{"id":401,"date":"2018-08-18T14:40:06","date_gmt":"2018-08-18T11:40:06","guid":{"rendered":"http:\/\/kifarunix.com\/?p=401"},"modified":"2024-03-10T16:39:00","modified_gmt":"2024-03-10T13:39:00","slug":"how-to-install-and-configure-iscsi-storage-server-on-ubuntu-18-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/how-to-install-and-configure-iscsi-storage-server-on-ubuntu-18-04\/","title":{"rendered":"How to Install and Configure iSCSI Storage Server on Ubuntu 18.04"},"content":{"rendered":"\n

In this tutorial we are going to learn how to install and configure iSCSI storage server on Ubuntu 18.04. Well, iSCSI, an acronym for Internet Small Computer System Interface<\/strong>, is a Storage Area Network protocol that is used by the organizations to facilitate online storage management. It relies on TCP\/IP networks to send SCSI commands between the initiator<\/strong> (client) and the target<\/strong> (server) that provide block-level access to the storage devices which can either be LVM logical volumes, complete disks, files or partitions.<\/p>\n\n\n\n

Installing iSCSI Storage Server on Ubuntu<\/h2>\n\n\n\n

Key Concepts in iSCSI<\/h3>\n\n\n\n

Below are key concepts used in iSCSI network storage;<\/p>\n\n\n\n

    \n
  • iSCSI Initiator<\/strong><\/code>: The client-side software that enables a device to connect to an iSCSI storage target and use its resources.<\/li>\n\n\n\n
  • iSCSI Target<\/code><\/strong>: The server-side software that presents the storage resources to the initiator as if they were local disks.<\/li>\n\n\n\n
  • LUN (Logical Unit Number)<\/code><\/strong>: A unique identifier that represents a specific logical volume or portion of a physical disk on the iSCSI target.<\/li>\n\n\n\n
  • iSCSI Portal<\/code><\/strong>: The IP address and TCP port number combination that the iSCSI initiator uses to connect to the iSCSI target.<\/li>\n\n\n\n
  • Initiator IQN (iSCSI Qualified Name)<\/code><\/strong>: The unique identifier assigned to the iSCSI initiator to establish a connection with the iSCSI target.<\/li>\n\n\n\n
  • CHAP (Challenge-Handshake Authentication Protocol)<\/strong><\/code>: A security mechanism used for authentication between the iSCSI initiator and target to ensure that only authorized initiators can access the storage.<\/li>\n\n\n\n
  • SCSI (Small Computer System Interface)<\/code><\/strong>: A standard protocol used by the operating system to communicate with storage devices, including iSCSI storage.<\/li>\n\n\n\n
  • MPIO (Multipath I\/O)<\/strong><\/code>: A technique used to create redundant paths between the initiator and target to ensure high availability and load balancing.<\/li>\n\n\n\n
  • Jumbo Frames<\/code><\/strong>: A technique used to increase the packet size in iSCSI networks to improve performance.<\/li>\n\n\n\n
  • Portal<\/strong><\/code>: A portal is a network interface on a target that listens for iSCSI initiator connection requests.<\/li>\n\n\n\n
  • TPG (Target Portal Group)<\/strong><\/code>: a group of portals on the target side that share the same target portal group tag (TPGT). By grouping portals into a TPG, the target can present a single iSCSI target to initiators, even if there are multiple interfaces or network paths to the target. TPGs can be used to provide load balancing, failover, and increased throughput.<\/li>\n\n\n\n
  • ACL<\/strong>: Access Control List that lists iSCSI clients to be granted access to the storage device.<\/li>\n<\/ul>\n\n\n\n

    Read more on man targetcli<\/code>.<\/p>\n\n\n\n

    In our deployment, we will be using Ubuntu 18.04 server as the iSCSI target and Ubuntu 18.04 Desktop as the iSCSI initiator.<\/p>\n\n\n\n

    Install iSCSI Required Packages<\/h3>\n\n\n\n

    To set up an iSCSI target, we need to install an administration tool called targetcli<\/strong> which provides the default interface for managing the target.<\/p>\n\n\n\n

    apt -y install targetcli-fb<\/code><\/pre>\n\n\n\n
    Configure iSCSI Target on Ubuntu<\/h3>\n\n\n\n
    After installing targetcli, let us configure iSCSI target.<\/p>\n\n\n\n
    Create the backend storage devices<\/h4>\n\n\n\n
    In our storage server, we have attached two disks and created two logical volumes;<\/p>\n\n\n\n
    lsblk<\/code><\/pre>\n\n\n\n
    \nNAME             MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT\n...\nsdb                8:16   0    4G  0 disk \n\u2514\u2500vol01-lv_san01 253:2    0    4G  0 lvm  \nsdc                8:32   0   15G  0 disk \n\u2514\u2500vol02-lv_san02 253:3    0   15G  0 lvm<\/strong>\n<\/code><\/pre>\n\n\n\n
    Create iSCSI Backstore\/Block Storage<\/h4>\n\n\n\n
    iSCSI backstore is a virtual disk or LUN (Logical Unit Number) that represents the storage space that is exported to the iSCSI initiators. There are several types of backstores that can be used in iSCSI, such as file-based backstores like iSCSI target files, or block-based backstores like LVM volumes or physical disks.<\/p>\n\n\n\n
    To create iSCSI target backstore, launch the targetcli utility by typing targetcli<\/strong> on terminal<\/p>\n\n\n\n
    targetcli<\/code><\/pre>\n\n\n\n
    This will open an interactive prompt;<\/p>\n\n\n\n
    \ntargetcli shell version 2.1.53\nCopyright 2011-2013 by Datera, Inc and others.\nFor help on commands, type 'help'.\n\n\/>\n<\/code><\/pre>\n\n\n\n
    Next, create new backstore for the iSCSI disk using logical volumes created above as the backend storage device.<\/p>\n\n\n\n
    \/backstores\/block create iscsi_disk_01 \/dev\/vol01\/lv_san01<\/code><\/pre>\n\n\n\n
    \/backstores\/block create iscsi_disk_02 \/dev\/vol02\/lv_san02<\/code><\/pre>\n\n\n\n
    If you run ls command, you should now be able to see created block storage;<\/p>\n\n\n\n
    ls<\/code><\/pre>\n\n\n\n
    \no- \/ ......................................................................................................................... [...]\n  o- backstores .............................................................................................................. [...]\n  | o- block .................................................................................................. [Storage Objects: 2]\n  | | o- iscsi_disk_01 ....................................................... [\/dev\/vol01\/lv_san01 (4.0GiB) write-thru deactivated]\n  | | | o- alua ................................................................................................... [ALUA Groups: 1]\n  | | |   o- default_tg_pt_gp ....................................................................... [ALUA state: Active\/optimized]\n  | | o- iscsi_disk_02 ...................................................... [\/dev\/vol02\/lv_san02 (15.0GiB) write-thru deactivated]\n  | |   o- alua ................................................................................................... [ALUA Groups: 1]\n  | |     o- default_tg_pt_gp ....................................................................... [ALUA state: Active\/optimized]\n  | o- fileio ................................................................................................. [Storage Objects: 0]\n  | o- pscsi .................................................................................................. [Storage Objects: 0]\n  | o- ramdisk ................................................................................................ [Storage Objects: 0]\n  o- iscsi ............................................................................................................ [Targets: 0]\n  o- loopback ......................................................................................................... [Targets: 0]\n<\/code><\/pre>\n\n\n\n
    NB iscsi_disk_nn is the name of the backing storage device. You can call it a name of your choice.<\/p>\n\n\n\n
    Create iSCSI File-based Backstore<\/h4>\n\n\n\n
    If you want, you can also create a file-backed block device. To do this, navigate to fileio directory and create for example, a 1GiB sized file residing on the home directory. <\/p>\n\n\n\n
    \/backstores\/fileio create iscsi_file01 \/home\/disk_file 1GiB<\/code><\/pre>\n\n\n\n
    ls \/backstores\/fileio<\/code><\/pre>\n\n\n\n
    \no- fileio ..................................................................................................... [Storage Objects: 1]\n  o- iscsi_file01 ................................................................ [\/home\/disk_file (1.0GiB) write-back deactivated]\n    o- alua ....................................................................................................... [ALUA Groups: 1]\n      o- default_tg_pt_gp ........................................................................... [ALUA state: Active\/optimized]\n\/>\n<\/code><\/pre>\n\n\n\n
    Create an IQN for the iSCSI target<\/h4>\n\n\n\n
    Next, you need to create an IQN for the iSCSI targets.<\/p>\n\n\n\n
    \/iscsi create iqn.2023-05.com.kifarunix-demo:target00<\/code><\/pre>\n\n\n\n
    When IQN is created, by default a Target Portal Group will be created.<\/p>\n\n\n\n
    Created target iqn.2023-05.com.kifarunix-demo:target00.\nCreated TPG 1.\nGlobal pref auto_add_default_portal=true\nCreated default portal listening on all IPs (0.0.0.0), port 3260.<\/code><\/pre>\n\n\n\n
    As you can see, iSCSI target creates a portal that listens on all interfaces on port 3260\/tcp.<\/p>\n\n\n\n
    Configure ACLs for the TPG<\/h4>\n\n\n\n
    Target Portal Group (TPG) Access Control List (ACL) defines which initiators are allowed to access the storage resources exposed by the target. The TPG ACL is used to provide access control at the Target level. It specifies the initiator names that are allowed or denied access to the target.<\/p>\n\n\n\n
    When a new session is established, the initiator’s name is checked against the TPG ACL. If the initiator name is found in the ACL, access is granted, and the session is established. If the initiator name is not found in the ACL, access is denied, and the session is terminated.<\/p>\n\n\n\n
    To create an ACL for the TPG1 above;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/acls create iqn.2023-05.com.kifarunix-demo:poc<\/code><\/pre>\n\n\n\n
    This creates a node ACL that allows poc server to access the target\u2019s IQN just created.<\/p>\n\n\n\n
    If you want to add multiple clients, specify them comma separated;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/acls create iqn.2023-05.com.kifarunix-demo:poc,iqn.2023-05.com.kifarunix-demo:another-server<\/code><\/pre>\n\n\n\n
    If you want to use IPs instead;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/acls create 192.168.1.100,192.168.1.101<\/code><\/pre>\n\n\n\n
    Configure CHAP Authentication<\/h4>\n\n\n\n
    Configure CHAP Authentication by creating initiators\u2019 users, that will be allowed to access backend storage, and their passwords.<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/acls\/iqn.2023-05.com.kifarunix-demo:poc set auth userid=kifarunix-admin<\/code><\/pre>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/acls\/iqn.2023-05.com.kifarunix-demo:poc set auth password=password<\/code><\/pre>\n\n\n\n
    Create LUNs for the iSCSI disk<\/h4>\n\n\n\n
    Create the LUNs<\/strong> needed to associate a block device with a specific TPG. For our case, we will use iscsi_disk_01<\/strong> block and iscsi_file01<\/strong> file created above to create a LUN.<\/p>\n\n\n\n
    Any new LUN created will be mapped to each ACL that is associated with the TPG.<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/luns create \/backstores\/block\/iscsi_disk_01<\/code><\/pre>\n\n\n\n
    Output;<\/p>\n\n\n\n
    Created LUN 0.\nCreated LUN 0->0 mapping in node ACL iqn.2023-05.com.kifarunix-demo:poc<\/code><\/pre>\n\n\n\n
    File based LUN;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/luns create \/backstores\/fileio\/iscsi_file01<\/code><\/pre>\n\n\n\n
    Create iSCSI Target Portal<\/h4>\n\n\n\n
    Optionally, to configure a target to offer services on specific address, create a portal for that address. Remember the IP address used must be fixed. To do this, Navigate to portals and create it.<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/portals create 192.168.57.45<\/code><\/pre>\n\n\n\n
    If you get the error, Could not create NetworkPortal in configFS<\/code><\/strong>, it is because you already have portal that listens on all IPs;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/portals ls<\/code><\/pre>\n\n\n\n
    o- portals ............................................................................................................ [Portals: 1]\n  o- 0.0.0.0:3260<\/strong> ............................................................................................................. [OK]\n\/><\/code><\/pre>\n\n\n\n
    Thus, to change this, delete the portal;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/portals delete 0.0.0.0 3260<\/code><\/pre>\n\n\n\n
    And re-create the portal;<\/p>\n\n\n\n
    \/iscsi\/iqn.2023-05.com.kifarunix-demo:target00\/tpg1\/portals create 192.168.57.45<\/code><\/pre>\n\n\n\n
    Output;<\/p>\n\n\n\n
    Using default IP port 3260\nCreated network portal 192.168.57.45:3260.<\/code><\/pre>\n\n\n\n
    Open iSCSI Portal on Firewall<\/h4>\n\n\n\n
    Exit the targetcli utility<\/p>\n\n\n\n
    \/> exit<\/strong>\nGlobal pref auto_save_on_exit=true\nConfiguration saved to \/etc\/target\/saveconfig.json<\/code><\/pre>\n\n\n\n
    check whether port 3260 is listening;<\/p>\n\n\n\n
    ss -altnp | grep 3260<\/code><\/pre>\n\n\n\n
    LISTEN     0      256    192.168.57.45:3260                     *:*<\/code><\/pre>\n\n\n\n
    Open iSCSI portal on firewall;<\/p>\n\n\n\n
    ufw allow 3260\/tcp<\/code><\/pre>\n\n\n\n
    Running iSCSI Target Service<\/h4>\n\n\n\n
    Start iSCSI target and enable it to run when the system boots.<\/p>\n\n\n\n
    systemctl enable --now target<\/code><\/pre>\n\n\n\n
    Check status;<\/p>\n\n\n\n
    systemctl status target<\/code><\/pre>\n\n\n\n
    Configure the iSCSI Initiator<\/h3>\n\n\n\n
    Follow these simple steps to configure an iSCSI Initiator.<\/p>\n\n\n\n
    Install iSCSI Initiator Utilities<\/h4>\n\n\n\n
    Run the command, install iSCSI Initiator utilities<\/p>\n\n\n\n
    apt -y install open-iscsi<\/code><\/pre>\n\n\n\n
    Set the iSCSI Initiator Name<\/h4>\n\n\n\n
    Edit the file \/etc\/iscsi\/initiatorname.iscsi<\/code><\/strong> configuration and add the name of the initiator;<\/p>\n\n\n\n
    vim \/etc\/iscsi\/initiatorname.iscsi<\/code><\/pre>\n\n\n\n
    InitiatorName=iqn.2023-05.com.kifarunix-demo:poc<\/code><\/pre>\n\n\n\n
    Save and exit the file<\/p>\n\n\n\n
    Configure Authentication<\/h4>\n\n\n\n
    Open the \/etc\/iscsi\/iscsid.conf<\/code> config and update the iSCSI credentials created before, under CHAP settings section;<\/p>\n\n\n\n
    vim \/etc\/iscsi\/iscsid.conf<\/code><\/pre>\n\n\n\n
    \n# *************\n# CHAP Settings\n# *************\n\n# To enable CHAP authentication set node.session.auth.authmethod\n# to CHAP. The default is None.\nnode.session.auth.authmethod = CHAP<\/strong>\n\n# To configure which CHAP algorithms to enable set\n# node.session.auth.chap_algs to a comma seperated list.\n# The algorithms should be listen with most prefered first.\n# Valid values are MD5, SHA1, SHA256\n# The default is MD5.\n#node.session.auth.chap_algs = SHA256,SHA1,MD5\n\n# To set a CHAP username and password for initiator\n# authentication by the target(s), uncomment the following lines:\nnode.session.auth.username = kifarunix-admin\nnode.session.auth.password = password<\/strong>\n<\/code><\/pre>\n\n\n\n
    Save the file and exit.<\/p>\n\n\n\n
    Restart the iscsid service<\/p>\n\n\n\n
    systemctl restart iscsid open-iscsi<\/code><\/pre>\n\n\n\n
    Perform iSCSI Target Discovery<\/h4>\n\n\n\n
    You can discover available targets using the iscsiadm<\/strong> command. When iscsiadm is operating on discovery mode, three arguments are passed:<\/p>\n\n\n\n