Proxmox Unable to Connect to TrueNAS iSCSI Target Using CHAP Authentication

[cyberquarks]

#### Problem Description:
I am experiencing persistent issues connecting my Proxmox server to a TrueNAS iSCSI target using CHAP authentication. Despite configuring both TrueNAS and Proxmox according to the documentation, the connection fails with an authentication error.

#### Environment Details:
- **Proxmox Version:** Proxmox VE 7.x
- **TrueNAS Version:** TrueNAS Scale (latest stable version)
- **Network Configuration:**
- Proxmox IP: `192.168.2.100`
- TrueNAS IP: `192.168.2.105`
- iSCSI Port: `3260`

#### Error Message:
```
iscsiadm: Could not log into all portals
root@pve:~# iscsiadm -m node -T iqn.2005-10.org.freenas.ctl:cassandra-db1 -p 192.168.2.105 --login
Logging in to [iface: default, target: iqn.2005-10.org.freenas.ctl:cassandra-db1, portal: 192.168.2.105,3260]
iscsiadm: initiator reported error (24 - iSCSI login failed due to authorization failure)
iscsiadm: Could not log into all portals
```

### TrueNAS Configuration:
1. **Global Configuration:**
- Base Name: `iqn.2005-10.org.freenas.ctl`
- iSCSI listen port: `3260`

2. **Portals:**
- Portal Group ID: `1`
- Listen: `0.0.0.0:3260`
- Discovery Auth Method: `CHAP`
- Discovery Auth Group: `1`

3. **Initiators Groups:**
- Group ID: `1`
- Initiators: `Allow all initiators`

4. **Authorized Access:**
- Group ID: `1`
- User: `cassandra`
- Peer User: (if applicable)
- Ensure the password for the `cassandra` user is correctly set.

5. **Targets:**
- Target Name: `cassandra-db1`
- Portal Group ID: `1` (cassandra-db1)
- Initiator Group ID: `1` (ALL Initiators Allowed)
- Authentication Method: `CHAP`
- Authentication Group Number: `1`

6. **Extents:**
- Extent Name: `cassandra-db1`
- Device/File: `zvol/oasis/cassandra-db1`
- Ensure it is enabled and properly configured.

7. **Associated Targets:**
- Target: `cassandra-db1`
- LUN ID: `0`
- Extent: `cassandra-db1`

### Proxmox Configuration:
1. **Storage Configuration:**
- Edit `/etc/pve/storage.cfg` to include the iSCSI storage entry with CHAP credentials:
```plaintext
iscsi: iscsi-cassandra-db1
portal 192.168.2.105
target iqn.2005-10.org.freenas.ctl:cassandra-db1
content none
nodes pve
username cassandra
password your_password
```

2. **iSCSI Initiator Settings:**
- Use the following commands to update the iSCSI initiator settings on Proxmox:
```bash
iscsiadm -m node -T iqn.2005-10.org.freenas.ctl:cassandra-db1 -p 192.168.2.105 --op update -n node.session.auth.authmethod -v CHAP
iscsiadm -m node -T iqn.2005-10.org.freenas.ctl:cassandra-db1 -p 192.168.2.105 --op update -n node.session.auth.username -v cassandra
iscsiadm -m node -T iqn.2005-10.org.freenas.ctl:cassandra-db1 -p 192.168.2.105 --op update -n node.session.auth.password -v your_password
iscsiadm -m node -T iqn.2005-10.org.freenas.ctl:cassandra-db1 -p 192.168.2.105 --login
```

3. **Verify iSCSI Initiator Name:**
- Ensure the initiator name on Proxmox matches what is allowed on TrueNAS:
```bash
cat /etc/iscsi/initiatorname.iscsi
```
- The content should be:
```plaintext
InitiatorName=iqn.1993-08.org.debian:01:f332ba64e9ee
```

### Troubleshooting Steps Taken:
1. Verified CHAP credentials on TrueNAS and Proxmox.
2. Ensured the iSCSI initiator name matches on both TrueNAS and Proxmox.
3. Confirmed network connectivity between Proxmox and TrueNAS using `nc -zv 192.168.2.105 3260`.
4. Restarted the iSCSI service on TrueNAS (`service ctld restart`).
5. Reviewed Proxmox logs for detailed errors using `journalctl -xe | grep iscsi` and `dmesg | grep iscsi`.

### Logs:
- **Proxmox Logs:**
```
May 28 01:06:45 pve iscsid[3336856]: Could not set session428 priority. READ/WRITE throughout and latency could be affected.
May 28 01:06:45 pve iscsid[3336856]: Login failed to authenticate with target iqn.2005-10.org.freenas.ctl:cassandra-db1
May 28 01:06:45 pve iscsid[3336856]: session 428 login rejected: Initiator failed authentication with target
May 28 01:06:45 pve iscsid[3336856]: Connection428:0 to [target: iqn.2005-10.org.freenas.ctl:cassandra-db1, portal: 192.168.2.105,3260] through [iface: default] is shutdown.
```

### Request for Help:
Despite following the steps mentioned, I am still unable to connect to the iSCSI target from Proxmox. Any insights or suggestions on what might be causing the authentication failure would be greatly appreciated.

### Additional Information:
If there are any specific details or configurations that I need to check, please let me know.

Thank you in advance for your assistance!

 

[Hannes Laimer]

Hey,

does your password contain any special characters? Could you try a plain text one, does it work with that?

 

[cyberquarks]

Hi, I changed the password to a simple one, like 'cassandra123' but still throws a similar error.

 

[bbgeek17]

username cassandra
password your_password

If I am not mistaken, these are not PVE iSCSI storage pool/plugin options.
Proxmox iSCSI storage pools do not support CHAP authentication directly. You would need to modify your iscsid.conf file.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[cyberquarks]

If I am not mistaken, these are not PVE iSCSI storage pool/plugin options.
Proxmox iSCSI storage pools to not support CHAP authentication directly. You would need to modify your iscsid.conf file.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

I have another iSCSI share without authentication and it works. If not having CHAP is not a security risk, I'm fine not having a password.

 

[bbgeek17]

I have another iSCSI share without authentication and it works.

Thats because default iscsd.conf is CHAP'less

If not having CHAP is not a security risk, I'm fine not having a password.

That depends on your security view of the world. If it's your homelab, my guess is you can probably live without it...
Can CHAP save you if your network/host was compromised? Given that it's listed in plain text in standard Linux config, probably not.
Is it helpful to prevent human error when you have 10s/100s of targets/hosts? Sure.

It's up to you.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox