I have a few computers on my network that boot via iSCSI (due to dead HDDs) using chainloaded iPXE over DHCP. I wanted to enable CHAP for my iSCSI target to increase security (and learn). However, iPXE does not appear to support CHAP...

Is it possible to boot from iSCSI and use CHAP at the same time?

  • I'm fairly sure the answer is NO because the only way to transmit the CHAP credentials would be over any insecure channel, defeating the purpose. – Chris S Jan 20 '12 at 19:27
  • If you can't use CHAP, than what is the security model for SAN booting using iSCSI? – Soviero Jan 20 '12 at 19:46
  • Normally you'd have an iSCSI HBA so you can configure the CHAP security on the card's firmware. iPXE to be iSCSI is an ugly hack IMHO. – Chris S Jan 20 '12 at 21:14
  • If you post that as an answer, I'll mark it as correct. – Soviero Jan 21 '12 at 17:31

Yes, it is possible to use iPXE and CHAP at the same time.

You need to set iPXE options, either in script or through your DHCP server. The relevant options are (from http://ipxe.org/cfg):

**Authentication settings**
username     (string)    User name
password     (string)    Password
reverse-username     (string)    Reverse user name
reverse-password     (string)    Reverse password

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.