LEARN. PRACTICE. GROW.Separate access controls
The lab uses CHAP for the target to authenticate the initiator. It creates a synthetic account and binds it to the specific target. Both portals’ local records receive method, username and password. Discovery and normal login have different client configuration scopes; successful discovery does not establish session authentication. Even accepted login does not establish that every LUN is authorized and visible. Investigation should continue with the intended resource and applicable mappings. The guide uses only its own target and LUN without representing bank policy. Explain aloud which stage each observation confirms before deciding whether access is ready for the consumer.
Use a negative control before a positive one
The first login attempt deliberately uses the wrong synthetic password. In the executed version, iscsiadm returns 24 with an authorization-failure indication; no sessions or SCSI disks appear. The guide checks those conditions rather than accepting any error as proof of CHAP. It then updates records with the correct value and establishes two paths. Credentials are public values created exclusively for training in a disposable VM. An actual ticket should retain authorized target, portal, time and useful diagnosis with controlled configuration references rather than copied secrets. Paired negative and positive results are more informative than keeping only a successful screenshot: they relate tested configuration to an observed access decision.
Prepare per-portal rotation and recovery
After changing a local credential, an already established session may continue I/O without exercising the next login. The plan needs controlled new authentication and continuity criteria. In a fictional case, B authenticates with new configuration while A fails. Compare effective records and target binding before removing controls or changing volume identities. Preserve required access while resolving the discrepancy. The lab does not perform real secret rotation: it rejects a wrong value, accepts the correct one and confirms new login after growth. The workshop asks learners to prepare a rotation plan with owners, per-portal checks, stop conditions and communication of degraded state.
Deliver evidence with boundaries and acceptance criteria
CHAP does not establish encrypted traffic, and a marker hash does not establish batch reconciliation. If the project requires these properties, keep requirements open until specific evidence exists. Algorithm support or a client default also does not represent organizational approval. Check versions and policy applicable to the destination. At lab closure, confirm removal of map, sessions, target, owned account and backing file, plus restoration of saved configuration. The VM is powered off after results are collected. To practise an international meeting, prepare a short English message stating demonstrated milestones, missing criteria and who will collect the next evidence. Authoring the workshop does not mean participants have already performed it or an independent specialist has reviewed it.
# Public synthetic values are used only in the disposable lab.
# Do not copy real credentials into commands, tickets or teaching reports.
# Evidence: content/labs/san-growth/evidence.json
# wrongChapRejected: returncode=24, sessionExit=21, scsiDisks=[]
# authenticatedRejoin: paths=2, newMarkerPreserved=true
# Scope: initiator authentication by the target.
# Not tested: mutual authentication, encrypted transport, real secret rotation.
# Replay guide: content/labs/san-growth/README.txtA wrong synthetic password produces error 24 and no session; the correct one permits two paths to the same LUN.
Common pitfalls
Confusing CHAP with encryption, discovery with login, an old session with new-credential validation or training values with enterprise policy.
Related topics: Storage · Linux Administration · Change Management
Evidence should show the exercised control, per-portal outcomes and security and operational requirements still outstanding.
Reference: Open-iSCSI configuration: discovery and session CHAP scopes · BigSavant SAN 2026-09; selected RHEL 9, ONTAP 9 and iSCSI behavior