moved TNC scenarios to tnc folder
This commit is contained in:
Andreas Steffen
@@ -1,3 +0,0 @@
|
||||
#IMV configuration file for TNC@FHH-TNC-Server
|
||||
|
||||
IMV "Dummy" /usr/local/lib/libdummyimv.so.0.7.0
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
@@ -1 +0,0 @@
|
||||
none
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
@@ -1 +0,0 @@
|
||||
allow
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
@@ -1 +0,0 @@
|
||||
none
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
@@ -1 +0,0 @@
|
||||
0
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMV configuration file for strongSwan server
|
||||
|
||||
IMV "Dummy" /usr/local/lib/libdummyimv.so
|
||||
@@ -1 +0,0 @@
|
||||
allow
|
||||
@@ -1 +0,0 @@
|
||||
allow
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
@@ -1 +0,0 @@
|
||||
isolate
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
@@ -1 +0,0 @@
|
||||
0
|
||||
@@ -1,3 +0,0 @@
|
||||
#IMV configuration file for strongSwan server
|
||||
|
||||
IMV "Dummy" /usr/local/lib/libdummyimv.so
|
||||
@@ -1 +0,0 @@
|
||||
allow
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
#IMC "HostScanner" /usr/local/lib/libhostscannerimc.so
|
||||
@@ -1,11 +0,0 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnccs-20 updown
|
||||
multiple_authentication=no
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-2.0
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
isolate
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
||||
#IMC "HostScanner" /usr/local/lib/libhostscannerimc.so
|
||||
@@ -1 +0,0 @@
|
||||
1
|
||||
@@ -1,4 +0,0 @@
|
||||
#IMV configuration file for strongSwan server
|
||||
|
||||
IMV "Dummy" /usr/local/lib/libdummyimv.so
|
||||
#IMV "HostScanner" /usr/local/lib/libhostscannerimv.so
|
||||
@@ -0,0 +1,11 @@
|
||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
|
||||
using EAP-TTLS authentication only with the gateway presenting a server certificate and
|
||||
the clients doing EAP-MD5 password-based authentication.
|
||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
||||
The Dummy IMC and IMV from the TNC@FHH project are used which communicate over a proprietary protocol.
|
||||
<p>
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
|
||||
clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets,
|
||||
respectively.
|
||||
|
||||
+2
-4
@@ -6,11 +6,9 @@ dave::cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
|
||||
dave::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
|
||||
dave::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
||||
dave::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
|
||||
moon::cat /var/log/auth.log::policy enforced on peer '[email protected]' is 'allow'::YES
|
||||
moon::cat /var/log/daemon.log::policy enforcement point added group membership 'allow'::YES
|
||||
moon::cat /var/log/daemon.log::added group membership 'allow'::YES
|
||||
moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
||||
moon::cat /var/log/auth.log::policy enforced on peer '[email protected]' is 'isolate'::YES
|
||||
moon::cat /var/log/daemon.log::policy enforcement point added group membership 'isolate'::YES
|
||||
moon::cat /var/log/daemon.log::added group membership 'isolate'::YES
|
||||
moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
||||
moon::ipsec statusall::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
|
||||
moon::ipsec statusall::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
config setup
|
||||
plutostart=no
|
||||
charondebug="tls 2, tnc 3"
|
||||
charondebug="tnc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
config setup
|
||||
plutostart=no
|
||||
charondebug="tls 2, tnc 3"
|
||||
charondebug="tnc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
config setup
|
||||
strictcrlpolicy=no
|
||||
plutostart=no
|
||||
charondebug="tls 2, tnc 3"
|
||||
charondebug="tnc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
+3
-3
@@ -6,9 +6,9 @@ carol::cat /etc/tnc_config
|
||||
dave::cat /etc/tnc_config
|
||||
carol::cat /etc/tnc/dummyimc.file
|
||||
dave::cat /etc/tnc/dummyimc.file
|
||||
moon::LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties ipsec start
|
||||
carol::LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties ipsec start
|
||||
dave::LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties ipsec start
|
||||
moon::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties ipsec start
|
||||
carol::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties ipsec start
|
||||
dave::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties ipsec start
|
||||
carol::sleep 1
|
||||
carol::ipsec up home
|
||||
dave::ipsec up home
|
||||
+2
@@ -6,6 +6,8 @@ the FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
|
||||
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
|
||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
||||
The IMC and IMV communicate using the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
||||
<p>
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements <b>carol</b>
|
||||
is authenticated successfully and is granted access to the subnet behind <b>moon</b> whereas
|
||||
<b>dave</b> fails the layered EAP authentication and is rejected.
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
libimcv {
|
||||
debug_level = 3
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
#IMV configuration file for strongSwan client
|
||||
|
||||
IMV "Test" /usr/local/libexec/ipsec/plugins/libstrongswan-imv-test.so
|
||||
+3
-5
@@ -3,12 +3,10 @@ carol::/etc/init.d/iptables start 2> /dev/null
|
||||
dave::/etc/init.d/iptables start 2> /dev/null
|
||||
alice::ln -s /etc/raddb/sites-available/inner-tunnel-second /etc/raddb/sites-enabled/inner-tunnel-second
|
||||
alice::cat /etc/raddb/sites-enabled/inner-tunnel-second
|
||||
alice::/etc/init.d/radiusd start
|
||||
carol::cat /etc/tnc/dummyimc.file
|
||||
dave::cat /etc/tnc/dummyimc.file
|
||||
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
|
||||
moon::ipsec start
|
||||
carol::ipsec start
|
||||
dave::ipsec start
|
||||
carol::LEAK_DETECTIVE_DISABLE=1 ipsec start
|
||||
dave::LEAK_DETECTIVE_DISABLE=1 ipsec start
|
||||
carol::sleep 1
|
||||
carol::ipsec up home
|
||||
dave::ipsec up home
|
||||
+4
-3
@@ -6,6 +6,7 @@ the FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
|
||||
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
|
||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements exchanged
|
||||
via the <b>IF-M</b> (RFC 5792 PA-TNC) protocol, the clients are connected by gateway <b>moon</b>
|
||||
to the "rw-allow" and "rw-isolate" subnets, respectively.
|
||||
The IMC and IMV communicate using the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
||||
<p>
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the clients
|
||||
are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
|
||||
@@ -0,0 +1,15 @@
|
||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
||||
log4j.rootLogger=DEBUG, A1, A2
|
||||
|
||||
# A1 is set to be a ConsoleAppender.
|
||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
||||
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
|
||||
|
||||
# A2 is set to be a SyslogAppender
|
||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
||||
log4j.appender.A2.Facility=DAEMON
|
||||
log4j.appender.A2.SyslogHost=localhost
|
||||
log4j.appender.A2.Threshold=DEBUG
|
||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
||||
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
config setup
|
||||
plutostart=no
|
||||
charondebug="tls 2, tnc 3"
|
||||
charondebug="tnc 3, imc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
+5
-2
@@ -3,9 +3,12 @@
|
||||
charon {
|
||||
load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnccs-11 updown
|
||||
multiple_authentication=no
|
||||
}
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
imc-test {
|
||||
command = allow
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "Test" /usr/local/libexec/ipsec/plugins/libstrongswan-imc-test.so
|
||||
+1
-1
@@ -2,7 +2,7 @@
|
||||
|
||||
config setup
|
||||
plutostart=no
|
||||
charondebug="tls 2, tnc 3"
|
||||
charondebug="tnc 3, imc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user