6.7

Securing iSCSI Storage
The storage you configure for a host might include one or more storage area networks (SANs) that use
iSCSI. When you configure iSCSI on a host, you can take measures to minimize security risks.
iSCSI supports accessing SCSI devices and exchanging data by using TCP/IP over a network port rather
than through a direct connection to a SCSI device. An iSCSI transaction encapsulates blocks of raw SCSI
data in iSCSI records and transmits the data to the requesting device or user.
iSCSI SANs support efficient use of the existing Ethernet infrastructure to provide hosts access to storage
resources that they can dynamically share. iSCSI SANs are an economical storage solution for
environments that rely on a common storage pool to serve many users. As with any networked system,
your iSCSI SANs can be subject to security breaches.
Note The requirements and procedures for securing an iSCSI SAN are similar for hardware iSCSI
adapters associated with hosts and for iSCSI configured directly through the host.
Securing iSCSI Devices
To secure iSCSI devices, require that the ESXi host, or initiator, can authenticate to the iSCSI device, or
target, whenever the host attempts to access data on the target LUN.
Authentication ensures that the initiator has the right to access a target. You grant this right when you
configure authentication on the iSCSI device.
ESXi does not support Secure Remote Protocol (SRP), or public-key authentication methods for iSCSI.
You can use Kerberos only with NFS 4.1.
ESXi supports both CHAP and Mutual CHAP authentication. The vSphere Storage documentation
explains how to select the best authentication method for your iSCSI device and how to set up CHAP.
Ensure uniqueness of CHAP secrets. Set up a different mutual authentication secret for each host. If
possible, set up a different secret for each client that to the ESXi host. Unique secrets ensure that an
attacker cannot create another arbitrary host and authenticate to the storage device even if one host is
compromised. With a shared secret, compromise of one host might allow an attacker to authenticate to
the storage device.
Protecting an iSCSI SAN
When you plan your iSCSI configuration, take measures to improve the overall security of the iSCSI SAN.
Your iSCSI configuration is only as secure as your IP network, so by enforcing good security standards
when you set up your network, you help safeguard your iSCSI storage.
The following are some specific suggestions for enforcing good security standards.
Protect Transmitted Data
A primary security risk in iSCSI SANs is that an attacker might sniff transmitted storage data.
vSphere Security
VMware, Inc. 220