If you want to create and manage iSCSI targets with Fedora or RHEL, you stumble upon tgtd and tgtadm. This tools are easy to use but have some obstacles to take care of. This is a quick guide on how to use tgtd and tgtadm.
iSCSI terminology
In the iSCSI world, we not taking about server and client, but iSCSI-Targets, which is the server and iSCSI-Initiators which are the clients
Install the tool set
It is just one package to install, afterwards enable the service:
target:~# yum install scsi-target-utils target:~# chkconfig tgtd on target:~# service tgtd start
Or Systemd style:
target:~# systemctl start tgtd.service target:~# systemctl enable tgtd.service
Online configuration vs. configuration file
There are basically two ways of configuring iSCSI targets:
- Online configuration with tgtadm, changes are getting available instantly, but not consistent over reboots
- Configuration files. Changes are presistent, but not instantly available
Well, there is the dump parameter for tgtadm but i.e. passwords are replaced with “PLEASE_CORRECT_THE_PASSWORD” which makes tgtadm completely useless if you are using CHAP authentication.
If you do not use CHAP authentication and use IP based ACLs instead, tgtadm can help you, just dump the config to /etc/tgt/conf.d
Usage of tgtadm
After you have created the storage such as a logical volume (used in this example), a partition or even a file, you can add the first target:
target:~# tgtadm --lld iscsi --op new --mode target --tid 1 --targetname iqn.2013-07.com.example.storage.ssd1
Then you can add a LUN (logical Unit) to the target
target:~# tgtadm --lld iscsi --op new --mode logicalunit --tid 1 --lun 1 --backing-store /dev/vg_storage_ssd/lv_storage_ssd
It is always a good idea to restrict access to your iSCSI targets. There are two ways to do so: IP based and user (CHAP Authentication) based ACL.
In this example we first add two addresses and later on remove one of them again just as a demo
target:~# tgtadm --lld iscsi --mode target --op bind --tid 1 --initiator-address=192.168.0.106 target:~# tgtadm --lld iscsi --mode target --op bind --tid 1 --initiator-address=192.168.0.107
Go to both initiators where the IPs and check if the Targets are visible:
iscsiadm --mode discovery --type sendtargets --portal 192.168.0.1
Lets remove the ACL for the IP address 192.168.0.107
target:~# tgtadm --lld iscsi --mode target --op unbind --tid 1 --initiator-address=192.168.0.107
Test if the Target is still visible on the host with IP address 192.168.0.107, it is not anymore.
If you want to use CHAP authentication, please be aware that tgtadm –dump does not save password, so initiators will not be able to login after a restart of the tgtd.
To add a new user:
target:~# tgtadm --lld iscsi --op new --mode account --user iscsi-user --password secret
And add the ACL to the target:
target:~# tgtadm --lld iscsi --op bind --mode account --tid 2 --user iscsi-user
To remove an account for the target:
target:~# tgtadm --lld iscsi --op unbind --mode account --tid 2 --user iscsi-user
As a wrote further above, configurations done by tgtadm are not persistent over reboot or restart of tgtd. For basic configurations as descibed above, the dump parameter is working fine. As configuration files in /etc/tgt/conf.d/ are automatically included, you just dump the config into a separate file.
target:~# tgt-admin --dump |grep -v default-driver > /etc/tgt/conf.d/my-targets.conf
The other way round
If you are using more sophisticated configuration, you probably want to manage your iSCSI configration the other way round.
You can edit your configuration file(s) in /etc/tgt/conf.d and invoke tgt-admin with the respective parameters to update the config instantly.
tgt-admin (not to be mistaken as tgtadm) is a perl script which basically parses /etc/tgt/targets.conf and updates the targets by invoking tgtadm.
To update your Target(s) issue:
tgt-admin --update ALL --force
For all your targets, incl. active ones (–force) or
tgt-admin --update --tid=1 --force
For updating Target ID 1
SIGKILL is nasty but sometimes needed
tgtd can not be stopped as usual daemons, you need to do a sledgehammer operation and invoke kill -9 to the process followed by service tgtd start command.
How the start up and stop process is working in a proper workaround way is being teached by Systemd, have a look at /usr/lib/systemd/system/tgtd.service which does not actually stop tgtd but just removes the targets.
Conclusion
tgtadm can be help- and sometimes harmful. Carefully consider what is the better way for you, creating config files with tgtadm or update the configuration files and activate them with tgt-admin.