14.8. Securing iSCSI storage pools with libvirt secrets

Procédure

1. Create a libvirt secret file with a challenge-handshake authentication protocol (CHAP) user name. For example:

   <secret ephemeral='no' private='yes'>
       <description>Passphrase for the iSCSI example.com server</description>
       <usage type='iscsi'>
           <target>iscsirhel7secret</target>
       </usage>
   </secret>

2. Define the libvirt secret with the virsh secret-define command.

   # virsh secret-define secret.xml

3. Verify the UUID with the virsh secret-list command.

   # virsh secret-list
   UUID                                  Usage
   -------------------------------------------------------------------
   2d7891af-20be-4e5e-af83-190e8a922360  iscsi iscsirhel7secret

4. Assign a secret to the UUID in the output of the previous step using the virsh secret-set-value command. This ensures that the CHAP username and password are in a libvirt-controlled secret list. For example:

   # virsh secret-set-value --interactive 2d7891af-20be-4e5e-af83-190e8a922360
   Enter new value for secret:
   Secret value set

5. Add an authentication entry in the storage pool’s XML file using the virsh edit command, and add an <auth> element, specifying authentication type, username, and secret usage.

   Par exemple :

   <pool type='iscsi'>
     <name>iscsirhel7pool</name>
       <source>
          <host name='192.168.122.1'/>
          <device path='iqn.2010-05.com.example.server1:iscsirhel7guest'/>
          <auth type='chap' username='redhat'>
             <secret usage='iscsirhel7secret'/>
          </auth>
       </source>
     <target>
       <path>/dev/disk/by-path</path>
     </target>
   </pool>

   Note

   The <auth> sub-element exists in different locations within the virtual machine’s <pool> and <disk> XML elements. For a <pool>, <auth> is specified within the <source> element, as this describes where to find the pool sources, since authentication is a property of some pool sources (iSCSI and RBD). For a <disk>, which is a sub-element of a domain, the authentication to the iSCSI or RBD disk is a property of the disk. In addition, the <auth> sub-element for a disk differs from that of a storage pool.

   <auth username='redhat'>
     <secret type='iscsi' usage='iscsirhel7secret'/>
   </auth>

6. To activate the changes, activate the storage pool. If the pool has already been started, stop and restart the storage pool:

   # virsh pool-destroy iscsirhel7pool
   # virsh pool-start iscsirhel7pool