Information
Challenge-Handshake Authentication Protocol (CHAP) requires both client and host to know the secret (password) to establish a connection. Each mutual authentication secret should be unique.
Rationale:
If all mutual authentication secrets are unique, compromise of one secret does not allow an attacker to authenticate to other hosts or clients using that same secret.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To change the values of CHAP secrets so they are unique, perform the following:
From the vSphere Web Client, navigate to 'Hosts'.
Click on a host.
Click on 'Configure' -> 'Storage' -> 'Storage Adapters'.
Select the iSCSI adapter to configure OR click the green plus symbol to create a new adapter.
Under Adapter Details, click the Properties tab and click 'Edit' in the Authentication panel.
Specify the authentication method.
None
Use unidirectional CHAP if required by target
Use unidirectional CHAP unless prohibited by target
Use unidirectional CHAP
Use bidirectional CHAP
Specify the outgoing CHAP name.
Make sure that the name you specify matches the name configured on the storage side.
To set the CHAP name to the iSCSI adapter name, select 'Use initiator name'.
To set the CHAP name to anything other than the iSCSI initiator name, deselect 'Use initiator name' and type a name in the Name text box.
Enter an outgoing CHAP secret to be used as part of authentication. Use the same secret as your storage side secret.
If configuring with bidirectional CHAP, specify incoming CHAP credentials.
Make sure your outgoing and incoming secrets do not match.
Click OK.
Click the second to last symbol to rescan the iSCSI adapter.
References:
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.storage.doc/GUID-AC65D747-728F-4109-96DD-49B433E2F266.html
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.storage.doc/GUID-2F1E64DB-20BB-4D18-A083-8E65FE380899.html
Notes:
If you change the CHAP parameters, they are used for new iSCSI sessions. For existing sessions, new settings are not used until you log out and log in again.