ceph / ceph/ceph-iscsi

can't handle discovery auth requests when discovery auth is disabled

Open
#68 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
68
Forks
58
PR merge metrics
No merged PRs in 30d

Description

The Ceph iSCSI gateway doesn't allow target discovery when discovery_auth is disabled but the client sends discovery_auth requests

Apr 18 13:05:01 ceiscsi0 kernel: CHAP user or password not set for Initiator ACL
Apr 18 13:05:01 ceiscsi0 kernel: Security negotiation failed.
Apr 18 13:05:01 ceiscsi0 kernel: iSCSI Login negotiation failed.

This is especially annoying with oVirt, where you can only give one set of credentials for discovery and target auth and discovery auth requests are always sent. When I don't want to have the same credentials for both phases on the gateway and I disable discovery_auth, oVirt can't login. Other iSCSI vendors (FreeNAS) don't have this limitation.

I don't know if this is the right place to report it, but I would very much appreciate if this could be resolved.

thank you

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how the Ceph iSCSI gateway handles discovery_auth settings and discovery authentication requests, using the reported CHAP and iSCSI login failure messages as the reproduction context. Determine the intended behavior when discovery_auth is disabled and verify that clients such as oVirt can complete discovery without requiring discovery credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.