Back to Blogs

Configure a Linux iSCSI Target with targetcli

Turn a dedicated Linux disk into a controlled iSCSI LUN using LIO, a dedicated portal, an initiator ACL and CHAP.

LinuxtargetcliLIOCHAP
Linux iSCSI target workflow from backstore and IQN to portal, ACL and CHAP
Configure a Linux iSCSI Target with targetcli cheat sheet: use this quick map before reading the detailed sections.

Before you configure the target

This lab uses target IP 192.168.50.10, empty disk /dev/sdb, target IQN iqn.2026-08.in.netest:storage.target01 and initiator IQN iqn.1994-05.com.redhat:client01.

Stop and verify the disk. The device used as a backstore must not contain mounted or required data. Replace every sample name, address and password with values from your environment.

Configuration path

  1. Identify the storage disk
  2. Install targetcli
  3. Create the backstore, IQN, LUN and portal
  4. Add the initiator ACL and CHAP
  5. Save and verify the target

1. Identify the storage disk

List block devices and confirm that the intended target disk is not mounted.

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL findmnt /dev/sdb wipefs -n /dev/sdb

wipefs -n reports existing signatures without modifying them. If the path is wrong, correct it before continuing.

2. Install and start the target software

RHEL, Rocky Linux or AlmaLinux

dnf install targetcli -y systemctl enable --now target

Ubuntu or Debian

apt update apt install targetcli-fb -y systemctl enable --now rtslib-fb-targetctl

Package and service names can vary by release. The remaining commands run inside the targetcli shell.

3. Create the backstore, target, LUN and portal

Create a block backstore

targetcli /> backstores/block create name=iscsi_disk01 dev=/dev/sdb /> backstores/block ls

Create the target IQN

/> iscsi create iqn.2026-08.in.netest:storage.target01 /> iscsi ls

Map the backstore as LUN 0

/> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/luns create /backstores/block/iscsi_disk01

Bind the storage portal

/> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/portals create 192.168.50.10
Why a specific IP? Binding 192.168.50.10:3260 is easier to audit than exposing the target on every interface with 0.0.0.0.

4. Restrict access with an ACL and CHAP

On the client, obtain the exact initiator IQN from /etc/iscsi/initiatorname.iscsi. Then create an ACL for that identity.

/> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/acls create iqn.1994-05.com.redhat:client01 /> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/acls ls

Enable authentication and set credentials on the ACL.

/> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1 set attribute authentication=1 /> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/acls/iqn.1994-05.com.redhat:client01 set attribute authentication=1 /> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/acls/iqn.1994-05.com.redhat:client01 set auth userid=iscsiuser /> iscsi/iqn.2026-08.in.netest:storage.target01/tpg1/acls/iqn.1994-05.com.redhat:client01 set auth password=Use-A-Strong-Secret
Do not reuse the example secret. CHAP authenticates the initiator but does not encrypt the data path. Limit TCP 3260 at the firewall and keep storage traffic isolated.

5. Save and verify the target

/> saveconfig /> exit targetcli ls ss -lntp | grep 3260 systemctl status target

The target tree should contain the target IQN, tpg1, one ACL, lun0 and portal 192.168.50.10:3260.

CheckExpected result
Backstoreiscsi_disk01 points to the intended disk
LUNlun0 maps to the block backstore
PortalDedicated IP listening on TCP 3260
ACLExact initiator IQN is present
AuthenticationCHAP enabled with a unique secret

Firewall and reachability check

Permit TCP 3260 only from the authorised initiator subnet or addresses. From the initiator, test the path before discovery:

ping -c 4 192.168.50.10 nc -zv 192.168.50.10 3260

If the port is unreachable, fix routing, VLAN, host firewall and portal binding before changing CHAP.

Configure a Linux iSCSI Target with targetcli Frequently Asked Questions

What does targetcli configure?

It manages the Linux LIO target objects: backstores, target IQNs, portals, LUNs, ACLs and authentication.

Can I use an LVM volume instead of a physical disk?

Yes. LIO can export block devices such as LVM logical volumes, RAID devices and physical disks. Choose the correct backstore type and verify its lifecycle before mapping it.

Should the portal listen on 0.0.0.0?

A lab may listen on all addresses, but a dedicated storage IP is clearer and reduces accidental exposure.

How do I verify the target?

Use targetcli ls, confirm TCP 3260 with ss -lntp, and check the relevant target service.

Reference

See Red Hat's Configuring an iSCSI target documentation for supported backstores, portals, ACLs and authentication.