iSCSI + CHAP — Quick Lab Note

1. Create new target on servera

Install and start:

dnf install -y targetcli
systemctl enable --now target

Create backing file:

mkdir -p /root/iscsi
truncate -s 1G /root/iscsi/test0.img

Open targetcli:

targetcli

Create backstore:

/backstores/fileio create test0 /root/iscsi/test0.img

Create target:

/iscsi create iqn.2026-09.home.lab:servera

Create LUN:

/iscsi/iqn.2026-09.home.lab:servera/tpg1/luns create /backstores/fileio/test0

---

2. Create new client on serverb

Install tools:

dnf install -y iscsi-initiator-utils

Check client IQN:

cat /etc/iscsi/initiatorname.iscsi

Example:

InitiatorName=iqn.2026-09.lab.serverb:client

Back on servera:

targetcli

Create ACL:

/iscsi/iqn.2026-09.home.lab:servera/tpg1/acls create iqn.2026-09.lab.serverb:client

Enable CHAP:

cd /iscsi/iqn.2026-09.home.lab:servera/tpg1
set attribute authentication=1
set auth userid=chapuser
set auth password=chap123456

Set same CHAP on ACL:

cd acls/iqn.2026-09.lab.serverb:client
set attribute authentication=1
set auth userid=chapuser
set auth password=chap123456

Save:

saveconfig
exit

Open firewall:

firewall-cmd --permanent --add-service=iscsi-target
firewall-cmd --reload

---

3. Configure / reset client

On serverb, set CHAP in:

vi /etc/iscsi/iscsid.conf

Use:

node.session.auth.authmethod = CHAP
node.session.auth.username = chapuser
node.session.auth.password = chap123456

Restart:

systemctl restart iscsid

Reset old saved iSCSI configuration:

iscsiadm -m node --logout
iscsiadm -m node -o delete

Check:

iscsiadm -m node

Should be empty.

---

4. Discover and login

Discover target:

iscsiadm -m discovery -t sendtargets -p <servera_IP>

Example:

iscsiadm -m discovery -t sendtargets -p 192.168.56.30

Login:

iscsiadm -m node \
-T iqn.2026-09.home.lab:servera \
-p 192.168.56.30:3260 \
--login

Verify:

iscsiadm -m session
lsblk

Remember

servera:
backstore → target → LUN → ACL → CHAP

serverb:
CHAP config → reset old node → discovery → login → lsblk

If login fails with:

authorization failure

check the saved client node settings:

iscsiadm -m node -T <TARGET_IQN> -p <IP>:3260