2 .\" The contents of this file are subject to the terms of the
3 .\" Common Development and Distribution License (the "License").
4 .\" You may not use this file except in compliance with the License.
6 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
7 .\" or http://www.opensolaris.org/os/licensing.
8 .\" See the License for the specific language governing permissions
9 .\" and limitations under the License.
11 .\" When distributing Covered Code, include this CDDL HEADER in each
12 .\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
13 .\" If applicable, add the following below this CDDL HEADER, with the
14 .\" fields enclosed by brackets "[]" replaced with your own identifying
15 .\" information: Portions Copyright [yyyy] [name of copyright owner]
18 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
19 .\" Copyright 2014 Nexenta Systems, Inc. All rights reserved.
21 .TH ITADM 8 "April 9, 2016"
23 itadm \- administer iSCSI targets
27 \fBitadm\fR create-target [\fB-a\fR,\fB--auth-method\fR radius | chap | none | default]
28 [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
29 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] [\fB-n\fR,\fB--node-name\fR \fItarget_node_name\fR]
30 [\fB-l\fR,\fB--alias\fR \fIalias\fR] [\fB-t\fR,\fB--tpg\fR \fItpg-name\fR[,\fItpg-name\fR]]
35 \fBitadm\fR modify-target [\fB-a\fR,\fB--auth-method\fR radius | chap | none | default]
36 [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
37 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] [\fB-n\fR,\fB--node-name\fR \fInew_target_node_name\fR]
38 [\fB-l\fR,\fB--alias\fR \fIalias\fR] [\fB-t\fR,\fB--tpg\fR \fItpg-name\fR[,\fItpg-name\fR]] \fItarget_node_name\fR
43 \fBitadm\fR delete-target [\fB-f\fR,\fB--force\fR] \fItarget_node_name\fR
48 \fBitadm\fR list-target [\fB-p\fR,\fB--parsable\fR] [\fB-v\fR,\fB--verbose\fR] [\fItarget_node_name\fR]
53 \fBitadm\fR create-tpg \fItpg_name\fR \fIIP-address\fR[:\fIport\fR] [\fIIP-address\fR[:\fIport\fR]]...
58 \fBitadm\fR list-tpg [\fB-p\fR,\fB--parsable\fR] [\fB-v\fR,\fB--verbose\fR] [\fItpg_name\fR]
63 \fBitadm\fR delete-tpg [\fB-f\fR,\fB--force\fR] \fItpg_name\fR
68 \fBitadm\fR create-initiator [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
69 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] \fIinitiator_node_name\fR
74 \fBitadm\fR modify-initiator [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
75 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] \fIinitiator_node_name\fR
80 \fBitadm\fR list-initiator [\fB-p\fR,\fB--parsable\fR] [\fB-v\fR,\fB--verbose\fR] \fIinitiator_node_name\fR
85 \fBitadm\fR delete-initiator \fIinitiator_node_name\fR
90 \fBitadm\fR modify-defaults [\fB-a\fR,\fB--auth-method\fR radius | chap | none]
91 [\fB-r\fR,\fB--radius-server\fR \fIIP-address\fR[:\fIport\fR]] [\fB-d\fR,\fB--radius-secret\fR]
92 [\fB-D\fR,\fB--radius-secret-file\fR \fIpath\fR][\fB-i\fR,\fB--isns\fR enable | disable]
93 [\fB-I\fR,\fB--isns-server\fR \fIIP-address\fR[:\fIport\fR][,\fIIP-address\fR[:\fIport\fR]]]
98 \fBitadm\fR list-defaults [\fB-p\fR,\fB--parsable\fR]
103 The \fBitadm\fR command manages Internet SCSI (iSCSI) target nodes within the
104 SCSI Target Mode Framework described in \fBstmfadm\fR(8) and
105 \fBlibstmf\fR(3LIB). This allows the iSCSI initiators to access STMF logical
106 units using the iSCSI protocol. In addition to iSCSI target nodes, \fBitadm\fR
107 manages two other classes of managed objects: iSCSI Target Portal Groups, and
108 iSCSI Initiator Node Contexts.
111 \fBitadm\fR is implemented as a set of subcommands with options and operands
112 for each subcommand. These subcommands are described in their own section,
113 below. In addition to its subcommands, \fBitadm\fR has a help command, which
114 displays the utility's usage information. The help command is invoked with the
116 .SS "iSCSI Target Portal Groups"
118 An iSCSI Target Network Portal is an IP address and TCP port that can be used
119 by an initiator node to connect to an iSCSI target. A collection of these
120 portals is called a Target Portal Group (TPG). You can use a TPG to limit
121 access to an iSCSI target. Use the \fBitadm modify\fR \fB-t\fR command to bind
122 a specific iSCSI target to the TPG. An iSCSI listener is created on each IP
123 address that belongs to the TPG, and listens for connections to the iSCSI
127 A TPG is identified by a unique name provided when the TPG is created. A
128 numerical "Target Portal Group Tag" from the range 2-65535 is automatically
129 generated when the TPG is created. The Target Portal Group Tag 1 is reserved
130 for the "default" target portal group that is used when no explicit Target
131 Portal Groups are set on the target. The portal for the default TPG matches
132 requests from all network interfaces on port 3260.
133 .SS "iSCSI Initiator Node Contexts"
135 Certain operations such as authentication by means of Challenge Handshake
136 Authentication Protocol (CHAP) require parameters associated with a remote
137 iSCSI Initiator Node. These parameters are associated with an iSCSI Initiator
138 Node Context. An iSCSI Initiator Node Context is identified by its Initiator
139 Node Name, formatted in either IQN or EUI format (see RFC 3720). For example:
143 iqn.1986-03.com.sun:01:e00000000000.47d55444
149 .SS "Specifying IP Addresses"
151 A number of \fBitadm\fR subcommands require that you specify one or more IP
152 addresses with optional port numbers. For IPv4, use standard dotted decimal
153 notation. For IPv6, enclose addresses in square brackets. The following are
154 example specifications.
160 \fBIPv6\fR: [1080:0:0:0:8:800:200C:417A]
161 [1080:0:0:0:8:800:200C:417A]:3260
168 The following are the \fBitadm\fR subcommands with their options.
169 .SS "\fBitadm create-target\fR"
172 itadm create-target [-a,--auth-method radius | chap | none | default]
174 [-S,--chap-secret-file \fIpath\fR] [-u,--chap-user \fIchap-user-name\fR]
175 [-n,--node-name \fItarget_node_name\fR] [-l,--alias \fIalias\fR]
176 [-t,--tpg \fItpg-name\fR[,\fItpg-name\fR,...]]
183 Create a iSCSI target with the specified options. Options are as follows.
187 \fB\fB-a\fR,\fB--auth-method\fR \fBradius | chap | none | default\fR\fR
191 Specifies the authentication method to use for the target. Valid values are
192 \fBradius\fR, \fBchap\fR, and \fBnone\fR. \fBchap\fR indicates that initiators
193 connecting to this target must be authenticated using the Challenge Handshake
194 Authentication Protocol (CHAP). \fBradius\fR indicates initiators should also
195 be authenticated by means of CHAP but the required authentication parameters
196 should be obtained from a central RADIUS server (see the \fBradius-server\fR
197 and \fBradius-secret\fR options). \fBnone\fR means that no authentication is
198 required to connect to the target. \fBdefault\fR means the target will use the
199 global setting of this property. (See the \fBmodify-defaults\fR subcommand.)
205 \fB\fB-s\fR,\fB--chap-secret\fR\fR
209 The CHAP secret to send during mutual CHAP authentication. There is no default
210 for this property. Maximum length is 255 characters; minimum required length is
217 \fB\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR\fR
221 Path to a temporary file containing the CHAP secret as described in the
228 \fB\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR\fR
232 Specifies the CHAP username for a target for use in mutual CHAP authentication.
233 This value is allowed only for targets, cannot be set globally, and is used
234 only when the initiator node is configured to use mutual CHAP authentication.
235 If no value is specified then the target node name is used as the username. See
242 \fB\fB-n\fR,\fB--node-name\fR \fItarget_node_name\fR\fR
246 An iSCSI Target Node is identified by its Target Node Name, formatted in either
247 IQN or EUI format (see RFC 3720). This option establishes that name.
253 \fB\fB-l\fR,\fB--alias\fR \fIalias\fR\fR
257 An alternate identifier associated with a target node. The identifier does not
264 \fB\fB-t\fR,\fB--tpg\fR \fItpg-name\fR[,\fItpg-name\fR,...]\fR
268 A list of Target Portal Group (TPG) identifiers that specifies the TPGs that an
269 initiator can use to access a specific target or the keyword \fBdefault\fR. If
270 \fBdefault\fR is specified, the target will use the default portal,
271 \fBINADDR_ANY:3260\fR.
274 .SS "\fBitadm modify-target\fR"
277 itadm modify-target [\fB-a\fR,\fB--auth-method\fR radius | chap | none | default]
278 [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
279 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] [\fB-n\fR,\fB--node-name\fR \fInew_tgt_node_name\fR]
280 [\fB-l\fR,\fB--alias\fR \fIalias\fR] [\fB-t\fR,\fB--tpg\fR \fItpg-name\fR[,\fItpg-name\fR]] \fItarget_node_name\fR
287 Modify an iSCSI target according to the specified options. Options are as
292 \fB\fB-a\fR,\fB--auth-method\fR \fBradius | chap | none | default\fR\fR
296 As described under the \fBcreate-target\fR subcommand, above.
302 \fB\fB-s\fR,\fB--chap-secret\fR\fR
306 As described under the \fBcreate-target\fR subcommand, above.
312 \fB\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR\fR
316 As described under the \fBcreate-target\fR subcommand, above.
322 \fB\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR\fR
326 As described under the \fBcreate-target\fR subcommand, above. To remove an
327 explicitly set CHAP username use \fB-u\fR \fBnone\fR.
333 \fB\fB-n\fR,\fB--node-name\fR \fItarget_node_name\fR\fR
337 Renames the target. See also the description of \fB-n\fR under the
338 \fBcreate-target\fR subcommand, above.
344 \fB\fB-l\fR,\fB--alias\fR \fIalias\fR\fR
348 As described under the \fBcreate-target\fR subcommand, above. To remove an
349 explicitly set alias use \fB-l\fR \fBnone\fR.
355 \fB\fB-t\fR,\fB--tpg\fR \fItpg-name\fR[,\fItpg-name\fR,...]\fR
359 As described under the \fBcreate-target\fR subcommand, above.
362 .SS "\fBitadm list-target\fR"
365 itadm list-target [\fB-p\fR,\fB--parsable\fR] [\fB-v\fR,\fB--verbose\fR] [\fItarget_node_name\fR]
372 List information about the configured targets. If \fItarget_node_name\fR is
373 specified, list only the information for that target. Options are as follows.
378 \fB\fB-p\fR,\fB--parsable\fR\fR
382 Used for scripting mode. Do not print headers and separate fields by a single
383 tab instead of arbitrary white space.
389 \fB\fB-v\fR,\fB--verbose\fR\fR
396 .SS "\fBitadm delete-target\fR"
399 itadm delete-target [\fB-f\fR,\fB--force\fR] \fItarget_node_name\fR
406 Delete the target specified by \fItarget_node_name\fR. The target must be
407 \fBoffline\fR before it can be deleted. Option is as follows.
411 \fB\fB-f\fR,\fB--force\fR\fR
415 If the target persists in an online state, this option attempts to offline the
416 target before deleting it.
419 .SS "\fBitadm create-tpg\fR"
422 itadm create-tpg \fItpg_name\fR \fIIP-address\fR[:\fIport\fR]...
429 Create an iSCSI target portal group made up of the specified portals and assign
430 it the identifier \fItpg_name\fR. Each portal is an IP address and port pair.
431 IPv4 portals are specified in dotted address notation, for example,
432 \fB172.31.255.255\fR. IPv6 portal addresses must be enclosed in square
436 This subcommand has no options.
437 .SS "\fBitadm list-tpg\fR"
440 itadm list-tpg [\fB-p\fR,\fB--parsable\fR] [\fB-v\fR,\fB--verbose\fR] [\fItpg_name\fR]
447 List information about the configured target portal group. If \fItpg_name\fR is
448 specified then list only the information about the target portal group
449 associated with that \fItpg_name\fR. Options are as follows.
454 \fB\fB-p\fR,\fB--parsable\fR\fR
458 Used for scripting mode. Do not print headers and separate fields by a single
459 tab instead of arbitrary white space.
465 \fB\fB-v\fR,\fB--verbose\fR\fR
472 .SS "\fBitadm delete-tpg\fR"
475 itadm delete-tpg [\fB-f\fR,\fB--force\fR] \fItpg_name\fR
482 Delete the target portal group associated with \fItpg_name\fR. Option is as
487 \fB\fB-f\fR,\fB--force\fR\fR
491 If the TPG is associated with any targets, the request to delete will be denied
492 unless this option is specified.
495 .SS "\fBitadm create-initiator\fR"
498 itadm create-initiator [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
499 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] \fIinitiator_node_name\fR
506 Configure parameters associated with the remote initiator named
507 \fIinitiator_node_name\fR. Options are as follows.
511 \fB\fB-s\fR,\fB--chap-secret\fR\fR
515 As described under the \fBcreate-target\fR subcommand, above.
521 \fB\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR\fR
525 As described under the \fBcreate-target\fR subcommand, above.
531 \fB\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR\fR
535 Specifies the CHAP username for an initiator, for use in CHAP authentication.
536 If no value is specified then the initiator node name is used as the username.
539 .SS "\fBitadm modify-initiator\fR"
542 itadm modify-initiator [\fB-s\fR,\fB--chap-secret\fR] [\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR]
543 [\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR] \fIinitiator_node_name\fR
550 Modify parameters associated with the remote initiator named
551 \fIinitiator_node_name\fR. Options are as follows.
555 \fB\fB-s\fR,\fB--chap-secret\fR\fR
559 As described under the \fBcreate-target\fR subcommand, above.
565 \fB\fB-S\fR,\fB--chap-secret-file\fR \fIpath\fR\fR
569 As described under the \fBcreate-target\fR subcommand, above.
575 \fB\fB-u\fR,\fB--chap-user\fR \fIchap-user-name\fR\fR
579 Specifies the CHAP username for an initiator, for use in CHAP authentication.
580 If no value is specified then the initiator node name is used as the username.
583 .SS "\fBitadm delete-initiator\fR"
586 itadm delete-initiator \fIinitiator_node_name\fR
593 Delete parameters associated with the remote initiator named
594 \fIinitiator_node_name\fR. This subcommand has no options.
595 .SS "\fBitadm list-initiator\fR"
598 \fBitadm\fR list-initiator [\fB-p\fR,\fB--parsable\fR] [\fB-v\fR,\fB--verbose\fR] \fIinitiator_node_name\fR
605 List parameters associated with the initiator named \fIinitiator_node_name\fR.
606 Options are as follows.
611 \fB\fB-p\fR,\fB--parsable\fR\fR
615 Used for scripting mode. Do not print headers and separate fields by a single
616 tab instead of arbitrary white space.
622 \fB\fB-v\fR,\fB--verbose\fR\fR
629 .SS "\fBitadm modify-defaults\fR"
632 itadm modify-defaults [\fB-a\fR,\fB--auth-method\fR radius | chap | none]
633 [\fB-r\fR,\fB--radius-server\fR \fIIP-address\fR[:\fIport\fR]] [\fB-d\fR,\fB--radius-secret\fR]
634 [\fB-D\fR,\fB--radius-secret-file\fR \fIpath\fR][\fB-i\fR,\fB--isns\fR enable | disable]
635 [\fB-I\fR,\fB--isns-server\fR \fIIP-address\fR[:\fIport\fR][,\fIIP-address\fR[:\fIport\fR]]]
642 Modify default parameters. Options are as follows.
646 \fB\fB-a\fR,\fB--auth-method\fR \fBradius | chap | none\fR\fR
650 Specifies the default authentication method to use for all targets. Valid
651 values are \fBradius\fR, \fBchap\fR, and \fBnone\fR. \fBchap\fR indicates that
652 initiators connecting to this target must be authenticated using Challenge
653 Handshake Authentication Protocol (CHAP). \fBradius\fR indicates initiators
654 should also be authenticated by means of CHAP, but the required authentication
655 parameters should be obtained from a central RADIUS server. (See
656 \fB--radius-server\fR and \fB--radius-secret\fR options.) \fBnone\fR means that
657 no authentication is required to connect to the target. Individual targets can
658 override this global setting using the \fB-a\fR option of the
659 \fBcreate-target\fR and \fBmodify-target\fR subcommands.
665 \fB\fB-d\fR,\fB--radius-secret\fR\fR
669 RADIUS Shared Secret for centralized CHAP authentication.
675 \fB\fB-D\fR,\fB--radius-secret-file\fR \fIpath\fR\fR
679 Path to a temporary file containing the CHAP secret as described in the
686 \fB\fB-i\fR,\fB--sns\fR \fBenable | disable\fR\fR
690 Specifies whether targets should be registered with the set of defined iSCSI
691 Name Service (iSNS) servers.
697 \fB\fB-I\fR,\fB--isns-server\fR
698 \fIIP-address\fR[:\fIport\fR][,\fIIP-address\fR[:\fIport\fR],...]\fR
702 Defines a list of iSNS servers with which iSCSI target nodes will be registered
703 when the \fBisns\fR option associated with the respective target is set. Up to
704 eight iSNS servers can be specified. To remove all iSNS servers, use \fB-I\fR
711 \fB\fB-r\fR,\fB--radius-server\fR \fIIP-address\fR[:\fIport\fR]\fR
715 Specify the IP address of the RADIUS server used for centralized CHAP
719 .SS "\fBitadm list-defaults\fR"
722 itadm list-defaults [\fB-p\fR,\fB--parsable\fR]
729 List information about the default properties. Option is as follows.
734 \fB\fB-p\fR,\fB--parsable\fR\fR
738 Used for scripting mode. Do not print headers and separate fields by a single
739 tab instead of arbitrary white space.
744 \fBExample 1 \fRCreating a Target
747 The following command creates a target.
752 # \fBitadm create-target\fR
753 Target iqn.1986-03.com.sun:02:72e1b181-7bce-c0e6-851e-ec0d8cf14b7a
760 \fBExample 2 \fRCreating a Target with a Specific Name
763 The following command creates a target with a specific IQN.
768 # \fBitadm create-target -n eui.20387ab8943ef7548\fR
770 # \fBitadm create-target \e
771 -n iqn.1986-03.com.sun:02:a9a366f8-cc2b-f291-840948c7f29e\fR
777 \fBExample 3 \fRChanging a Name
780 The following command changes an IQN for an existing target.
785 # \fBitadm modify-target -n eui.20387ab8943ef7548 \e
786 iqn.1986-03.com.sun:02:a9a366f8-909b-cc2b-f291-840948c7f29e\fR
792 \fBExample 4 \fRSetting up CHAP Authentication
795 The following command sets up CHAP authentication for a target using the
796 default CHAP username.
801 # \fBitadm modify-initiator -s iqn.1986-03.com.sun:01:e00000000000.47d55444\fR
802 \fBEnter CHAP secret:\fR *********
803 \fBRe-enter secret:\fR *********
805 # \fBitadm modify-target -a chap eui.20387ab8943ef7548\fR
811 \fBExample 5 \fRCreating Target Portal Groups
814 The following command creates two target portal groups, \fBA\fR and \fBB\fR,
815 using port 8000 for the addresses in TPG 2.
820 # \fBitadm create-tpg A 192.168.0.1 192.168.0.2\fR
821 # \fBitadm create-tpg B 192.168.0.2:8000 192.168.0.2:8000\fR
827 \fBExample 6 \fRConfiguring a Target to Use TPGs
830 The following command configures a target to use TPGs A and B.
835 # \fBitadm modify-target -t A,B eui.20387ab8943ef7548\fR
841 \fBExample 7 \fRSetting up RADIUS Authentication for Specific Target
844 The following command sets up RADIUS authentication for a specific target.
849 # \fBitadm modify-defaults -r 192.168.10.1 -d\fR
850 \fBEnter RADIUS secret:\fR *********
851 \fBRe-enter secret:\fR *********
853 # \fBitadm modify-target -a radius eui.20387ab8943ef7548\fR
859 \fBExample 8 \fRSetting up RADIUS Authentication for All Targets
862 The following command sets up RADIUS authentication for all targets.
867 # \fBitadm modify-defaults -d -r 192.168.10.1 -a radius\fR
868 \fBEnter RADIUS secret:\fR *********
869 \fBRe-enter secret:\fR *********
876 The preceding command assumes all targets were created with \fB-a\fR
880 \fBExample 9 \fRListing Default Properties
883 The following command lists default properties.
888 # \fBitadm list-defaults\fR
889 iSCSI Target Default Properties:
893 radiusserver: \fInone\fR
896 isnsserver: 2.3.4.5,4.5.6.7
902 \fBExample 10 \fRListing Targets
905 The following command lists targets.
910 # \fBitadm list-target\fR
911 TARGET NAME STATE SESSIONS
912 iqn.1986-03.com.sun:02:72e1b181-7bce-c0e6-851e-ec0d8cf14b7a online 0
913 iqn.1986-03.com.sun:02:2cb0c526-c05a-e279-e396-a367006f4227 online 0
914 iqn.1986-03.com.sun:02:d14125bb-1c9d-c28d-97b0-f89259b642f3 online 0
915 iqn.1986-03.com.sun:02:03ff9fc5-794a-e9b4-a081-bb82917c292a online 0
921 \fBExample 11 \fRListing Targets (Verbose)
924 The following command lists targets with the verbose option.
929 # \fBitadm list-target -v\fR
930 TARGET NAME STATE SESSIONS
931 iqn.1986-03.com.sun:02:d23e68d8-2d79-c988-98e7-a6361689d33c online 0
933 auth: none (defaults)
935 targetchapsecret: unset
937 iqn.1986-03.com.sun:02:94ec46d4-c8e1-6993-ef03-ffc1dcd66606 online 1
941 targetchapsecret: unset
942 tpg-tags: nge1_ipv4 = 3
948 \fBExample 12 \fRListing a Specific Target
951 The following command lists targets with the verbose option.
956 # \fBitadm list-target -v \e
957 iqn.1986-03.com.sun:02:2cb0c526-c05a-e279-e396-a367006f4227\fR
958 TARGET NAME STATE SESSIONS
959 iqn.1986-03.com.sun:02:2cb0c526-c05a-e279-e396-a367006f4227 online 1
963 targetchapsecret: unset
964 tpg-tags: nge1_ipv4 = 3
971 See \fBattributes\fR(5) for descriptions of the following attributes:
979 ATTRIBUTE TYPE ATTRIBUTE VALUE
981 Interface Stability Committed
986 \fBiscsiadm\fR(8), \fBstmfadm\fR(8), \fBlibstmf\fR(3LIB), \fBattributes\fR(5)