testing: Converterd tnc to systemd
This commit is contained in:
Andreas Steffen
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -10,9 +10,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
syslog {
|
||||
daemon {
|
||||
default = 1
|
||||
}
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-radius {
|
||||
secret = gv6URkSs
|
||||
server = 10.1.0.10
|
||||
secret = gv6URkSs
|
||||
server = 10.1.0.10
|
||||
filter_id = yes
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
alice::killall radiusd
|
||||
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -11,9 +11,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,15 +1,11 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
retransmit_tries = 5
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-radius updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
syslog {
|
||||
daemon {
|
||||
default = 1
|
||||
}
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-radius {
|
||||
secret = gv6URkSs
|
||||
server = 10.1.0.10
|
||||
secret = gv6URkSs
|
||||
server = 10.1.0.10
|
||||
filter_id = yes
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
alice::killall radiusd
|
||||
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
|
||||
carol::echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
|
||||
@@ -15,9 +15,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,15 +1,11 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
syslog {
|
||||
daemon {
|
||||
default = 1
|
||||
}
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-radius {
|
||||
secret = gv6URkSs
|
||||
server = 10.1.0.10
|
||||
secret = gv6URkSs
|
||||
server = 10.1.0.10
|
||||
filter_id = yes
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
alice::killall radiusd
|
||||
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -11,9 +11,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -8,9 +8,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -8,9 +8,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -1,21 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 2
|
||||
imc = 2
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -27,7 +23,7 @@ libtls {
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = isolate
|
||||
command = isolate
|
||||
retry = yes
|
||||
retry_command = allow
|
||||
}
|
||||
|
||||
@@ -1,21 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 2
|
||||
imc = 2
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
@@ -34,7 +30,7 @@ libtls {
|
||||
libimcv {
|
||||
plugins {
|
||||
imv-test {
|
||||
rounds = 0
|
||||
rounds = 0
|
||||
}
|
||||
imv-scanner {
|
||||
closed_port_policy = yes
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -8,9 +8,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -11,7 +11,7 @@ alice::cat /var/log/daemon.log::skipping SASL, client already authenticated by T
|
||||
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=Linux strongSwan, OU=Accounting, [email protected].*authenticated by certificate::YES
|
||||
alice::cat /var/log/daemon.log::received software inventory with ... items for request 3 at last eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::role=.softwareCreator licensor tagCreator::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
||||
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
|
||||
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
|
||||
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
|
||||
@@ -20,5 +20,5 @@ alice::cat /var/log/daemon.log::user AR identity.*carol.*authenticated by passwo
|
||||
alice::cat /var/log/daemon.log::received software ID events with ... items for request 9 at last eid 2 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::3 SWID tag target::YES
|
||||
alice::cat /var/log/daemon.log::received software inventory with 3 items for request 9 at last eid 2 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
||||
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce pem pkcs1 x509 openssl revocation constraints curl vici socket-default kernel-netlink tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
|
||||
|
||||
syslog {
|
||||
@@ -44,6 +44,6 @@ libimcv {
|
||||
}
|
||||
|
||||
imv_policy_manager {
|
||||
command_allow = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is allowed\""'
|
||||
command_block = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is blocked\""'
|
||||
command_allow = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is allowed\""'
|
||||
command_block = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is blocked\""'
|
||||
}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
carol::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
dave::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
alice::service charon stop
|
||||
alice::service apache2 stop
|
||||
alice::systemctl stop strongswan-swanctl
|
||||
alice::systemctl stop apache2
|
||||
alice::rm /etc/swanctl/rsa/aaaKey.pem
|
||||
alice::rm /etc/swanctl/x509/aaaCert.pem
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -13,8 +13,8 @@ alice::chgrp -R www-data /etc/db.d/config.db; chmod -R g+w /etc/db.d/config.db
|
||||
alice::/usr/local/bin/init_tnc
|
||||
alice::rm /etc/swanctl/x509/aliceCert.pem
|
||||
alice::rm /etc/swanctl/rsa/aliceKey.pem
|
||||
alice::service charon start
|
||||
alice::service apache2 start
|
||||
alice::systemctl start apache2
|
||||
alice::systemctl start strongswan-swanctl
|
||||
alice::swanctl --load-creds
|
||||
winnetou::ip route add 10.1.0.0/16 via 192.168.0.1
|
||||
dave::ip route add 10.1.0.0/16 via 192.168.0.1
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
@@ -24,7 +20,7 @@ charon {
|
||||
}
|
||||
tnccs-20 {
|
||||
tests {
|
||||
pb_tnc_noskip = yes
|
||||
pb_tnc_noskip = yes
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -8,9 +8,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
carol::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -4,8 +4,8 @@ moon::cat /etc/tnc_config
|
||||
carol::cat /etc/tnc_config
|
||||
carol::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,21 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 2
|
||||
imc = 2
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,20 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 2
|
||||
imc = 2
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -10,9 +10,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
carol::expect-connection home
|
||||
carol::swanctl --initiate --child home 2> /dev/null
|
||||
|
||||
@@ -1,17 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici socket-default kernel-netlink eap-identity eap-ttls eap-tnc tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imv = 3
|
||||
}
|
||||
}
|
||||
@@ -36,5 +33,5 @@ charon {
|
||||
|
||||
libimcv {
|
||||
debug_level = 3
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
}
|
||||
|
||||
@@ -1,18 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
@@ -43,7 +39,7 @@ libimcv {
|
||||
|
||||
plugins {
|
||||
imc-hcd {
|
||||
push_info = no
|
||||
push_info = no
|
||||
subtypes {
|
||||
system {
|
||||
attributes_natural_language = en
|
||||
@@ -64,7 +60,7 @@ libimcv {
|
||||
}
|
||||
fw-2 {
|
||||
name = Firmware UVW for ARMv6 32 bit strongPrint OS 1.0
|
||||
patches = "security patch CVE-2014-1288 2014-01-01\r\nsecurity patch CVE-2014-1492 2014-02-01\r\nsecurity patch CVE-2014-1622 2014-05-01\r\nsecurity patch CVE-2014-2775 2014-07-01\r\n\security patch CVE-2014-4453 2014-08-01\r\nsecurity patch CVE-2014-6108 2014-11-01\r\nsecurity patch CVE-2015-0555 2015-01-01\r\nsecurity patch CVE-2015-4319 2015-07-01\r\n"
|
||||
patches = "security patch CVE-2014-1288 2014-01-01\r\nsecurity patch CVE-2014-1492 2014-02-01\r\nsecurity patch CVE-2014-1622 2014-05-01\r\nsecurity patch CVE-2014-2775 2014-07-01\r\n\security patch CVE-2014-4453 2014-08-01\r\nsecurity patch CVE-2014-6108 2014-11-01\r\nsecurity patch CVE-2015-0555 2015-01-01\r\nsecurity patch CVE-2015-4319 2015-07-01\r\n"
|
||||
string_version = 13.8.5
|
||||
version = 0000000D000000080000000500000000
|
||||
}
|
||||
@@ -78,7 +74,7 @@ libimcv {
|
||||
|
||||
resident_application {
|
||||
resident-app-1 {
|
||||
name = Resident App XYZ
|
||||
name = Resident App XYZ
|
||||
patches = "xmas patch 2014-12-24\r\nservice patch for App XYZ 2015-05-22\r\n"
|
||||
string_version = 2.5
|
||||
version = 00000002000000050000000000000000
|
||||
@@ -137,7 +133,7 @@ libimcv {
|
||||
version = 00000007000000080000000000000000
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resident_application {
|
||||
resident-app-if {
|
||||
name = Resident Interface App
|
||||
@@ -150,10 +146,10 @@ libimcv {
|
||||
|
||||
scanner {
|
||||
attributes_natural_language = en
|
||||
|
||||
|
||||
firmware {
|
||||
fw-scanner {
|
||||
name = Scanner Firmware
|
||||
name = Scanner Firmware
|
||||
patches = "security patch 2013-08-11\r\nsecurity patch 2015-5-30\r\n"
|
||||
string_version = 2.5.3
|
||||
version = 00000002000000050000000300000000
|
||||
|
||||
@@ -1,18 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
@@ -52,18 +48,18 @@ libimcv {
|
||||
vendor_smi_code = 36906
|
||||
pstn_fax_enabled = yes
|
||||
time_source = 0.ch.pool.ntp.org
|
||||
user_application_enabled = no
|
||||
user_application_enabled = no
|
||||
user_application_persistence_enabled = no
|
||||
|
||||
firmware {
|
||||
fw-1 {
|
||||
name = Firmware ABC
|
||||
name = Firmware ABC
|
||||
patches = "security patch 2014-05-08\r\nupgrade 2014-08-16\r\nsecurity patch 2015-3-22\r\n"
|
||||
string_version = 1.0.7
|
||||
version = 00000001000000000000000700000000
|
||||
}
|
||||
fw-2 {
|
||||
name = Firmware UVW
|
||||
name = Firmware UVW
|
||||
string_version = 13.8.5
|
||||
version = 0000000D000000080000000500000000
|
||||
}
|
||||
@@ -71,7 +67,7 @@ libimcv {
|
||||
|
||||
resident_application {
|
||||
resident-app-1 {
|
||||
name = Resident App XYZ
|
||||
name = Resident App XYZ
|
||||
patches = "xmas patch 2014-12-24\r\nservice patch 2015-05-22\r\n"
|
||||
string_version = 2.5
|
||||
version = 00000002000000050000000000000000
|
||||
@@ -96,7 +92,7 @@ libimcv {
|
||||
|
||||
interface {
|
||||
attributes_natural_language = en
|
||||
|
||||
|
||||
firmware {
|
||||
fw-if {
|
||||
name = Interface Firmware
|
||||
@@ -118,10 +114,10 @@ libimcv {
|
||||
|
||||
scanner {
|
||||
attributes_natural_language = en
|
||||
|
||||
|
||||
firmware {
|
||||
fw-scanner {
|
||||
name = Scanner Firmware
|
||||
name = Scanner Firmware
|
||||
patches = "security patch 2013-08-11\r\nsecurity patch 2015-5-30\r\n"
|
||||
string_version = 2.5.3
|
||||
version = 00000002000000050000000300000000
|
||||
|
||||
@@ -1,17 +1,21 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-radius updown
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
syslog {
|
||||
daemon {
|
||||
default = 1
|
||||
}
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-radius {
|
||||
secret = gv6URkSs
|
||||
#server = PH_IP6_ALICE
|
||||
#server = PH_IP6_ALICE
|
||||
server = PH_IP_ALICE
|
||||
filter_id = yes
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
alice::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
alice::systemctl stop strongswan-swanctl
|
||||
alice::rm /etc/swanctl/rsa/aaaKey.pem
|
||||
alice::rm /etc/swanctl/x509/aaaCert.pem
|
||||
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
|
||||
@@ -9,10 +9,10 @@ carol::echo 0 > /proc/sys/net/ipv4/ip_forward
|
||||
dave::echo aabbccddeeff11223344556677889900 > /var/lib/dbus/machine-id
|
||||
alice::rm /etc/swanctl/rsa/aliceKey.pem
|
||||
alice::rm /etc/swanctl/x509/aliceCert.pem
|
||||
alice::service charon start
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
alice::systemctl start strongswan-swanctl
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,20 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 2
|
||||
imv = 2
|
||||
}
|
||||
@@ -36,10 +32,10 @@ libtls {
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = allow
|
||||
command = allow
|
||||
}
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,20 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 2
|
||||
imv = 2
|
||||
}
|
||||
@@ -38,10 +34,10 @@ libtls {
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = none
|
||||
command = none
|
||||
}
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
moon::service charon stop
|
||||
sun::service charon stop
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
sun::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::service charon start
|
||||
sun::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
sun::systemctl start strongswan-swanctl
|
||||
sun::expect-connection mutual
|
||||
moon::expect-connection mutual
|
||||
moon::swanctl --initiate --child mutual
|
||||
|
||||
@@ -1,20 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 2
|
||||
imv = 2
|
||||
}
|
||||
@@ -40,6 +36,6 @@ libimcv {
|
||||
}
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,20 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 2
|
||||
imv = 2
|
||||
}
|
||||
@@ -38,10 +34,10 @@ libtls {
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = allow
|
||||
command = allow
|
||||
}
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
moon::service charon stop
|
||||
sun::service charon stop
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
sun::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::service charon start
|
||||
sun::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
sun::systemctl start strongswan-swanctl
|
||||
sun::expect-connection mutual
|
||||
moon::expect-connection mutual
|
||||
moon::swanctl --initiate --child mutual
|
||||
|
||||
@@ -1,17 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default tnc-pdp tnc-tnccs tnc-imc tnc-imv tnccs-20
|
||||
charon-systemd {
|
||||
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default tnc-pdp tnc-tnccs tnc-imc tnc-imv tnccs-20
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 2
|
||||
imv = 2
|
||||
}
|
||||
@@ -36,10 +33,10 @@ libtls {
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = allow
|
||||
command = allow
|
||||
}
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1 +1 @@
|
||||
sun::service charon stop
|
||||
sun::systemctl stop strongswan-swanctl
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
sun::service charon start
|
||||
sun::systemctl start strongswan-swanctl
|
||||
moon::cat /etc/pts/options
|
||||
moon::sleep 1
|
||||
moon::/usr/local/bin/pt-tls-client --optionsfrom /etc/pts/options
|
||||
|
||||
@@ -10,7 +10,7 @@ alice::cat /var/log/daemon.log::certificate status is good::YES
|
||||
alice::cat /var/log/daemon.log::skipping SASL, client already authenticated by TLS certificate::YES
|
||||
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=Linux strongSwan, OU=Accounting, [email protected].*authenticated by certificate::YES
|
||||
alice::cat /var/log/daemon.log::received software inventory with ... items for request 3 at last eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
||||
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
|
||||
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
|
||||
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
|
||||
@@ -21,5 +21,5 @@ alice::cat /var/log/daemon.log::received software ID inventory with ... items fo
|
||||
alice::cat /var/log/daemon.log::1 SWID tag target::YES
|
||||
alice::cat /var/log/daemon.log::received software inventory with 1 item for request 9 at last eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::strongswan.org__strongSwan.*@ /usr/local/share/strongswan::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
||||
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce pem pkcs1 x509 openssl revocation constraints curl vici socket-default kernel-netlink tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
|
||||
|
||||
syslog {
|
||||
@@ -44,6 +44,6 @@ libimcv {
|
||||
}
|
||||
|
||||
imv_policy_manager {
|
||||
command_allow = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is allowed\""'
|
||||
command_block = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is blocked\""'
|
||||
command_allow = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is allowed\""'
|
||||
command_block = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is blocked\""'
|
||||
}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
carol::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
dave::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
alice::service charon stop
|
||||
alice::service apache2 stop
|
||||
alice::systemctl stop strongswan-swanctl
|
||||
alice::systemctl stop apache2
|
||||
alice::rm /etc/swanctl/rsa/aaaKey.pem
|
||||
alice::rm /etc/swanctl/x509/aaaCert.pem
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -13,8 +13,8 @@ alice::chgrp -R www-data /etc/db.d/config.db; chmod -R g+w /etc/db.d/config.db
|
||||
alice::/usr/local/bin/init_tnc
|
||||
alice::rm /etc/swanctl/x509/aliceCert.pem
|
||||
alice::rm /etc/swanctl/rsa/aliceKey.pem
|
||||
alice::service charon start
|
||||
alice::service apache2 start
|
||||
alice::systemctl start apache2
|
||||
alice::systemctl start strongswan-swanctl
|
||||
alice::swanctl --load-creds
|
||||
winnetou::ip route add 10.1.0.0/16 via 192.168.0.1
|
||||
dave::ip route add 10.1.0.0/16 via 192.168.0.1
|
||||
|
||||
@@ -1,20 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 3
|
||||
pts = 3
|
||||
}
|
||||
|
||||
@@ -1,21 +1,17 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
retransmit_tries = 5
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 3
|
||||
pts = 3
|
||||
}
|
||||
|
||||
@@ -1,20 +1,16 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imv = 3
|
||||
pts = 3
|
||||
}
|
||||
@@ -34,7 +30,7 @@ libtls {
|
||||
|
||||
libimcv {
|
||||
database = sqlite:///etc/db.d/config.db
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
plugins {
|
||||
imv-attestation {
|
||||
hash_algorithm = sha256
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -12,9 +12,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
dave::expect-connection home
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -13,9 +13,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
carol::service charon start
|
||||
dave::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
carol::expect-connection home
|
||||
|
||||
@@ -1,17 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici socket-default kernel-netlink eap-identity eap-ttls eap-md5 eap-tnc tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imv = 3
|
||||
}
|
||||
}
|
||||
@@ -35,7 +32,7 @@ charon {
|
||||
}
|
||||
|
||||
libimcv {
|
||||
debug_level = 3
|
||||
debug_level = 3
|
||||
database = sqlite:///etc/db.d/config.db
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
|
||||
|
||||
@@ -1,18 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,18 +1,14 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 2
|
||||
tnc = 2
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-radius updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
syslog {
|
||||
daemon {
|
||||
default = 1
|
||||
}
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-radius {
|
||||
secret = gv6URkSs
|
||||
#server = PH_IP6_ALICE
|
||||
#server = PH_IP6_ALICE
|
||||
server = PH_IP_ALICE
|
||||
filter_id = yes
|
||||
}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
moon::service charon stop
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
alice::service charon stop
|
||||
alice::service apache2 stop
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
alice::systemctl stop strongswan-swanctl
|
||||
alice::systemctl stop apache2
|
||||
alice::rm /etc/swanctl/x509/aaaCert.pem
|
||||
alice::rm /etc/swanctl/rsa/aaaKey.pem
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -17,11 +17,11 @@ alice::sed -i "s:DEBIAN_VERSION:\`cat /etc/debian_version\`:" /etc/pts/data1.sql
|
||||
alice::cd /usr/local/share/strongswan/templates/database/imv; cat tables.sql data.sql /etc/pts/data1.sql | sqlite3 /etc/db.d/config.db
|
||||
alice::chgrp -R www-data /etc/db.d/config.db; chmod -R g+w /etc/db.d/config.db
|
||||
alice::/usr/local/bin/init_tnc
|
||||
alice::service apache2 start
|
||||
alice::service charon start
|
||||
moon::service charon start
|
||||
dave::service charon start
|
||||
carol::service charon start
|
||||
alice::systemctl start apache2
|
||||
alice::systemctl start strongswan-swanctl
|
||||
moon::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
dave::expect-connection home
|
||||
|
||||
@@ -9,7 +9,7 @@ alice::cat /var/log/daemon.log::certificate status is good::YES
|
||||
alice::cat /var/log/daemon.log::skipping SASL, client already authenticated by TLS certificate::YES
|
||||
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=Linux strongSwan, OU=Accounting, [email protected].*authenticated by certificate::YES
|
||||
alice::cat /var/log/daemon.log::received SWID tag inventory with ... items for request 3 at eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
|
||||
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
|
||||
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
|
||||
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
|
||||
@@ -19,5 +19,5 @@ alice::cat /var/log/daemon.log::received SWID tag ID inventory with ... items fo
|
||||
alice::cat /var/log/daemon.log::1 SWID tag target::YES
|
||||
alice::cat /var/log/daemon.log::received SWID tag inventory with 1 item for request 9 at eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::strongswan.org__strongSwan-::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
||||
alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
|
||||
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce pem pkcs1 x509 openssl revocation constraints curl vici socket-default kernel-netlink tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
|
||||
|
||||
syslog {
|
||||
@@ -39,6 +39,6 @@ libimcv {
|
||||
}
|
||||
|
||||
imv_policy_manager {
|
||||
command_allow = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is allowed\""'
|
||||
command_block = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is blocked\""'
|
||||
command_allow = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is allowed\""'
|
||||
command_block = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is blocked\""'
|
||||
}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
carol::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
dave::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
|
||||
alice::service charon stop
|
||||
alice::service apache2 stop
|
||||
alice::systemctl stop strongswan-swanctl
|
||||
alice::systemctl stop apache2
|
||||
alice::rm /etc/swanctl/rsa/aaaKey.pem
|
||||
alice::rm /etc/swanctl/x509/aaaCert.pem
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -13,8 +13,8 @@ alice::chgrp -R www-data /etc/db.d/config.db; chmod -R g+w /etc/db.d/config.db
|
||||
alice::/usr/local/bin/init_tnc
|
||||
alice::rm /etc/swanctl/x509/aliceCert.pem
|
||||
alice::rm /etc/swanctl/rsa/aliceKey.pem
|
||||
alice::service charon start
|
||||
alice::service apache2 start
|
||||
alice::systemctl start apache2
|
||||
alice::systemctl start strongswan-swanctl
|
||||
alice::swanctl --load-creds
|
||||
winnetou::ip route add 10.1.0.0/16 via 192.168.0.1
|
||||
dave::ip route add 10.1.0.0/16 via 192.168.0.1
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
@@ -34,7 +30,7 @@ libtls {
|
||||
|
||||
libimcv {
|
||||
database = sqlite:///etc/db.d/config.db
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
|
||||
plugins {
|
||||
imv-attestation {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
carol::service charon stop
|
||||
dave::service charon stop
|
||||
moon::service charon stop
|
||||
carol::systemctl stop strongswan-swanctl
|
||||
dave::systemctl stop strongswan-swanctl
|
||||
moon::systemctl stop strongswan-swanctl
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
|
||||
@@ -12,9 +12,9 @@ carol::rm /etc/swanctl/rsa/*
|
||||
dave::rm /etc/swanctl/rsa/*
|
||||
carol::rm /etc/swanctl/x509/*
|
||||
dave::rm /etc/swanctl/x509/*
|
||||
moon::service charon start
|
||||
dave::service charon start
|
||||
carol::service charon start
|
||||
moon::systemctl start strongswan-swanctl
|
||||
dave::systemctl start strongswan-swanctl
|
||||
carol::systemctl start strongswan-swanctl
|
||||
moon::expect-connection rw-allow
|
||||
moon::expect-connection rw-isolate
|
||||
dave::expect-connection home
|
||||
|
||||
@@ -1,22 +1,18 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
charon-systemd {
|
||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
|
||||
|
||||
multiple_authentication = no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
tnc = 3
|
||||
imc = 3
|
||||
pts = 3
|
||||
pts = 3
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user