iSCSI Unauthenticated Target Detection

#!/usr/bin/env bash
# noisgate: iSCSI Unauthenticated Target check (Tenable 51368)
# Usage: sudo ./check_iscsi_auth.sh <portal_ip> [port]
set -u
TARGET="${1:-}"
PORT="${2:-3260}"
if [[ -z "$TARGET" ]]; then echo "usage: $0 <portal_ip> [port]"; exit 2; fi
if ! command -v iscsiadm >/dev/null 2>&1; then echo "UNKNOWN: open-iscsi/iscsiadm not installed"; exit 3; fi
if [[ $EUID -ne 0 ]]; then echo "UNKNOWN: must run as root"; exit 3; fi

# 1. Is the portal reachable?
if ! timeout 5 bash -c "</dev/tcp/${TARGET}/${PORT}" 2>/dev/null; then
  echo "UNKNOWN: TCP/${PORT} unreachable on ${TARGET}"; exit 3
fi

# 2. Ensure discovery-phase CHAP is OFF on our initiator so we exercise the target's requirement
sed -i 's/^discovery.sendtargets.auth.authmethod.*/discovery.sendtargets.auth.authmethod = None/' /etc/iscsi/iscsid.conf 2>/dev/null || true
systemctl restart iscsid 2>/dev/null || service iscsid restart 2>/dev/null || true

# 3. Attempt anonymous SendTargets discovery
DISC=$(timeout 10 iscsiadm -m discovery -t sendtargets -p "${TARGET}:${PORT}" 2>&1)
RC=$?
if [[ $RC -ne 0 ]]; then
  if echo "$DISC" | grep -qiE 'auth|chap|permission|forbidden|reject'; then
    echo "PATCHED: portal requires authentication for discovery"; exit 0
  fi
  echo "UNKNOWN: discovery failed rc=$RC msg=$DISC"; exit 3
fi

IQNS=$(echo "$DISC" | awk '{print $2}' | grep -E '^iqn\.' | sort -u)
if [[ -z "$IQNS" ]]; then echo "UNKNOWN: no IQNs returned"; exit 3; fi

# 4. Try a non-persistent normal-session login to the first target
FIRST=$(echo "$IQNS" | head -1)
LOGIN=$(timeout 10 iscsiadm -m node -T "$FIRST" -p "${TARGET}:${PORT}" --login 2>&1)
LRC=$?
if [[ $LRC -eq 0 ]]; then
  echo "VULNERABLE: unauthenticated session established to ${FIRST} on ${TARGET}"
  iscsiadm -m node -T "$FIRST" -p "${TARGET}:${PORT}" --logout >/dev/null 2>&1
  iscsiadm -m node -T "$FIRST" -p "${TARGET}:${PORT}" -o delete >/dev/null 2>&1
  exit 1
fi
if echo "$LOGIN" | grep -qiE 'auth|chap|reject|forbidden'; then
  echo "PARTIAL: discovery unauthenticated but session-phase auth enforced on ${FIRST}"; exit 1
fi
echo "UNKNOWN: login rc=$LRC msg=$LOGIN"; exit 3