1

have a machine that is an initiator to a few iscsi targets. The network between initiator and targets is physically secure, so I have always assumed that chap was not required

If I look at netstat, it has outgoing connections on high ports to port 3260 on the iscsi targets, and everything works nicely

Because these high ports are usable by any user, it would seem that any user, running root or not, can potentially set up a rogue iscsi initiator and do anything. I can telnet to 3260 on any of the iscsi targets and get a connection, so it would seem that I can potentially gain block access to any disk without being root on the initiator machine.

Am I correct?

  • iSCSI has no concept of users or permissions. – Basil Aug 15 '16 at 11:39
1

Your logic is correct. If a user can copy a program onto the system, or can develop one on the system, then it won't need root access for an active open on an ephemeral port. Therefore it can send iSCSI requests to an unsecured target.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.