Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication

Cómo se verifica

Método de auditoría: Comando de shell

out=$(esxcli iscsi adapter list 2>/dev/null) || exit 1
ad=$(printf '%s\n' "$out" | awk 'NR > 2 && $1 ~ /^vmhba/ {print $1}')
bad=''
for a in $ad; do
  u=$(esxcli iscsi adapter auth chap get -A "$a" -d uni 2>/dev/null | sed -n 's/^ *Level: *//p' | head -n 1)
  m=$(esxcli iscsi adapter auth chap get -A "$a" -d mutual 2>/dev/null | sed -n 's/^ *Level: *//p' | head -n 1)
  [ "$u" = required ] && [ "$m" = required ] || bad="$bad $a(uni=${u:-?},mutual=${m:-?})"
done
[ -z "$bad" ] && echo compliant || echo "iSCSI adapters without bidirectional CHAP:$bad"

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To enable bidirectional CHAP authentication for iSCSI traffic, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand Storage. 3. Select Storage Adapters then select the iSCSI Adapter. 4. Under Properties click on Edit next to Authentication. 5. Next to Authentication Method select Use bidirectional CHAP from the dropdown. 6. Specify the outgoing CHAP name. Make sure that the name you specify matches the name configured on the storage side. To set the CHAP name to the iSCSI adapter name, select "Use initiator name".

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target vmware