Logical unit number masking

LUN masking is a level of security that makes a LUN available to only selected hosts and unavailable to all others. This kind of security is done on the storage area network (SAN) level and is based on the host host adapter (HBA), i.e. you can give access of specific LUN on the SAN to specific host with specific HBA.

LUN masking is mainly implemented at the HBA level. The security benefits of LUN masking implemented at HBAs are limited, since with many HBAs it is possible to forge source addresses (WWNs/MACs/IPs) and compromise the access. Many storage controllers also support LUN masking. When LUN masking is implemented at the storage controller level, the controller itself enforces the access policies to the device and as a result it is more secure. However, it is mainly implemented not as a security measure per se, but rather as a protection against misbehaving servers which may corrupt disks belonging to other servers. For example, Windows servers attached to a SAN will, under some conditions, corrupt non-Windows (Unix, Linux, NetWare) volumes on the SAN by attempting to write Windows volume labels to them. By hiding the other LUNs from the Windows server, this can be prevented, since the Windows server does not even realize the other LUNs exist.

• Persistent binding

{{Reflist}}

• [http://www.sansecurity.com/faq/lun-masking.shtml LUN Masking] {{Webarchive|url=https://web.archive.org/web/20060505180308/http://www.sansecurity.com/faq/lun-masking.shtml |date=2006-05-05 }}
• {{usurped|1=[https://web.archive.org/web/20130403011432/http://a4academics.com/blog/420-zoning-and-lun-masking LUN Masking and Zoning]}}

Category:Computer storage buses