Bug 1788233

Summary: iSCSI CHAP authentication configuration needed (rejected login by Synology DiskStation target)
Product: Red Hat Enterprise Linux 8 Reporter: Chris Leech <cleech>
Component: iscsi-initiator-utilsAssignee: Chris Leech <cleech>
Status: CLOSED ERRATA QA Contact: Filip Suba <fsuba>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 8.2CC: fsuba, lmiksik
Target Milestone: rcKeywords: Regression
Target Release: 8.2Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: iscsi-initiator-utils-6.2.0.878-1.gitd791ce0.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-28 16:50:43 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Chris Leech 2020-01-06 19:05:24 UTC 
Description of problem:

After adding the additional CHAP digest modes for BZ 1761940, MD5 CHAP authentiction to a Synology DiskStation target was reported to no longer function.

This is actually an issue with the authentication negotiation of the kernel iSCSI target on the Synology, but may be present in other targets based on older Linux kernels.  They reject any initiator authentication that offers to use a CHAP mode other than MD5, even if MD5 is offered as well.

We should have a way of configuring the advertised CHAP modes, which would allow disabling anything other than MD5 in order to remain compatible with these targets.

Version-Release number of selected component (if applicable):

iscsi-initiator-utils-6.2.0.878-0.gitd791ce0.el8

Additional info:

I don't have a target that does this, instead I'm looking at the known issue of the older kernel target and checking that the on-the-wire behavior of the initiator can be configured back to what we did before.

It looks like it may be possible to reproduce this with RHEL 7.1 as the target.
Comment 5 Filip Suba 2020-03-19 08:11:37 UTC 
Verified with iscsi-initiator-utils-6.2.0.878-3.gitd791ce0.el8. Regression testing passed.
Comment 7 errata-xmlrpc 2020-04-28 16:50:43 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:1829