AWS Storage Gateway User Guide
Configuring CHAP Authentication
iscsiadm -m discoverydb -t sendtargets -p
[GATEWAY_IP]
:3260 -o delete
2. Increase the disk timeout value in the rules file.
a. If you are using the RHEL 5 initiator, open the
/etc/udev/rules.d/50-udev.rules
file and
find the following line.
ACTION=="add", SUBSYSTEM=="scsi" , SYSFS{type}=="0|7|14", \
RUN+="/bin/sh -c 'echo
[timeout]
> /sys$$DEVPATH/timeout'"
This rules file does not exist in RHEL 6 or 7 initiators, so you must create it using the following
rule.
ACTION=="add", SUBSYSTEMS=="scsi" , ATTRS{model}=="Storage Gateway",
RUN+="/bin/sh -c 'echo
[timeout]
> /sys$$DEVPATH/timeout'"
To modify the timeout value in RHEL 6, use the following command and then add the lines of
code shown preceding.
sudo vim /etc/udev/rules.d/50-udev.rules
To modify the timeout value in RHEL 7, use the following command and then add the lines of
code shown preceding.
sudo su -c "echo 600 > /sys/block/[device name]/device/
timeout
"
b. Set the
[timeout]
value to 600.
This value represents a timeout of 600 seconds.
3. Restart your system to ensure that the new configuration values take effect.
Before restarting, you must make sure that the results of all write operations to your volumes are
flushed. To do this, unmount storage volumes before restarting.
4. You can test the configuration by using the following command.
udevadm test
[PATH_TO_ISCSI_DEVICE]
This command shows the udev rules that are applied to the iSCSI device.
Configuring CHAP Authentication for Your iSCSI
Targets
AWS Storage Gateway supports authentication between your gateway and iSCSI initiators by using
Challenge-Handshake Authentication Protocol (CHAP). CHAP provides protection against playback
attacks by periodically verifying the identity of an iSCSI initiator as authenticated to access a volume and
VTL device target.
To set up CHAP, you must configure it both on the AWS Storage Gateway console and in the iSCSI
initiator software that you use to connect to the target. Storage Gateway uses mutual CHAP, which is
when the initiator authenticates the target and the target authenticates the initiator.
API Version 2013-06-30
377
