Return-Path: <owner-ips-outgoing@ece.cmu.edu>
X-Sieve: cmu-sieve 2.0
Return-Path: <owner-ips-outgoing@ece.cmu.edu>
Received: from osgood.ece.cmu.edu (OSGOOD.ECE.CMU.EDU [128.2.129.25])
	by ece.cmu.edu (8.11.0/8.10.2) with ESMTP id h5CKRW320295
	for <ipsml@ece.cmu.edu>; Thu, 12 Jun 2003 16:27:32 -0400 (EDT)
Received: by osgood.ece.cmu.edu (Postfix, from userid 953)
	id 4C4A382; Thu, 12 Jun 2003 16:27:31 -0400 (EDT)
Received: from sos.ece.cmu.edu (SOS.ECE.CMU.EDU [128.2.129.27])
	by osgood.ece.cmu.edu (Postfix) with ESMTP
	id BCEAA6F; Thu, 12 Jun 2003 16:27:29 -0400 (EDT)
Received: by sos.ece.cmu.edu (Postfix)
	id 2614B89DB; Thu, 12 Jun 2003 16:27:13 -0400 (EDT)
Received: from bache.ece.cmu.edu (BACHE.ECE.CMU.EDU [128.2.129.23])
	by sos.ece.cmu.edu (Postfix) with ESMTP id 1A2C889D7
	for <ips-outgoing@sos.ece.cmu.edu>; Thu, 12 Jun 2003 16:27:13 -0400 (EDT)
Received: by bache.ece.cmu.edu (Postfix)
	id EB2AC2BE; Thu, 12 Jun 2003 16:27:12 -0400 (EDT)
Received: by bache.ece.cmu.edu (Postfix, from userid 953)
	id B8B9D2C4; Thu, 12 Jun 2003 16:27:12 -0400 (EDT)
Received: from sos.ece.cmu.edu (SOS.ECE.CMU.EDU [128.2.129.27])
	by bache.ece.cmu.edu (Postfix) with ESMTP id 8B3AE2BE
	for <ips-outgoing@ece.cmu.edu>; Thu, 12 Jun 2003 16:27:04 -0400 (EDT)
Received: by sos.ece.cmu.edu (Postfix, from userid 363)
	id 77DA489DC; Thu, 12 Jun 2003 16:27:04 -0400 (EDT)
X-Original-To: ips@sos.ece.cmu.edu
Received: from osgood.ece.cmu.edu (OSGOOD.ECE.CMU.EDU [128.2.129.25])
	by sos.ece.cmu.edu (Postfix) with ESMTP id 593D289D7
	for <ips@sos.ece.cmu.edu>; Thu, 12 Jun 2003 16:27:02 -0400 (EDT)
Received: by osgood.ece.cmu.edu (Postfix)
	id 268526F; Thu, 12 Jun 2003 16:27:02 -0400 (EDT)
Delivered-To: ips@ece.cmu.edu
Received: by osgood.ece.cmu.edu (Postfix, from userid 953)
	id E72F182; Thu, 12 Jun 2003 16:27:01 -0400 (EDT)
Received: from thebe.your-site.com (thebe.your-site.com [140.186.45.26])
	by osgood.ece.cmu.edu (Postfix) with ESMTP id 7C5056F
	for <ips@ece.cmu.edu>; Thu, 12 Jun 2003 16:27:00 -0400 (EDT)
Received: from 192.168.0.2 (64-144-5-25.client.dsl.net [64.144.5.25])
	by thebe.your-site.com (Postfix) with ESMTP
	id F18162451B2; Thu, 12 Jun 2003 16:27:30 -0400 (EDT)
Date: Thu, 12 Jun 2003 15:26:58 -0500
From: Caitlin Bestler <cait@asomi.com>
Subject: Re: Question on iSCSI security
To: wrstuden@wasabisystems.com
Cc: "Williams, Jim" <Jim.Williams@Emulex.com>,
   "'ips@ece.cmu.edu'" <ips@ece.cmu.edu>
X-Priority: 3
In-Reply-To: <Pine.NEB.4.53.0306122005210.668@neverwinter.home-net.icnt.net>
Message-ID: <r01050300-1026-37B5AC489D1411D7A792003065D48EE0@[192.168.0.2]>
MIME-Version: 1.0
Content-Type: text/plain; Charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Mailer: Mailsmith 1.5.3 (Blindsider)
Sender: owner-ips@ece.cmu.edu
Precedence: bulk
X-Spam-Status: No, hits=-16.3 required=5.0
	tests=BAYES_01,EMAIL_ATTRIBUTION,IN_REP_TO
	version=2.50
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp)

On 6/12/03, wrstuden@wasabisystems.com wrote:

>As I understand your scenario, target C will see initiator
>A logging in from B's IP address. There is no way that
>iSCSI will see the connection as coming from anywhere
>other than B's IP. So you can close this by limiting A's
>auths to only be valid from its IP addresses.

And if A has to use an alternate path through another NIC?
Or if A's address is assigned by DHCP?

At the minimum, such a solution should be aware of ALL
valid addresses for that A might use.

Caitlin Bestler
http://asomi.com/CaitlinBestler/