1

have a machine that is an initiator to a few iscsi targets. The network between initiator and targets is physically secure, so I have always assumed that chap was not required

If I look at netstat, it has outgoing connections on high ports to port 3260 on the iscsi targets, and everything works nicely

Because these high ports are usable by any user, it would seem that any user, running root or not, can potentially set up a rogue iscsi initiator and do anything. I can telnet to 3260 on any of the iscsi targets and get a connection, so it would seem that I can potentially gain block access to any disk without being root on the initiator machine.

Am I correct?

Improve this question
1
  • iSCSI has no concept of users or permissions.
    – Basil
    Aug 15, 2016 at 11:39

1 Answer 1

Reset to default
1

Your logic is correct. If a user can copy a program onto the system, or can develop one on the system, then it won't need root access for an active open on an ephemeral port. Therefore it can send iSCSI requests to an unsecured target.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .