question
100% accept rate
I'm fairly sure the answer is NO because the only way to transmit the CHAP credentials would be over any insecure channel, defeating the purpose. – Chris S♦ Jan 20 at 19:27
If you can't use CHAP, than what is the security model for SAN booting using iSCSI? – Kevin Jan 20 at 19:46
Normally you'd have an iSCSI HBA so you can configure the CHAP security on the card's firmware. iPXE to be iSCSI is an ugly hack IMHO. – Chris S♦ Jan 20 at 21:14
If you post that as an answer, I'll mark it as correct. – Kevin Jan 21 at 17:31
feedback

1 Answer

up vote 3 down vote accepted

Yes, it is possible to use iPXE and CHAP at the same time.

You need to set iPXE options, either in script or through your DHCP server. The relevant options are (from http://ipxe.org/cfg):

**Authentication settings**
username     (string)    User name
password     (string)    Password
reverse-username     (string)    Reverse user name
reverse-password     (string)    Reverse password
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.