Chapter 1. Disk attachment technology
11
Draft Document for Review August 30, 2007 12:59 am
7065DiskAttach.fm
User agent (UA) - works on the client (iSCSI initiator) to help establish contact with a
service (iSCSI target). It does this be retrieving information from service agents (SA) or
directory agents (DA).
Service agent (SA) - runs on the iSCSI target device to advertise the service and its
capabilities.
Directory agent (DA) - collects service advertisements from the iSCSI targets.
1.3.3 iSCSI security considerations
FC disk attachment uses a separate FC SAN, not accessible to Ethernet network users.
iSCSI, on the other hand, is a SAN technology that uses the Ethernet network, which is a lot
more vulnerable to intrusion. Therefore, iSCSI security is very important.
iSCSI connection authentication
One way to provide secure data transmission is by means of authentication. Although
authentication is optional, its use should be considered mandatory in all security-sensitive
environments. When enabled, the iSCSI target will authenticate the initiator. Optionally, the
initiator can authenticate the target as well. Each connection within a session has to be
authenticated. Several authentication methods can be used - in our sample configurations,
we use CHAP.:
CHAP (Challenge Handshake Authentication Protocol)
SRP (Secure Remote Password)
KRB5 (Kerberos V5)
SPKM1 (Simple Public-Key generic security service API Mechanism)
SPKM2 (Simple Public-Key generic security service API Mechanism)
IP Security (IPSec)
The authentication methods listed above do prevent unauthorized initiators from accessing
the targets, but there is no protection on the packet level. For increased security, the actual
packets should be protected as well. As iSCSI relies on TCP/IP communication, IP Security
(IPSec) can be used to achieve this.
IPSec authenticates and encrypts each packet in the IP data stream. There are two IPSec
modes:
Transport mode
This mode means only the payload in each packet is encrypted. The IP header is left
unencrypted, so the routing works just the same as without IPSec.
Tunnel mode
Tunnel mode means the entire packet is encrypted, including the IP header. This means
the whole encrypted packet must be encapsulated in a new IP packet, so that routing will
function properly.
IPsec is commonly used to set up Virtual Private Networks (VPN).
### Might include a section on iSCSI addressing (IQN, EUI, NAA) ###
