Securing VSAN Free Cluster

[thx1200]

Hello, now that my lab servers are successfully working, I want to lock down my VSAN infrastructure. The documentation seems to do a good job of discussing best practices from the GUI, but I can't find good information on how to do it from the command line or by editing the config files. Can somebody point me in the right direction?

For my understanding, I need to secure the following:
- VSAN admin console: change default password from 'starwind' to something else and lock down port 3261.
- Sync interface: I believe all communication is via iSCSI over the dedicated interfaces, so I'm guessing I need to add mutual CHAP to the connections and also lock-down the availability of 3260 to those interfaces.
- Storage interface: This is definitely iSCSI, so I would need to add mutual CHAP and also lock down port 3260.

Am I missing anything? Can somebody provide guidance to updating passwords and adding CHAP via command line / config file?

[yaroslav (staff)]

You cannot use multiple chap auth. Set just one.
Also, you can't change the password for the Management Console or set CHAP that easily. Both are encrypted. Check this out viewtopic.php?f=5&t=6001&p=33727&hilit= ... ZDg#p33727.

Alternatively, you can deploy the trial-based system on another instance, set the password there, then copy the corresponding areas from that system to your lab one.

[thx1200]

"Mutual" CHAP, not multiple.

The powershell script in that thread worked great for setting the admin CHAP. I'll deploy a trial to look at the configs for the CHAP side of the auth.

Are the two places I need to look in the config the StarWind.cfg file and the .swdsk header file for the HA on the disk?

[yaroslav (staff)]

Hi. Yes. You are on the right track