Detections
Analytics

6.1 Ensure bidirectional CHAP authentication for iSCSI traffic is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

vSphere allows for the use of bidirectional authentication of both the iSCSI target and host. Bidirectional Challenge-Handshake Authentication Protocol (CHAP), also known as Mutual CHAP, should be enabled to provide bidirectional authentication.

Rationale:

By not authenticating both the iSCSI target and host, there is a potential for a man-in-the-middle attack in which an attacker might impersonate either side of the connection to steal data. Bidirectional authentication can mitigate this risk.

Note: Choosing not to enforce bidirectional authentication can make sense if you create a dedicated network or VLAN to service all your iSCSI devices. If the iSCSI facility is isolated from general network traffic, it is less vulnerable to exploitation.

Solution

To enable bidirectional CHAP authentication for iSCSI traffic, perform the following:

From the vSphere Web Client, navigate to 'Hosts and Clusters'.

Click on a host.

Click on 'Configure' -> 'Storage' -> 'Storage Adapters'.

Select the iSCSI adapter to configure OR click the green plus symbol to create a new adapter.

Under Adapter Details, click the Properties tab and click 'Edit' in the Authentication panel.

Specify authentication method: 'Use bidirectional CHAP'.

Specify the outgoing CHAP name.

Make sure that the name you specify matches the name configured on the storage side.

To set the CHAP name to the iSCSI adapter name, select 'Use initiator name'.

To set the CHAP name to anything other than the iSCSI initiator name, deselect 'Use initiator name' and type a name in the Name text box.

Enter an outgoing CHAP secret to be used as part of authentication. Use the same secret as your storage side secret.

Specify incoming CHAP credentials. Make sure your outgoing and incoming secrets do not match.

Click OK.

Click the second to last symbol to rescan the iSCSI adapter.

Alternately, run the following PowerCLI command:

# Set the Chap settings for the Iscsi Adapter
Get-VMHost | Get-VMHostHba | Where {$_.Type -eq 'Iscsi'} | Set-VMHostHba # Use desired parameters here

References:

https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.storage.doc/GUID-AC65D747-728F-4109-96DD-49B433E2F266.html

https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.storage.doc/GUID-2F1E64DB-20BB-4D18-A083-8E65FE380899.html

Notes:

Prerequisites- Before setting up CHAP parameters for software or dependent hardware iSCSI, determine whether to configure unidirectional or bidirectional CHAP. Independent hardware iSCSI adapters do not support bidirectional CHAP.

Verify CHAP parameters configured on the storage side. Parameters that you configure must match the ones on the storage side.

Required privilege: Host.Configuration.Storage Partition Configuration

See Also

https://workbench.cisecurity.org/files/2816

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1)

Plugin: VMware

Control ID: 8a5078aed32394e132741589403afa086b55c7e3f88d6e865d9afb9e4016244b