HPE MSA 1060 : Proxmox 7.1, iSCSI, chap and problems

[sterua32]

Hello everyone!

I encounter problem with setting iscsi and chap on my proxmox server.

I had a disk bay HPE MSA1060 where a set a record for chap authentication:
initiatorname : the iqn find on the proxmox server in /etc/iscsi/initiatorname.iscsi
password: test1234test

on the proxmox server, in /etc/iscsi/iscsi.conf i set :

# To enable CHAP authentication set node.session.auth.authmethod
# to CHAP. The default is None.
node.session.auth.authmethod = CHAP

# To configure which CHAP algorithms to enable set
# node.session.auth.chap_algs to a comma seperated list.
# The algorithms should be listen with most prefered first.
# Valid values are MD5, SHA1, SHA256, and SHA3-256.
# The default is MD5.
#node.session.auth.chap_algs = SHA3-256,SHA256,SHA1,MD5

# To set a CHAP username and password for initiator
# authentication by the target(s), uncomment the following lines:
node.session.auth.username = username
node.session.auth.password = test1234test

# To set a CHAP username and password for target(s)
# authentication by the initiator, uncomment the following lines:
#node.session.auth.username_in = username_in
#node.session.auth.password_in = password_in

# To enable CHAP authentication for a discovery session to the target
# set discovery.sendtargets.auth.authmethod to CHAP. The default is None.
discovery.sendtargets.auth.authmethod = CHAP

# To set a discovery session CHAP username and password for the initiator
# authentication by the target(s), uncomment the following lines:
discovery.sendtargets.auth.username = username
discovery.sendtargets.auth.password = test1234test

when i try a lsscsi, it dit not find my hpe msa.
when i try a iscsiadm -m node --portal "192.168.0.1" --login it returns:

Logging in to [iface: default, target: iqn.xxx.hpe:storage.msa1060.xxxxxxx, portal: 192.168.0.1,3260] iscsiadm: Could not login to [iface: default, target: iqn.xxxxx.hpe:storage.msa1060.xxxxxxxx, portal: 192.168.0.1,3260]. iscsiadm: initiator reported error (24 - iSCSI login failed due to authorization failure) iscsiadm: Could not log into all portals
(i change the ip for the post, and change the iqn)

so, i dont know how to make it works...
Someone can help me ?

When i try to unset chap on my hpe msa, and comment all the line in /etc/iscsi/iscsi.conf for the chap auth, lsscsi find the volumes from my hpe msa, and the iscsiadm command return no error.
So, there is something i missed for chap, but i dont know what...

[support_s]

System recommended content:

1. HPE MSA 1060/2060/2062 Storage Management Guide

2. HPE MSA 1060 Storage Array - Overview

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[sterua32]

hi.

Sorry, i had no possibility de see this response this past week-end.

I have already this documentation, but, it did not help very much, because, it describe how to activate Chap for iscsi, but dont give any information for setting it on linux server... maybe someone has a solution or a hint/a clue to give me for my problem?

Thank you by advance.

Have a good day

[Navaneetha1]

Sterua32,

Please verify the CHAP settings , username and Passphrase used both the MSA and also the host end.
The document does not specify settings for Proxmox VE.
The authentication can even fail due to incompatible CHAP definitions.

https://www.hpe.com/psnow/doc/a00105312en_us
Page : 31

Thanks,
Navaneetha
I'm an HPE employee.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]

[sterua32]

I got there, finally, all that's missing is the multipath test

For those who have the same problem, to get the logs, you have to go to the bay's web administration interface, then support, enter the information, do "collect logs", wait several minutes, and there it downloads a .zip file with lots of logs

Which I made a script to look for "chap failed" entries:

Code:

for i in $(find . -type f -print)
do
        echo $i
        grep -i "chap failed" $i
done

Which returned errors with the affected files.

I could see that my different username attempts corresponded to [0]##########Chap failed - No DB Entry for username

On the other hand, I noticed that when I changed the username in the iscid.conf file, it did not change the username during the tests, because it always remained the same in the logs...

I searched, and found: you have to manually modify the files in nodes/iqn...../@ip_port_iscsi/default and in send_targets/@ip_portal/iqn.. .@ip_port/st_config

So, the username needed is in fact the iqn of the initiator (iqn given in /etc/iscsi/initiatorname.iscsi)

And there, an systemctl restart open-iscsi.service or an iscsiadm -m node --portal "@ip_portail" --login works!

You can check with an lsscsi to see the disks shared by the array (you have to install lsscsi before you can use it)

Now i see the disk of my hep psa on my proxmox server (proxmox is a debian os).
But, i dont find the way to make on a server, a linux lvm, and see it on the other server...

[Navaneetha1]

Sterua32,

Thank you for your updates. 
Our suggestions were purely from the MSA storage perspective.
I understand , now you are able to see the MSA disks on your Proxmox server after changing the Mulitpath settings.

Regarding settings and configurations on Linux host , we suggest to check with Linux experts on the same.

[sterua32]

Thanks.

Just a last question: now that i see my volumes on my servers, whats the preconisation of HPE for formating this volumes/luns ? mount it directly? making lvm on it? ext4? or hpe dont say anything for it ?

Is there a best-practise guide somewhere for this ?

Thanks by advance.

Have a nice day and a nice week-end

[Navaneetha1]

Hello sterua32,

We do not have any specific recommendations / best practices for formatting the LUN.

General Best practices for MSA 1060
https://www.hpe.com/psnow/doc/a00105260enw

Have a Great Weekend !

Thanks,
Navaneetha
I'm an HPE employee.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]