iSCSI target authentication

[jtack10]

Hello,

I am looking for a way to automatically revoke access to an iSCSI target. Basically, I want to be able to provide access to a target for a specific user by providing them with a kind of ticket. Later, I would like to be able to revoke that ticket and have the access to the iSCSI target revoked for that user.

I was able to set up a target with CHAP and found that when I remove a user from the authentication group, access is revoked. I was wondering if anyone could give me some advice on how I might accomplish this in a more automated way.

I know very little about CHAP and iSCSI, but was thinking that if CHAP uses PAM, I may be able to provide a PAM module to do what I want. I may be way off base, so any ideas are appreciated.

Thanks for any assistance!

 

[jtack10]

A little more digging and I see that FreeNAS uses istgt. Looking at the source code for that, it does not look like it uses PAM. It has its own authentication built in. I am wondering if I could put a service on a FreeNAS server that changes the auth.conf file in /var/etc/iscsi. Is that possible, or am I barking up the wrong tree?