Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 109

Using a RADIUS server to manage CHAP accounts is helpful if you are managing a large number of accounts. However, computer access to targets depends on the availability of the RADIUS server. NOTE: If you use CHAP for initiator authentication, you can also use target authentication for mutual authentication, which provides additional security. Display Local CHAP Accounts To display local CHAP accounts: 1. Click Group → Group Configuration. 2. Click the iSCSI tab. The Local CHAP Accounts panel lists all current CHAP accounts. NOTE: Starting with firmware v9.1.x, the CHAP password is no longer displayed in clear text format. Create a Local CHAP Account CHAP accounts are a method of ensuring that only authorized users can access a PS Series group. You can create local CHAP accounts or you can use a RADIUS server. Before you create an account: • You can decide whether to verify iSCSI initiator credentials against local CHAP accounts first (before verifying external CHAP accounts on a RADIUS server). • You need the following information: - CHAP user name - Password (otherwise known as a CHAP secret). For optimal security, passwords must contain at least 12 characters (preferably random). Individual iSCSI initiators have their own rules and restrictions for length and format. Consult your initiator documentation for details. To create a local CHAP account: 1. Click Group → Group Configuration. 2. Click the iSCSI tab. 3. (Optional) Select Enable local authentication and check local first in the iSCSI Authentication panel. 4. In the Local CHAP Accounts panel, click Add to open the Add CHAP Account dialog box. 5. Type a CHAP user name and, optionally, a password. • The user name can be up to 63 printable characters (any characters except space and colon). NOTE: If the user name contains a pound-sign character, enclose the name in quotation marks (for example, "chap#user"). Otherwise, the system will read the characters after the pound sign as a comment and not include them in the user name. • The password can be up to 255 printable characters (any characters except space and colon). If you do not enter a password, the group automatically generates a password that is 16 characters long). 6. Select whether to enable the account. You must enable an account to use it for initiator authentication. You can modify an account and enable or disable it later. 7. Click OK. 8. Click Save all changes. NOTE: In the iSCSI initiator authentication area, you can select Enable RADIUS authentication for iSCSI initiators, Consult locally defined CHAP accounts first, or both. Make sure that at least one of these choices is selected. If neither option is selected, the PS Series group will lock out all iSCSI initiator logins. After creating the CHAP account, you can: • Create an access control policy and use the CHAP user name in the policy About Volume-Level Security 109