FreeBSD Mastery: Specialty Filesystems by Lucas Michael W

Author:Lucas, Michael W
Language: eng
Format: epub
Tags: nonfiction
Published: 2016-01-28T00:00:00+00:00

In addition to requiring a username and password to access a target, you can also restrict which initiators can connect to which targets by using the initiator name and IP address.

Use the initiator-name keyword to define initiator names that can connect in an authentication group. If you have multiple permitted initiators, list each initiator name on its own line. Here I require the initiator to use the name I created earlier this chapter, as well as several similar initiator names.

auth-group db {

chap bugs daffy

initiator-name iqn.2013-11.io.mwl:host1

initiator-name iqn.2013-11.io.mwl:host2

initiator-name iqn.2013-11.io.mwl:host987

}

Most initiator software can set the initiator name, so restricting initiator names isn’t a security measure. If someone has the target’s CHAP username and secret, they can probably capture the initiator name as well. It’s more of a way to prevent problems caused by human error.

Restricting initiators by IP address is probably more effective. Use the initiator-portal keyword and the permitted IP address or network block. If you have multiple permitted IP blocks, list each on its own line with its own initiator-portal keyword.

auth-group db {

chap bugs daffy

initiator-name iqn.2013-11.io.mwl:host1

initiator-portal 203.0.113.0/24

initiator-portal [2001:db8:bad:c0de::]/64

initiator-portal 192.0.2.87

}

While restricting connections by IP address is probably more secure than limiting initiator names, it still doesn’t replace firewalls or packet filters. You really need a network access control device between your targets and the public Internet.

Restrictions by IP or initiator name are usable only in addition to other authentication methods. You must either use some sort of CHAP or specifically allow access without authentication.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.