evilrouters.net

i originally wrote the following on 23-may-2007:

i installed red hat enterprise linux 4.5 on an hp dl365 yesterday to test out iscsi.

we carved out some space on the san to use for the testing, 500gb to be exact. the dl365 has a qlogic fiber-channel hba in it, connected to the hp san at 4 gbps. the 500gb of storage shows up on the rhel box at /dev/sda. no partitions or filesystems were created on the device.

as far as i can tell, rhel does not include support for being an iscsi target, which i did not find out until after i had it installed. fortunately, i came across the iscsi enterprise target project on sourceforge. their wiki led me to martin’s “iscsi target howto on enterprise linux (rhel4)“. by following that, i was able to get the iscsi target up and running, exporting the 500gb on /dev/sda.

the next step was to connect to that storage space from a windows box. this test is sort of a proof-of-concept to see if we can get things to work the way we want — which means windows “clients”, or initiators, will be used. i found anze vidmar’s “going enterprise — setup your fc4 iscsi target in 5 minutes” wiki page, which details setting up an iscsi initiator on windows. i grabbed the microsoft iscsi software initiator version 2.04 and installed it on my windows xp workstation (a vista version wasn’t available, or i’d have went for that).

following anze’s instructions allowed me to get the windows xp client configured as an initiator in just a few moments, and i had a p: drive showing up as a local disk, with an ~500gb ntfs filesystem on it for all my storage pleasure. excellent!

unfortunately, we need some access controls in our environment. if or when this goes into production, all iscsi traffic will be on an isolated, private network. i’m a big fan of the layered security approach, however, so while an isolated, private network is a good start, i want to implement the authentication that iet and the microsoft initiator are supposed to support.

enter problem. =)

anytime i try to set up some credentials on the target side (using “incominguser username password” in the /etc/ietd.conf config file) and use those same credentials in the microsoft iscsi initiator, i get a simple “authentication failure” dialog box on the client/initiator side. unfortunately, there aren’t any log entries on the server/target side (that i noticed, anyway) to help provide any insight.

anyone ran into this before and have any suggestions? tia.

update: seems i didn’t have any credentials listed in the “global” section of the /etc/ietd.conf file, which is needed if you try to do authentication during the discovery phase (i was). added that in and now have authentication working across the board.