testing: Remove TNC@FHH dependencies and scenarios that rely on them
While we could continue to use FreeRADIUS 2.x that branch is officially EOL. So instead of investing time and effort in updating/migrating the patches to FreeRADIUS 3.x (the module changed quite significantly as it relies solely on the naeap library in that release), for a protocol that is superseded anyway, we just remove these scenarios and the dependencies. Actually, the complete rlm_eap_tnc module will be removed with FreeRADIUS 4.0.
This commit is contained in:
Tobias Brunner
@@ -695,15 +695,10 @@ do
|
|||||||
$TESTRESULTDIR/${host}.$file > /dev/null 2>&1
|
$TESTRESULTDIR/${host}.$file > /dev/null 2>&1
|
||||||
done
|
done
|
||||||
|
|
||||||
scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \
|
|
||||||
$TESTRESULTDIR/${host}.strongswan.conf > /dev/null 2>&1
|
|
||||||
|
|
||||||
scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \
|
scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \
|
||||||
$TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
|
$TESTRESULTDIR/${host}.radius.log > /dev/null 2>&1
|
||||||
|
|
||||||
ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
|
|
||||||
>> $TESTRESULTDIR/${host}.daemon.log 2>/dev/null
|
|
||||||
|
|
||||||
chmod a+r $TESTRESULTDIR/*
|
chmod a+r $TESTRESULTDIR/*
|
||||||
cat >> $TESTRESULTDIR/index.html <<@EOF
|
cat >> $TESTRESULTDIR/index.html <<@EOF
|
||||||
<h3>$host</h3>
|
<h3>$host</h3>
|
||||||
@@ -713,14 +708,12 @@ do
|
|||||||
<ul>
|
<ul>
|
||||||
<li><a href="$host.clients.conf">clients.conf</a></li>
|
<li><a href="$host.clients.conf">clients.conf</a></li>
|
||||||
<li><a href="$host.radiusd.conf">radiusd.conf</a></li>
|
<li><a href="$host.radiusd.conf">radiusd.conf</a></li>
|
||||||
<li><a href="$host.strongswan.conf">strongswan.conf</a></li>
|
|
||||||
</ul>
|
</ul>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">
|
<td valign="top">
|
||||||
<ul>
|
<ul>
|
||||||
<li><a href="$host.eap.conf">eap.conf</a></li>
|
<li><a href="$host.eap.conf">eap.conf</a></li>
|
||||||
<li><a href="$host.radius.log">radius.log</a></li>
|
<li><a href="$host.radius.log">radius.log</a></li>
|
||||||
<li><a href="$host.daemon.log">daemon.log</a></li>
|
|
||||||
</ul>
|
</ul>
|
||||||
</td>
|
</td>
|
||||||
<td valign="top">
|
<td valign="top">
|
||||||
|
|||||||
@@ -11,7 +11,7 @@
|
|||||||
#
|
#
|
||||||
# The filename given here should be an absolute path.
|
# The filename given here should be an absolute path.
|
||||||
#
|
#
|
||||||
$INCLUDE /usr/local/share/freeradius/dictionary
|
$INCLUDE /usr/share/freeradius/dictionary
|
||||||
|
|
||||||
#
|
#
|
||||||
# Place additional attributes or $INCLUDEs here. They will
|
# Place additional attributes or $INCLUDEs here. They will
|
||||||
|
|||||||
@@ -34,7 +34,7 @@ stretch)
|
|||||||
*)
|
*)
|
||||||
echo_warn "Package list for '$BASEIMGSUITE' might has to be updated"
|
echo_warn "Package list for '$BASEIMGSUITE' might has to be updated"
|
||||||
esac
|
esac
|
||||||
SERVICES="apache2 dbus isc-dhcp-server slapd bind9"
|
SERVICES="apache2 dbus isc-dhcp-server slapd bind9 freeradius"
|
||||||
INC=$INC,${SERVICES// /,}
|
INC=$INC,${SERVICES// /,}
|
||||||
|
|
||||||
CACHEDIR=$BUILDDIR/cache
|
CACHEDIR=$BUILDDIR/cache
|
||||||
|
|||||||
@@ -1,31 +0,0 @@
|
|||||||
#!/usr/bin/make
|
|
||||||
|
|
||||||
PV = 1.25
|
|
||||||
PKG = libtnc-$(PV)
|
|
||||||
TAR = $(PKG).tar.gz
|
|
||||||
SRC = http://downloads.sourceforge.net/project/libtnc/libtnc/$(PV)/$(TAR)
|
|
||||||
|
|
||||||
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
|
|
||||||
|
|
||||||
CONFIG_OPTS = \
|
|
||||||
--sysconfdir=/etc
|
|
||||||
|
|
||||||
all: install
|
|
||||||
|
|
||||||
$(TAR):
|
|
||||||
wget $(SRC)
|
|
||||||
|
|
||||||
.$(PKG)-unpacked: $(TAR)
|
|
||||||
tar xfz $(TAR)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-configured: .$(PKG)-unpacked
|
|
||||||
cd $(PKG) && ./configure $(CONFIG_OPTS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-built: .$(PKG)-configured
|
|
||||||
cd $(PKG) && make -j $(NUM_CPUS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
install: .$(PKG)-built
|
|
||||||
cd $(PKG) && make install
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
#!/usr/bin/make
|
|
||||||
|
|
||||||
PKG = fhhtnc
|
|
||||||
SRC = git://github.com/trustatfhh/tnc-fhh.git
|
|
||||||
|
|
||||||
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
|
|
||||||
|
|
||||||
CONFIG_OPTS = \
|
|
||||||
-DCOMPONENT=all \
|
|
||||||
-DNAL=8021x
|
|
||||||
|
|
||||||
PATCHES = \
|
|
||||||
tnc-fhh-tncsim
|
|
||||||
|
|
||||||
all: install
|
|
||||||
|
|
||||||
.$(PKG)-cloned:
|
|
||||||
git clone $(SRC) $(PKG)
|
|
||||||
mkdir $(PKG)/build
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-patches-applied: .$(PKG)-cloned
|
|
||||||
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-configured: .$(PKG)-patches-applied
|
|
||||||
cd $(PKG)/build && cmake $(CONFIG_OPTS) ../
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-built: .$(PKG)-configured
|
|
||||||
cd $(PKG)/build && make -j $(NUM_CPUS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
install: .$(PKG)-built
|
|
||||||
cd $(PKG)/build && make install
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
#!/usr/bin/make
|
|
||||||
|
|
||||||
PV = 2.2.8
|
|
||||||
PKG = freeradius-server-$(PV)
|
|
||||||
TAR = $(PKG).tar.bz2
|
|
||||||
SRC = ftp://ftp.freeradius.org/pub/freeradius/old/$(TAR)
|
|
||||||
|
|
||||||
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
|
|
||||||
|
|
||||||
CONFIG_OPTS = \
|
|
||||||
--with-raddbdir=/etc/freeradius \
|
|
||||||
--sysconfdir=/etc \
|
|
||||||
--with-logdir=/var/log/freeradius \
|
|
||||||
--enable-developer \
|
|
||||||
--with-experimental-modules
|
|
||||||
|
|
||||||
PATCHES = \
|
|
||||||
freeradius-eap-sim-identity \
|
|
||||||
freeradius-tnc-fhh
|
|
||||||
|
|
||||||
all: install
|
|
||||||
|
|
||||||
$(TAR):
|
|
||||||
wget $(SRC)
|
|
||||||
|
|
||||||
.$(PKG)-unpacked: $(TAR)
|
|
||||||
tar xfj $(TAR)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-patches-applied: .$(PKG)-unpacked
|
|
||||||
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-configured: .$(PKG)-patches-applied
|
|
||||||
cd $(PKG) && ./configure $(CONFIG_OPTS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-built: .$(PKG)-configured
|
|
||||||
cd $(PKG) && make -j $(NUM_CPUS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
install: .$(PKG)-built
|
|
||||||
cd $(PKG) && make install
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
#!/usr/bin/make
|
|
||||||
|
|
||||||
PV = 2.0
|
|
||||||
PKG = hostapd-$(PV)
|
|
||||||
TAR = $(PKG).tar.gz
|
|
||||||
SRC = http://w1.fi/releases/$(TAR)
|
|
||||||
|
|
||||||
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
|
|
||||||
|
|
||||||
CONFIG_OPTS =
|
|
||||||
|
|
||||||
PATCHES = \
|
|
||||||
hostapd-config
|
|
||||||
|
|
||||||
SUBDIR = hostapd
|
|
||||||
|
|
||||||
all: install
|
|
||||||
|
|
||||||
$(TAR):
|
|
||||||
wget $(SRC)
|
|
||||||
|
|
||||||
.$(PKG)-unpacked: $(TAR)
|
|
||||||
tar xfz $(TAR)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-patches-applied: .$(PKG)-unpacked
|
|
||||||
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-configured: .$(PKG)-patches-applied
|
|
||||||
cp $(PKG)/$(SUBDIR)/defconfig $(PKG)/$(SUBDIR)/.config
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-built: .$(PKG)-configured
|
|
||||||
cd $(PKG)/$(SUBDIR) && make -j $(NUM_CPUS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
install: .$(PKG)-built
|
|
||||||
cd $(PKG)/$(SUBDIR) && make install
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
#!/usr/bin/make
|
|
||||||
|
|
||||||
PV = 2.0
|
|
||||||
PKG = wpa_supplicant-$(PV)
|
|
||||||
TAR = $(PKG).tar.gz
|
|
||||||
SRC = http://w1.fi/releases/$(TAR)
|
|
||||||
|
|
||||||
NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
|
|
||||||
|
|
||||||
CONFIG_OPTS =
|
|
||||||
|
|
||||||
PATCHES = \
|
|
||||||
wpa_supplicant-eap-tnc
|
|
||||||
|
|
||||||
SUBDIR = wpa_supplicant
|
|
||||||
|
|
||||||
all: install
|
|
||||||
|
|
||||||
$(TAR):
|
|
||||||
wget $(SRC)
|
|
||||||
|
|
||||||
.$(PKG)-unpacked: $(TAR)
|
|
||||||
tar xfz $(TAR)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-patches-applied: .$(PKG)-unpacked
|
|
||||||
cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-configured: .$(PKG)-patches-applied
|
|
||||||
cp $(PKG)/$(SUBDIR)/defconfig $(PKG)/$(SUBDIR)/.config
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
.$(PKG)-built: .$(PKG)-configured
|
|
||||||
cd $(PKG)/$(SUBDIR) && make -j $(NUM_CPUS)
|
|
||||||
@touch $@
|
|
||||||
|
|
||||||
install: .$(PKG)-built
|
|
||||||
cd $(PKG)/$(SUBDIR) && make install
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:03:05.081225276 +0100
|
|
||||||
+++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c 2012-11-28 11:46:59.746289881 +0100
|
|
||||||
@@ -246,14 +246,21 @@
|
|
||||||
newvp->vp_integer = ess->sim_id++;
|
|
||||||
pairreplace(outvps, newvp);
|
|
||||||
|
|
||||||
+ ess->keys.identitylen = strlen(handler->identity);
|
|
||||||
+ memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
|
|
||||||
+
|
|
||||||
/* make a copy of the identity */
|
|
||||||
newvp = pairfind(*invps, ATTRIBUTE_EAP_SIM_BASE + PW_EAP_SIM_IDENTITY);
|
|
||||||
- if (newvp) {
|
|
||||||
- ess->keys.identitylen = newvp->length;
|
|
||||||
- memcpy(ess->keys.identity, newvp->vp_octets, newvp->length);
|
|
||||||
- } else {
|
|
||||||
- ess->keys.identitylen = strlen(handler->identity);
|
|
||||||
- memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
|
|
||||||
+ if (newvp && newvp->length > 2) {
|
|
||||||
+ uint16_t len;
|
|
||||||
+
|
|
||||||
+ memcpy(&len, newvp->vp_octets, sizeof(uint16_t));
|
|
||||||
+ len = ntohs(len);
|
|
||||||
+ if (len <= newvp->length - 2 && len <= MAX_STRING_LEN) {
|
|
||||||
+ ess->keys.identitylen = len;
|
|
||||||
+ memcpy(ess->keys.identity, newvp->vp_octets + 2,
|
|
||||||
+ ess->keys.identitylen);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
/* all set, calculate keys! */
|
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -1,38 +0,0 @@
|
|||||||
diff -u -ur hostapd-2.0.orig/hostapd/defconfig hostapd-2.0/hostapd/defconfig
|
|
||||||
--- hostapd-2.0.orig/hostapd/defconfig 2013-01-12 16:42:53.000000000 +0100
|
|
||||||
+++ hostapd-2.0/hostapd/defconfig 2016-06-15 17:32:57.000000000 +0200
|
|
||||||
@@ -13,14 +13,14 @@
|
|
||||||
CONFIG_DRIVER_HOSTAP=y
|
|
||||||
|
|
||||||
# Driver interface for wired authenticator
|
|
||||||
-#CONFIG_DRIVER_WIRED=y
|
|
||||||
+CONFIG_DRIVER_WIRED=y
|
|
||||||
|
|
||||||
# Driver interface for madwifi driver
|
|
||||||
#CONFIG_DRIVER_MADWIFI=y
|
|
||||||
#CFLAGS += -I../../madwifi # change to the madwifi source directory
|
|
||||||
|
|
||||||
# Driver interface for drivers using the nl80211 kernel interface
|
|
||||||
-CONFIG_DRIVER_NL80211=y
|
|
||||||
+#CONFIG_DRIVER_NL80211=y
|
|
||||||
|
|
||||||
# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
|
|
||||||
#CONFIG_DRIVER_BSD=y
|
|
||||||
@@ -30,7 +30,7 @@
|
|
||||||
#LIBS_c += -L/usr/local/lib
|
|
||||||
|
|
||||||
# Driver interface for no driver (e.g., RADIUS server only)
|
|
||||||
-#CONFIG_DRIVER_NONE=y
|
|
||||||
+CONFIG_DRIVER_NONE=y
|
|
||||||
|
|
||||||
# IEEE 802.11F/IAPP
|
|
||||||
CONFIG_IAPP=y
|
|
||||||
@@ -152,7 +152,7 @@
|
|
||||||
|
|
||||||
# Add support for writing debug log to a file: -f /tmp/hostapd.log
|
|
||||||
# Disabled by default.
|
|
||||||
-#CONFIG_DEBUG_FILE=y
|
|
||||||
+CONFIG_DEBUG_FILE=y
|
|
||||||
|
|
||||||
# Remove support for RADIUS accounting
|
|
||||||
#CONFIG_NO_ACCOUNTING=y
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
diff --git a/CMakeLists.txt b/CMakeLists.txt
|
|
||||||
index fe65134512ea..3c5255f21ea6 100644
|
|
||||||
--- a/CMakeLists.txt
|
|
||||||
+++ b/CMakeLists.txt
|
|
||||||
@@ -101,7 +101,6 @@ IF(${COMPONENT} STREQUAL "ALL")
|
|
||||||
add_subdirectory(tncxacml)
|
|
||||||
add_subdirectory(imcv)
|
|
||||||
add_subdirectory(tncs)
|
|
||||||
- add_subdirectory(tncsim)
|
|
||||||
|
|
||||||
IF(${NAL} STREQUAL "8021X" OR ${NAL} STREQUAL "ALL")
|
|
||||||
add_subdirectory(naaeap)
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
diff -urN wpa_supplicant-2.0.ori/src/eap_peer/tncc.c wpa_supplicant-2.0/src/eap_peer/tncc.c
|
|
||||||
--- wpa_supplicant-2.0.ori/src/eap_peer/tncc.c 2013-01-12 16:42:53.000000000 +0100
|
|
||||||
+++ wpa_supplicant-2.0/src/eap_peer/tncc.c 2013-03-23 13:10:22.151059154 +0100
|
|
||||||
@@ -465,7 +465,7 @@
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
#else /* CONFIG_NATIVE_WINDOWS */
|
|
||||||
- imc->dlhandle = dlopen(imc->path, RTLD_LAZY);
|
|
||||||
+ imc->dlhandle = dlopen(imc->path, RTLD_LAZY | RTLD_GLOBAL);
|
|
||||||
if (imc->dlhandle == NULL) {
|
|
||||||
wpa_printf(MSG_ERROR, "TNC: Failed to open IMC '%s' (%s): %s",
|
|
||||||
imc->name, imc->path, dlerror());
|
|
||||||
diff -urN wpa_supplicant-2.0.ori/wpa_supplicant/defconfig wpa_supplicant-2.0/wpa_supplicant/defconfig
|
|
||||||
--- wpa_supplicant-2.0.ori/wpa_supplicant/defconfig 2013-01-12 16:42:53.000000000 +0100
|
|
||||||
+++ wpa_supplicant-2.0/wpa_supplicant/defconfig 2013-03-23 13:06:08.759052370 +0100
|
|
||||||
@@ -86,7 +86,7 @@
|
|
||||||
CONFIG_DRIVER_WEXT=y
|
|
||||||
|
|
||||||
# Driver interface for Linux drivers using the nl80211 kernel interface
|
|
||||||
-CONFIG_DRIVER_NL80211=y
|
|
||||||
+#CONFIG_DRIVER_NL80211=y
|
|
||||||
|
|
||||||
# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
|
|
||||||
#CONFIG_DRIVER_BSD=y
|
|
||||||
@@ -193,7 +193,7 @@
|
|
||||||
#CONFIG_EAP_GPSK_SHA256=y
|
|
||||||
|
|
||||||
# EAP-TNC and related Trusted Network Connect support (experimental)
|
|
||||||
-#CONFIG_EAP_TNC=y
|
|
||||||
+CONFIG_EAP_TNC=y
|
|
||||||
|
|
||||||
# Wi-Fi Protected Setup (WPS)
|
|
||||||
#CONFIG_WPS=y
|
|
||||||
diff -urN wpa_supplicant-2.0.ori/wpa_supplicant/Makefile wpa_supplicant-2.0/wpa_supplicant/Makefile
|
|
||||||
--- wpa_supplicant-2.0.ori/wpa_supplicant/Makefile 2013-01-12 16:42:53.000000000 +0100
|
|
||||||
+++ wpa_supplicant-2.0/wpa_supplicant/Makefile 2013-03-23 13:06:08.759052370 +0100
|
|
||||||
@@ -6,8 +6,8 @@
|
|
||||||
CFLAGS = -MMD -O2 -Wall -g
|
|
||||||
endif
|
|
||||||
|
|
||||||
-export LIBDIR ?= /usr/local/lib/
|
|
||||||
-export BINDIR ?= /usr/local/sbin/
|
|
||||||
+export LIBDIR ?= /usr/lib/
|
|
||||||
+export BINDIR ?= /usr/sbin/
|
|
||||||
PKG_CONFIG ?= pkg-config
|
|
||||||
|
|
||||||
CFLAGS += -I../src
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>
|
|
||||||
using EAP-TTLS authentication only with the gateway presenting a server certificate and
|
|
||||||
the clients doing EAP-MD5 password-based authentication.
|
|
||||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
|
||||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
|
||||||
The Dummy IMC and IMV from the
|
|
||||||
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
|
|
||||||
<b>TNC@FHH</b></a> project are used which communicate over a proprietary protocol.
|
|
||||||
<p>
|
|
||||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
|
|
||||||
clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets,
|
|
||||||
respectively.
|
|
||||||
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
|
|
||||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
|
||||||
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
|
|
||||||
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with EAP successful::YES
|
|
||||||
moon:: cat /var/log/daemon.log::added group membership 'allow'::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
moon:: cat /var/log/daemon.log::added group membership 'isolate'::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
|
|
||||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
|
||||||
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
|
|
||||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
|
||||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
|
||||||
@@ -1,158 +0,0 @@
|
|||||||
#! /bin/sh
|
|
||||||
### BEGIN INIT INFO
|
|
||||||
# Provides: charon
|
|
||||||
# Required-Start: $remote_fs $syslog
|
|
||||||
# Required-Stop: $remote_fs $syslog
|
|
||||||
# Default-Start: 2 3 4 5
|
|
||||||
# Default-Stop: 0 1 6
|
|
||||||
# Short-Description: strongSwan charon IKE daemon
|
|
||||||
# Description: with swanctl the strongSwan charon daemon must be
|
|
||||||
# running in the background
|
|
||||||
### END INIT INFO
|
|
||||||
|
|
||||||
# Author: Andreas Steffen <[email protected]>
|
|
||||||
#
|
|
||||||
# Do NOT "set -e"
|
|
||||||
|
|
||||||
# PATH should only include /usr/* if it runs after the mountnfs.sh script
|
|
||||||
PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin
|
|
||||||
DESC="strongSwan charon IKE daemon"
|
|
||||||
NAME=charon
|
|
||||||
DAEMON=/usr/local/libexec/ipsec/$NAME
|
|
||||||
DAEMON_ARGS=""
|
|
||||||
PIDFILE=/var/run/$NAME.pid
|
|
||||||
SCRIPTNAME=/etc/init.d/charon
|
|
||||||
|
|
||||||
export LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties
|
|
||||||
|
|
||||||
# Exit if the package is not installed
|
|
||||||
[ -x "$DAEMON" ] || exit 0
|
|
||||||
|
|
||||||
# Read configuration variable file if it is present
|
|
||||||
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
|
|
||||||
|
|
||||||
# Load the VERBOSE setting and other rcS variables
|
|
||||||
. /lib/init/vars.sh
|
|
||||||
|
|
||||||
# Define LSB log_* functions.
|
|
||||||
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
|
|
||||||
# and status_of_proc is working.
|
|
||||||
. /lib/lsb/init-functions
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that starts the daemon/service
|
|
||||||
#
|
|
||||||
do_start()
|
|
||||||
{
|
|
||||||
# Return
|
|
||||||
# 0 if daemon has been started
|
|
||||||
# 1 if daemon was already running
|
|
||||||
# 2 if daemon could not be started
|
|
||||||
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|
|
||||||
|| return 1
|
|
||||||
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON -- \
|
|
||||||
$DAEMON_ARGS \
|
|
||||||
|| return 2
|
|
||||||
# Add code here, if necessary, that waits for the process to be ready
|
|
||||||
# to handle requests from services started subsequently which depend
|
|
||||||
# on this one. As a last resort, sleep for some time.
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that stops the daemon/service
|
|
||||||
#
|
|
||||||
do_stop()
|
|
||||||
{
|
|
||||||
# Return
|
|
||||||
# 0 if daemon has been stopped
|
|
||||||
# 1 if daemon was already stopped
|
|
||||||
# 2 if daemon could not be stopped
|
|
||||||
# other if a failure occurred
|
|
||||||
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
|
|
||||||
RETVAL="$?"
|
|
||||||
[ "$RETVAL" = 2 ] && return 2
|
|
||||||
# Wait for children to finish too if this is a daemon that forks
|
|
||||||
# and if the daemon is only ever run from this initscript.
|
|
||||||
# If the above conditions are not satisfied then add some other code
|
|
||||||
# that waits for the process to drop all resources that could be
|
|
||||||
# needed by services started subsequently. A last resort is to
|
|
||||||
# sleep for some time.
|
|
||||||
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
|
|
||||||
[ "$?" = 2 ] && return 2
|
|
||||||
# Many daemons don't delete their pidfiles when they exit.
|
|
||||||
rm -f $PIDFILE
|
|
||||||
return "$RETVAL"
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that sends a SIGHUP to the daemon/service
|
|
||||||
#
|
|
||||||
do_reload() {
|
|
||||||
#
|
|
||||||
# If the daemon can reload its configuration without
|
|
||||||
# restarting (for example, when it is sent a SIGHUP),
|
|
||||||
# then implement that here.
|
|
||||||
#
|
|
||||||
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
case "$1" in
|
|
||||||
start)
|
|
||||||
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
|
|
||||||
do_start
|
|
||||||
case "$?" in
|
|
||||||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
|
||||||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
stop)
|
|
||||||
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
|
|
||||||
do_stop
|
|
||||||
case "$?" in
|
|
||||||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
|
||||||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
status)
|
|
||||||
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
|
|
||||||
;;
|
|
||||||
#reload|force-reload)
|
|
||||||
#
|
|
||||||
# If do_reload() is not implemented then leave this commented out
|
|
||||||
# and leave 'force-reload' as an alias for 'restart'.
|
|
||||||
#
|
|
||||||
#log_daemon_msg "Reloading $DESC" "$NAME"
|
|
||||||
#do_reload
|
|
||||||
#log_end_msg $?
|
|
||||||
#;;
|
|
||||||
restart|force-reload)
|
|
||||||
#
|
|
||||||
# If the "reload" option is implemented then remove the
|
|
||||||
# 'force-reload' alias
|
|
||||||
#
|
|
||||||
log_daemon_msg "Restarting $DESC" "$NAME"
|
|
||||||
do_stop
|
|
||||||
case "$?" in
|
|
||||||
0|1)
|
|
||||||
do_start
|
|
||||||
case "$?" in
|
|
||||||
0) log_end_msg 0 ;;
|
|
||||||
1) log_end_msg 1 ;; # Old process is still running
|
|
||||||
*) log_end_msg 1 ;; # Failed to start
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
# Failed to stop
|
|
||||||
log_end_msg 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
|
|
||||||
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
|
|
||||||
exit 3
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
:
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libtls {
|
|
||||||
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.100
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "Ar3etTnp"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
allow
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
|
||||||
log4j.rootLogger=DEBUG, A1, A2
|
|
||||||
|
|
||||||
# A1 is set to be a ConsoleAppender.
|
|
||||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
|
||||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A1.layout.ConversionPattern=--[IMC] %m%n
|
|
||||||
|
|
||||||
# A2 is set to be a SyslogAppender
|
|
||||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
|
||||||
log4j.appender.A2.Facility=DAEMON
|
|
||||||
log4j.appender.A2.SyslogHost=localhost
|
|
||||||
log4j.appender.A2.Threshold=DEBUG
|
|
||||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A2.layout.ConversionPattern=--[IMC] %m%n
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
|
||||||
#IMC "HostScanner" /usr/local/lib/libhostscannerimc.so
|
|
||||||
@@ -1,158 +0,0 @@
|
|||||||
#! /bin/sh
|
|
||||||
### BEGIN INIT INFO
|
|
||||||
# Provides: charon
|
|
||||||
# Required-Start: $remote_fs $syslog
|
|
||||||
# Required-Stop: $remote_fs $syslog
|
|
||||||
# Default-Start: 2 3 4 5
|
|
||||||
# Default-Stop: 0 1 6
|
|
||||||
# Short-Description: strongSwan charon IKE daemon
|
|
||||||
# Description: with swanctl the strongSwan charon daemon must be
|
|
||||||
# running in the background
|
|
||||||
### END INIT INFO
|
|
||||||
|
|
||||||
# Author: Andreas Steffen <[email protected]>
|
|
||||||
#
|
|
||||||
# Do NOT "set -e"
|
|
||||||
|
|
||||||
# PATH should only include /usr/* if it runs after the mountnfs.sh script
|
|
||||||
PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin
|
|
||||||
DESC="strongSwan charon IKE daemon"
|
|
||||||
NAME=charon
|
|
||||||
DAEMON=/usr/local/libexec/ipsec/$NAME
|
|
||||||
DAEMON_ARGS=""
|
|
||||||
PIDFILE=/var/run/$NAME.pid
|
|
||||||
SCRIPTNAME=/etc/init.d/charon
|
|
||||||
|
|
||||||
export LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties
|
|
||||||
|
|
||||||
# Exit if the package is not installed
|
|
||||||
[ -x "$DAEMON" ] || exit 0
|
|
||||||
|
|
||||||
# Read configuration variable file if it is present
|
|
||||||
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
|
|
||||||
|
|
||||||
# Load the VERBOSE setting and other rcS variables
|
|
||||||
. /lib/init/vars.sh
|
|
||||||
|
|
||||||
# Define LSB log_* functions.
|
|
||||||
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
|
|
||||||
# and status_of_proc is working.
|
|
||||||
. /lib/lsb/init-functions
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that starts the daemon/service
|
|
||||||
#
|
|
||||||
do_start()
|
|
||||||
{
|
|
||||||
# Return
|
|
||||||
# 0 if daemon has been started
|
|
||||||
# 1 if daemon was already running
|
|
||||||
# 2 if daemon could not be started
|
|
||||||
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|
|
||||||
|| return 1
|
|
||||||
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON -- \
|
|
||||||
$DAEMON_ARGS \
|
|
||||||
|| return 2
|
|
||||||
# Add code here, if necessary, that waits for the process to be ready
|
|
||||||
# to handle requests from services started subsequently which depend
|
|
||||||
# on this one. As a last resort, sleep for some time.
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that stops the daemon/service
|
|
||||||
#
|
|
||||||
do_stop()
|
|
||||||
{
|
|
||||||
# Return
|
|
||||||
# 0 if daemon has been stopped
|
|
||||||
# 1 if daemon was already stopped
|
|
||||||
# 2 if daemon could not be stopped
|
|
||||||
# other if a failure occurred
|
|
||||||
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
|
|
||||||
RETVAL="$?"
|
|
||||||
[ "$RETVAL" = 2 ] && return 2
|
|
||||||
# Wait for children to finish too if this is a daemon that forks
|
|
||||||
# and if the daemon is only ever run from this initscript.
|
|
||||||
# If the above conditions are not satisfied then add some other code
|
|
||||||
# that waits for the process to drop all resources that could be
|
|
||||||
# needed by services started subsequently. A last resort is to
|
|
||||||
# sleep for some time.
|
|
||||||
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
|
|
||||||
[ "$?" = 2 ] && return 2
|
|
||||||
# Many daemons don't delete their pidfiles when they exit.
|
|
||||||
rm -f $PIDFILE
|
|
||||||
return "$RETVAL"
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that sends a SIGHUP to the daemon/service
|
|
||||||
#
|
|
||||||
do_reload() {
|
|
||||||
#
|
|
||||||
# If the daemon can reload its configuration without
|
|
||||||
# restarting (for example, when it is sent a SIGHUP),
|
|
||||||
# then implement that here.
|
|
||||||
#
|
|
||||||
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
case "$1" in
|
|
||||||
start)
|
|
||||||
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
|
|
||||||
do_start
|
|
||||||
case "$?" in
|
|
||||||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
|
||||||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
stop)
|
|
||||||
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
|
|
||||||
do_stop
|
|
||||||
case "$?" in
|
|
||||||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
|
||||||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
status)
|
|
||||||
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
|
|
||||||
;;
|
|
||||||
#reload|force-reload)
|
|
||||||
#
|
|
||||||
# If do_reload() is not implemented then leave this commented out
|
|
||||||
# and leave 'force-reload' as an alias for 'restart'.
|
|
||||||
#
|
|
||||||
#log_daemon_msg "Reloading $DESC" "$NAME"
|
|
||||||
#do_reload
|
|
||||||
#log_end_msg $?
|
|
||||||
#;;
|
|
||||||
restart|force-reload)
|
|
||||||
#
|
|
||||||
# If the "reload" option is implemented then remove the
|
|
||||||
# 'force-reload' alias
|
|
||||||
#
|
|
||||||
log_daemon_msg "Restarting $DESC" "$NAME"
|
|
||||||
do_stop
|
|
||||||
case "$?" in
|
|
||||||
0|1)
|
|
||||||
do_start
|
|
||||||
case "$?" in
|
|
||||||
0) log_end_msg 0 ;;
|
|
||||||
1) log_end_msg 1 ;; # Old process is still running
|
|
||||||
*) log_end_msg 1 ;; # Failed to start
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
# Failed to stop
|
|
||||||
log_end_msg 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
|
|
||||||
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
|
|
||||||
exit 3
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
:
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libtls {
|
|
||||||
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.200
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "W7R0g3do"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
isolate
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
|
||||||
log4j.rootLogger=DEBUG, A1, A2
|
|
||||||
|
|
||||||
# A1 is set to be a ConsoleAppender.
|
|
||||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
|
||||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A1.layout.ConversionPattern=--[IMC] %m%n
|
|
||||||
|
|
||||||
# A2 is set to be a SyslogAppender
|
|
||||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
|
||||||
log4j.appender.A2.Facility=DAEMON
|
|
||||||
log4j.appender.A2.SyslogHost=localhost
|
|
||||||
log4j.appender.A2.Threshold=DEBUG
|
|
||||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A2.layout.ConversionPattern=--[IMC] %m%n
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "Dummy" /usr/local/lib/libdummyimc.so
|
|
||||||
#IMC "HostScanner" /usr/local/lib/libhostscannerimc.so
|
|
||||||
@@ -1,158 +0,0 @@
|
|||||||
#! /bin/sh
|
|
||||||
### BEGIN INIT INFO
|
|
||||||
# Provides: charon
|
|
||||||
# Required-Start: $remote_fs $syslog
|
|
||||||
# Required-Stop: $remote_fs $syslog
|
|
||||||
# Default-Start: 2 3 4 5
|
|
||||||
# Default-Stop: 0 1 6
|
|
||||||
# Short-Description: strongSwan charon IKE daemon
|
|
||||||
# Description: with swanctl the strongSwan charon daemon must be
|
|
||||||
# running in the background
|
|
||||||
### END INIT INFO
|
|
||||||
|
|
||||||
# Author: Andreas Steffen <[email protected]>
|
|
||||||
#
|
|
||||||
# Do NOT "set -e"
|
|
||||||
|
|
||||||
# PATH should only include /usr/* if it runs after the mountnfs.sh script
|
|
||||||
PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin
|
|
||||||
DESC="strongSwan charon IKE daemon"
|
|
||||||
NAME=charon
|
|
||||||
DAEMON=/usr/local/libexec/ipsec/$NAME
|
|
||||||
DAEMON_ARGS=""
|
|
||||||
PIDFILE=/var/run/$NAME.pid
|
|
||||||
SCRIPTNAME=/etc/init.d/charon
|
|
||||||
|
|
||||||
export LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties
|
|
||||||
|
|
||||||
# Exit if the package is not installed
|
|
||||||
[ -x "$DAEMON" ] || exit 0
|
|
||||||
|
|
||||||
# Read configuration variable file if it is present
|
|
||||||
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
|
|
||||||
|
|
||||||
# Load the VERBOSE setting and other rcS variables
|
|
||||||
. /lib/init/vars.sh
|
|
||||||
|
|
||||||
# Define LSB log_* functions.
|
|
||||||
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
|
|
||||||
# and status_of_proc is working.
|
|
||||||
. /lib/lsb/init-functions
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that starts the daemon/service
|
|
||||||
#
|
|
||||||
do_start()
|
|
||||||
{
|
|
||||||
# Return
|
|
||||||
# 0 if daemon has been started
|
|
||||||
# 1 if daemon was already running
|
|
||||||
# 2 if daemon could not be started
|
|
||||||
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
|
|
||||||
|| return 1
|
|
||||||
start-stop-daemon --start --quiet --background --pidfile $PIDFILE --exec $DAEMON -- \
|
|
||||||
$DAEMON_ARGS \
|
|
||||||
|| return 2
|
|
||||||
# Add code here, if necessary, that waits for the process to be ready
|
|
||||||
# to handle requests from services started subsequently which depend
|
|
||||||
# on this one. As a last resort, sleep for some time.
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that stops the daemon/service
|
|
||||||
#
|
|
||||||
do_stop()
|
|
||||||
{
|
|
||||||
# Return
|
|
||||||
# 0 if daemon has been stopped
|
|
||||||
# 1 if daemon was already stopped
|
|
||||||
# 2 if daemon could not be stopped
|
|
||||||
# other if a failure occurred
|
|
||||||
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
|
|
||||||
RETVAL="$?"
|
|
||||||
[ "$RETVAL" = 2 ] && return 2
|
|
||||||
# Wait for children to finish too if this is a daemon that forks
|
|
||||||
# and if the daemon is only ever run from this initscript.
|
|
||||||
# If the above conditions are not satisfied then add some other code
|
|
||||||
# that waits for the process to drop all resources that could be
|
|
||||||
# needed by services started subsequently. A last resort is to
|
|
||||||
# sleep for some time.
|
|
||||||
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
|
|
||||||
[ "$?" = 2 ] && return 2
|
|
||||||
# Many daemons don't delete their pidfiles when they exit.
|
|
||||||
rm -f $PIDFILE
|
|
||||||
return "$RETVAL"
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# Function that sends a SIGHUP to the daemon/service
|
|
||||||
#
|
|
||||||
do_reload() {
|
|
||||||
#
|
|
||||||
# If the daemon can reload its configuration without
|
|
||||||
# restarting (for example, when it is sent a SIGHUP),
|
|
||||||
# then implement that here.
|
|
||||||
#
|
|
||||||
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
case "$1" in
|
|
||||||
start)
|
|
||||||
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
|
|
||||||
do_start
|
|
||||||
case "$?" in
|
|
||||||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
|
||||||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
stop)
|
|
||||||
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
|
|
||||||
do_stop
|
|
||||||
case "$?" in
|
|
||||||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
|
|
||||||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
status)
|
|
||||||
status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
|
|
||||||
;;
|
|
||||||
#reload|force-reload)
|
|
||||||
#
|
|
||||||
# If do_reload() is not implemented then leave this commented out
|
|
||||||
# and leave 'force-reload' as an alias for 'restart'.
|
|
||||||
#
|
|
||||||
#log_daemon_msg "Reloading $DESC" "$NAME"
|
|
||||||
#do_reload
|
|
||||||
#log_end_msg $?
|
|
||||||
#;;
|
|
||||||
restart|force-reload)
|
|
||||||
#
|
|
||||||
# If the "reload" option is implemented then remove the
|
|
||||||
# 'force-reload' alias
|
|
||||||
#
|
|
||||||
log_daemon_msg "Restarting $DESC" "$NAME"
|
|
||||||
do_stop
|
|
||||||
case "$?" in
|
|
||||||
0|1)
|
|
||||||
do_start
|
|
||||||
case "$?" in
|
|
||||||
0) log_end_msg 0 ;;
|
|
||||||
1) log_end_msg 1 ;; # Old process is still running
|
|
||||||
*) log_end_msg 1 ;; # Failed to start
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
# Failed to stop
|
|
||||||
log_end_msg 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
|
|
||||||
echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
|
|
||||||
exit 3
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
:
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
|
|
||||||
|
|
||||||
multiple_authentication = no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-ttls {
|
|
||||||
phase2_method = md5
|
|
||||||
phase2_piggyback = yes
|
|
||||||
phase2_tnc = yes
|
|
||||||
phase2_tnc_method = tnc
|
|
||||||
}
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libtls {
|
|
||||||
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
||||||
}
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
rw-allow {
|
|
||||||
local_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = *@strongswan.org
|
|
||||||
groups = allow
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
rw-allow {
|
|
||||||
local_ts = 10.1.0.0/28
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
|
|
||||||
rw-isolate {
|
|
||||||
local_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-ttls
|
|
||||||
id = *@strongswan.org
|
|
||||||
groups = isolate
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
rw-isolate {
|
|
||||||
local_ts = 10.1.0.16/28
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap-carol {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "Ar3etTnp"
|
|
||||||
}
|
|
||||||
eap-dave {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "W7R0g3do"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
1
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
#FTP - File Transfer Protocol
|
|
||||||
TCP 20 = whatever
|
|
||||||
TCP 21 = close
|
|
||||||
|
|
||||||
#SSH - Secure Shell
|
|
||||||
TCP 22 = whatever
|
|
||||||
|
|
||||||
#Telnet
|
|
||||||
TCP 23 = close
|
|
||||||
|
|
||||||
#E-Mail
|
|
||||||
#
|
|
||||||
#SMTP - Simple Mail Transfer Protocol
|
|
||||||
TCP 25 = close
|
|
||||||
TCP 587 = close
|
|
||||||
#POP3 - Post Office Protocol version 3
|
|
||||||
TCP 110 = close
|
|
||||||
TCP 995 = close
|
|
||||||
|
|
||||||
#DNS - Domain Name System
|
|
||||||
UDP 53 = close
|
|
||||||
TCP 53 = close
|
|
||||||
|
|
||||||
#BOOTP/DHCP - Bootstrap Protocol /
|
|
||||||
#Dynamic Host Configuration Protocol
|
|
||||||
UDP 67 = close
|
|
||||||
#UDP 68 = open
|
|
||||||
UDP 68 = whatever
|
|
||||||
|
|
||||||
#www - World Wide Web
|
|
||||||
#HTTP - Hypertext Transfer Protocol
|
|
||||||
TCP 80 = close
|
|
||||||
#HTTPS - Hypertext Transfer Protocol Secure
|
|
||||||
TCP 443 = close
|
|
||||||
|
|
||||||
#examples
|
|
||||||
TCP 8080 = close
|
|
||||||
TCP 5223 = whatever
|
|
||||||
UDP 4444 = close
|
|
||||||
UDP 631 = whatever
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
|
||||||
log4j.rootLogger=DEBUG, A1, A2
|
|
||||||
|
|
||||||
# A1 is set to be a ConsoleAppender.
|
|
||||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
|
||||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A1.layout.ConversionPattern=--[IMV] %m%n
|
|
||||||
|
|
||||||
# A2 is set to be a SyslogAppender
|
|
||||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
|
||||||
log4j.appender.A2.Facility=DAEMON
|
|
||||||
log4j.appender.A2.SyslogHost=localhost
|
|
||||||
log4j.appender.A2.Threshold=DEBUG
|
|
||||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A2.layout.ConversionPattern=--[IMV] %m%n
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMV configuration file for strongSwan server
|
|
||||||
|
|
||||||
IMV "Dummy" /usr/local/lib/libdummyimv.so
|
|
||||||
#IMV "HostScanner" /usr/local/lib/libhostscannerimv.so
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
carol::systemctl stop strongswan-swanctl
|
|
||||||
dave::systemctl stop strongswan-swanctl
|
|
||||||
moon::systemctl stop strongswan-swanctl
|
|
||||||
moon::iptables-restore < /etc/iptables.flush
|
|
||||||
carol::iptables-restore < /etc/iptables.flush
|
|
||||||
dave::iptables-restore < /etc/iptables.flush
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
moon::iptables-restore < /etc/iptables.rules
|
|
||||||
carol::iptables-restore < /etc/iptables.rules
|
|
||||||
dave::iptables-restore < /etc/iptables.rules
|
|
||||||
moon::cat /etc/tnc_config
|
|
||||||
carol::cat /etc/tnc_config
|
|
||||||
dave::cat /etc/tnc_config
|
|
||||||
carol::cat /etc/tnc/dummyimc.file
|
|
||||||
dave::cat /etc/tnc/dummyimc.file
|
|
||||||
carol::rm /etc/swanctl/rsa/*
|
|
||||||
dave::rm /etc/swanctl/rsa/*
|
|
||||||
carol::rm /etc/swanctl/x509/*
|
|
||||||
dave::rm /etc/swanctl/x509/*
|
|
||||||
moon::systemctl start strongswan-swanctl
|
|
||||||
carol::systemctl start strongswan-swanctl
|
|
||||||
dave::systemctl start strongswan-swanctl
|
|
||||||
moon::expect-connection rw-allow
|
|
||||||
carol::expect-connection home
|
|
||||||
carol::swanctl --initiate --child home 2> /dev/null
|
|
||||||
dave::expect-connection home
|
|
||||||
dave::swanctl --initiate --child home 2> /dev/null
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# guest instances used for this test
|
|
||||||
|
|
||||||
# All guest instances that are required for this test
|
|
||||||
#
|
|
||||||
VIRTHOSTS="alice venus moon carol winnetou dave"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-v-m-c-w-d.png"
|
|
||||||
|
|
||||||
# Guest instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# Guest instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="moon carol dave"
|
|
||||||
|
|
||||||
# Guest instances on which FreeRadius is started
|
|
||||||
#
|
|
||||||
RADIUSHOSTS=
|
|
||||||
# charon controlled by swanctl
|
|
||||||
#
|
|
||||||
SWANCTL=1
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
|
|
||||||
At the outset the gateway authenticates itself to the clients by sending an IKEv2
|
|
||||||
<b>RSA signature</b> accompanied by a certificate.
|
|
||||||
<b>carol</b> and <b>dave</b> then set up an <b>EAP-TTLS</b> tunnel each via <b>moon</b> to the
|
|
||||||
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
|
|
||||||
<b>TNC@FHH</b></a>-enhanced FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
|
|
||||||
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
|
|
||||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
|
||||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
|
||||||
The IMC and IMV communicate are using the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
|
||||||
<p>
|
|
||||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements <b>carol</b>
|
|
||||||
is authenticated successfully and is granted access to the subnet behind <b>moon</b> whereas
|
|
||||||
<b>dave</b> fails the layered EAP authentication and is rejected.
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
|
||||||
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
|
|
||||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
|
||||||
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*none::YES
|
|
||||||
dave:: cat /var/log/daemon.log::received EAP_FAILURE, EAP authentication failed::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
moon:: cat /var/log/daemon.log::RADIUS authentication of '[email protected]' failed::YES
|
|
||||||
moon:: cat /var/log/daemon.log::EAP method EAP_TTLS failed for peer [email protected]::YES
|
|
||||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
|
|
||||||
dave:: swanctl --list-sas --raw 2> /dev/null::home::NO
|
|
||||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw::NO
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
|
||||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
eap {
|
|
||||||
md5 {
|
|
||||||
}
|
|
||||||
default_eap_type = ttls
|
|
||||||
tls {
|
|
||||||
private_key_file = /etc/raddb/certs/aaaKey.pem
|
|
||||||
certificate_file = /etc/raddb/certs/aaaCert.pem
|
|
||||||
CA_file = /etc/raddb/certs/strongswanCert.pem
|
|
||||||
cipher_list = "DEFAULT"
|
|
||||||
dh_file = /etc/raddb/certs/dh
|
|
||||||
random_file = /etc/raddb/certs/random
|
|
||||||
}
|
|
||||||
ttls {
|
|
||||||
default_eap_type = md5
|
|
||||||
use_tunneled_reply = yes
|
|
||||||
virtual_server = "inner-tunnel"
|
|
||||||
tnc_virtual_server = "inner-tunnel-second"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
eap eap_tnc {
|
|
||||||
default_eap_type = tnc
|
|
||||||
tnc {
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
realm strongswan.org {
|
|
||||||
type = radius
|
|
||||||
authhost = LOCAL
|
|
||||||
accthost = LOCAL
|
|
||||||
}
|
|
||||||
-43
@@ -1,43 +0,0 @@
|
|||||||
authorize {
|
|
||||||
suffix
|
|
||||||
eap {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
preacct {
|
|
||||||
preprocess
|
|
||||||
acct_unique
|
|
||||||
suffix
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
accounting {
|
|
||||||
detail
|
|
||||||
unix
|
|
||||||
radutmp
|
|
||||||
attr_filter.accounting_response
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
exec
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pre-proxy {
|
|
||||||
}
|
|
||||||
|
|
||||||
post-proxy {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
-32
@@ -1,32 +0,0 @@
|
|||||||
server inner-tunnel {
|
|
||||||
|
|
||||||
authorize {
|
|
||||||
suffix
|
|
||||||
eap {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pre-proxy {
|
|
||||||
}
|
|
||||||
|
|
||||||
post-proxy {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
} # inner-tunnel server block
|
|
||||||
-36
@@ -1,36 +0,0 @@
|
|||||||
server inner-tunnel-second {
|
|
||||||
|
|
||||||
authorize {
|
|
||||||
eap_tnc {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap_tnc
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
if (control:TNC-Status == "Access") {
|
|
||||||
update reply {
|
|
||||||
Tunnel-Type := ESP
|
|
||||||
Filter-Id := "allow"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
elsif (control:TNC-Status == "Isolate") {
|
|
||||||
update reply {
|
|
||||||
Tunnel-Type := ESP
|
|
||||||
Filter-Id := "isolate"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
} # inner-tunnel-second block
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
carol Cleartext-Password := "Ar3etTnp"
|
|
||||||
dave Cleartext-Password := "W7R0g3do"
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
load = random nonce sha1 sha2 md5 gmp pubkey x509
|
|
||||||
debug_level = 3
|
|
||||||
assessment_result = no
|
|
||||||
plugins {
|
|
||||||
imv-test {
|
|
||||||
rounds = 1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
|
||||||
log4j.rootLogger=DEBUG, A1, A2
|
|
||||||
|
|
||||||
# A1 is set to be a ConsoleAppender.
|
|
||||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
|
||||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
|
|
||||||
|
|
||||||
# A2 is set to be a SyslogAppender
|
|
||||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
|
||||||
log4j.appender.A2.Facility=DAEMON
|
|
||||||
log4j.appender.A2.SyslogHost=localhost
|
|
||||||
log4j.appender.A2.Threshold=DEBUG
|
|
||||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMV configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMV "Test" /usr/local/lib/ipsec/imcvs/imv-test.so
|
|
||||||
IMV "Scanner" /usr/local/lib/ipsec/imcvs/imv-scanner.so
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
imc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
plugins {
|
|
||||||
imc-test {
|
|
||||||
command = allow
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.100
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap
|
|
||||||
aaa_id = aaa.strongswan.org
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "Ar3etTnp"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
|
||||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
imc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
plugins {
|
|
||||||
imc-test {
|
|
||||||
command = none
|
|
||||||
}
|
|
||||||
imc-scanner {
|
|
||||||
push_info = no
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.200
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap
|
|
||||||
aaa_id = aaa.strongswan.org
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "W7R0g3do"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
|
||||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
|
||||||
|
|
||||||
# allow RADIUS protocol with alice
|
|
||||||
-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
|
|
||||||
-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
eap-radius {
|
|
||||||
secret = gv6URkSs
|
|
||||||
server = 10.1.0.10
|
|
||||||
filter_id = yes
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
rw {
|
|
||||||
local_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
certs = moonCert.pem
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-radius
|
|
||||||
id = *@strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
rw {
|
|
||||||
local_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
carol::systemctl stop strongswan-swanctl
|
|
||||||
dave::systemctl stop strongswan-swanctl
|
|
||||||
moon::systemctl stop strongswan-swanctl
|
|
||||||
alice::killall radiusd
|
|
||||||
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
|
|
||||||
moon::iptables-restore < /etc/iptables.flush
|
|
||||||
carol::iptables-restore < /etc/iptables.flush
|
|
||||||
dave::iptables-restore < /etc/iptables.flush
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
moon::iptables-restore < /etc/iptables.rules
|
|
||||||
carol::iptables-restore < /etc/iptables.rules
|
|
||||||
dave::iptables-restore < /etc/iptables.rules
|
|
||||||
alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second
|
|
||||||
alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second
|
|
||||||
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
|
|
||||||
alice::cat /etc/tnc_config
|
|
||||||
carol::cat /etc/tnc_config
|
|
||||||
dave::cat /etc/tnc_config
|
|
||||||
carol::rm /etc/swanctl/rsa/*
|
|
||||||
dave::rm /etc/swanctl/rsa/*
|
|
||||||
carol::rm /etc/swanctl/x509/*
|
|
||||||
dave::rm /etc/swanctl/x509/*
|
|
||||||
moon::systemctl start strongswan-swanctl
|
|
||||||
carol::systemctl start strongswan-swanctl
|
|
||||||
dave::systemctl start strongswan-swanctl
|
|
||||||
moon::expect-connection rw
|
|
||||||
carol::expect-connection home
|
|
||||||
carol::swanctl --initiate --child home
|
|
||||||
dave::expect-connection home
|
|
||||||
dave::swanctl --initiate --child home
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# guest instances used for this test
|
|
||||||
|
|
||||||
# All guest instances that are required for this test
|
|
||||||
#
|
|
||||||
VIRTHOSTS="alice venus moon carol winnetou dave"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-v-m-c-w-d.png"
|
|
||||||
|
|
||||||
# Guest instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# Guest instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="moon carol dave"
|
|
||||||
|
|
||||||
# Guest instances on which FreeRadius is started
|
|
||||||
#
|
|
||||||
RADIUSHOSTS="alice"
|
|
||||||
|
|
||||||
# charon controlled by swanctl
|
|
||||||
#
|
|
||||||
SWANCTL=1
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
|
|
||||||
At the outset the gateway authenticates itself to the clients by sending an IKEv2
|
|
||||||
<b>RSA signature</b> accompanied by a certificate.
|
|
||||||
<b>carol</b> and <b>dave</b> then set up an <b>EAP-TTLS</b> tunnel each via <b>moon</b> to the
|
|
||||||
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
|
|
||||||
<b>TNC@FHH</b></a>-enhanced FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
|
|
||||||
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
|
|
||||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
|
||||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
|
||||||
The communication between the OS and Attestation IMC and the Attestation IMV is based on the
|
|
||||||
<b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
|
||||||
<p>
|
|
||||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the clients
|
|
||||||
are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
|
||||||
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
|
|
||||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
|
||||||
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
|
|
||||||
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
|
|
||||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=ECP_256.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
|
||||||
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
|
|
||||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
|
||||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
eap {
|
|
||||||
md5 {
|
|
||||||
}
|
|
||||||
default_eap_type = ttls
|
|
||||||
tls {
|
|
||||||
private_key_file = /etc/raddb/certs/aaaKey.pem
|
|
||||||
certificate_file = /etc/raddb/certs/aaaCert.pem
|
|
||||||
CA_file = /etc/raddb/certs/strongswanCert.pem
|
|
||||||
cipher_list = "DEFAULT"
|
|
||||||
dh_file = /etc/raddb/certs/dh
|
|
||||||
random_file = /etc/raddb/certs/random
|
|
||||||
}
|
|
||||||
ttls {
|
|
||||||
default_eap_type = md5
|
|
||||||
use_tunneled_reply = yes
|
|
||||||
virtual_server = "inner-tunnel"
|
|
||||||
tnc_virtual_server = "inner-tunnel-second"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
eap eap_tnc {
|
|
||||||
default_eap_type = tnc
|
|
||||||
tnc {
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
realm strongswan.org {
|
|
||||||
type = radius
|
|
||||||
authhost = LOCAL
|
|
||||||
accthost = LOCAL
|
|
||||||
}
|
|
||||||
-43
@@ -1,43 +0,0 @@
|
|||||||
authorize {
|
|
||||||
suffix
|
|
||||||
eap {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
preacct {
|
|
||||||
preprocess
|
|
||||||
acct_unique
|
|
||||||
suffix
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
accounting {
|
|
||||||
detail
|
|
||||||
unix
|
|
||||||
radutmp
|
|
||||||
attr_filter.accounting_response
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
exec
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pre-proxy {
|
|
||||||
}
|
|
||||||
|
|
||||||
post-proxy {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
-32
@@ -1,32 +0,0 @@
|
|||||||
server inner-tunnel {
|
|
||||||
|
|
||||||
authorize {
|
|
||||||
suffix
|
|
||||||
eap {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pre-proxy {
|
|
||||||
}
|
|
||||||
|
|
||||||
post-proxy {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
} # inner-tunnel server block
|
|
||||||
-36
@@ -1,36 +0,0 @@
|
|||||||
server inner-tunnel-second {
|
|
||||||
|
|
||||||
authorize {
|
|
||||||
eap_tnc {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap_tnc
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
if (control:TNC-Status == "Access") {
|
|
||||||
update reply {
|
|
||||||
Tunnel-Type := ESP
|
|
||||||
Filter-Id := "allow"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
elsif (control:TNC-Status == "Isolate") {
|
|
||||||
update reply {
|
|
||||||
Tunnel-Type := ESP
|
|
||||||
Filter-Id := "isolate"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
} # inner-tunnel-second block
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
carol Cleartext-Password := "Ar3etTnp"
|
|
||||||
dave Cleartext-Password := "W7R0g3do"
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
/* Devices */
|
|
||||||
|
|
||||||
INSERT INTO devices ( /* 1 */
|
|
||||||
value, product, created
|
|
||||||
)
|
|
||||||
SELECT 'aabbccddeeff11223344556677889900', id, 1372330615
|
|
||||||
FROM products WHERE name = 'Debian DEBIAN_VERSION x86_64';
|
|
||||||
|
|
||||||
/* Groups Members */
|
|
||||||
|
|
||||||
INSERT INTO groups_members (
|
|
||||||
group_id, device_id
|
|
||||||
) VALUES (
|
|
||||||
10, 1
|
|
||||||
);
|
|
||||||
|
|
||||||
INSERT INTO enforcements (
|
|
||||||
policy, group_id, max_age, rec_fail, rec_noresult
|
|
||||||
) VALUES (
|
|
||||||
3, 10, 0, 2, 2
|
|
||||||
);
|
|
||||||
|
|
||||||
INSERT INTO enforcements (
|
|
||||||
policy, group_id, max_age
|
|
||||||
) VALUES (
|
|
||||||
16, 2, 0
|
|
||||||
);
|
|
||||||
|
|
||||||
DELETE FROM enforcements WHERE id = 1;
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
load = random nonce openssl pubkey sqlite
|
|
||||||
debug_level = 3
|
|
||||||
database = sqlite:///etc/db.d/config.db
|
|
||||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
|
||||||
assessment_result = no
|
|
||||||
}
|
|
||||||
|
|
||||||
attest {
|
|
||||||
database = sqlite:///etc/db.d/config.db
|
|
||||||
}
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
|
||||||
log4j.rootLogger=DEBUG, A1, A2
|
|
||||||
|
|
||||||
# A1 is set to be a ConsoleAppender.
|
|
||||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
|
||||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
|
|
||||||
|
|
||||||
# A2 is set to be a SyslogAppender
|
|
||||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
|
||||||
log4j.appender.A2.Facility=DAEMON
|
|
||||||
log4j.appender.A2.SyslogHost=localhost
|
|
||||||
log4j.appender.A2.Threshold=DEBUG
|
|
||||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMV configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMV "OS" /usr/local/lib/ipsec/imcvs/imv-os.so
|
|
||||||
IMV "Attestation" /usr/local/lib/ipsec/imcvs/imv-attestation.so
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
imc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.100
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap
|
|
||||||
aaa_id = aaa.strongswan.org
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
proposals = aes128-sha256-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "Ar3etTnp"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
|
|
||||||
IMC "Attestation" /usr/local/lib/ipsec/imcvs/imc-attestation.so
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
retransmit_tries = 5
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
imc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.200
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap
|
|
||||||
aaa_id = aaa.strongswan.org
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
proposals = aes128-sha256-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "W7R0g3do"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
|
|
||||||
IMC "Attestation" /usr/local/lib/ipsec/imcvs/imc-attestation.so
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
*filter
|
|
||||||
|
|
||||||
# default policy is DROP
|
|
||||||
-P INPUT DROP
|
|
||||||
-P OUTPUT DROP
|
|
||||||
-P FORWARD DROP
|
|
||||||
|
|
||||||
# allow esp
|
|
||||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
||||||
|
|
||||||
# allow IKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow MobIKE
|
|
||||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
||||||
|
|
||||||
# allow ssh
|
|
||||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
||||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
||||||
|
|
||||||
# allow crl fetch from winnetou
|
|
||||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
|
||||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
|
||||||
|
|
||||||
# allow RADIUS protocol with alice
|
|
||||||
-A INPUT -i eth1 -p udp --sport 1812 -s PH_IP_ALICE -j ACCEPT
|
|
||||||
-A OUTPUT -o eth1 -p udp --dport 1812 -d PH_IP_ALICE -j ACCEPT
|
|
||||||
|
|
||||||
COMMIT
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce openssl pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-radius updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
eap-radius {
|
|
||||||
secret = gv6URkSs
|
|
||||||
server = 10.1.0.10
|
|
||||||
filter_id = yes
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
rw-allow {
|
|
||||||
local_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
certs = moonCert.pem
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-radius
|
|
||||||
id = *@strongswan.org
|
|
||||||
groups = allow
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
rw-allow {
|
|
||||||
local_ts = 10.1.0.0/28
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-ecp256
|
|
||||||
}
|
|
||||||
|
|
||||||
rw-isolate {
|
|
||||||
local_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = eap-radius
|
|
||||||
id = *@strongswan.org
|
|
||||||
groups = isolate
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
rw-isolate {
|
|
||||||
local_ts = 10.1.0.16/28
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
send_certreq = no
|
|
||||||
proposals = aes128-sha256-ecp256
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
carol::systemctl stop strongswan-swanctl
|
|
||||||
dave::systemctl stop strongswan-swanctl
|
|
||||||
moon::systemctl stop strongswan-swanctl
|
|
||||||
alice::killall radiusd
|
|
||||||
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
|
|
||||||
carol::echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
||||||
moon::iptables-restore < /etc/iptables.flush
|
|
||||||
carol::iptables-restore < /etc/iptables.flush
|
|
||||||
dave::iptables-restore < /etc/iptables.flush
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
moon::iptables-restore < /etc/iptables.rules
|
|
||||||
carol::iptables-restore < /etc/iptables.rules
|
|
||||||
dave::iptables-restore < /etc/iptables.rules
|
|
||||||
carol::echo 0 > /proc/sys/net/ipv4/ip_forward
|
|
||||||
dave::echo aabbccddeeff11223344556677889900 > /var/lib/dbus/machine-id
|
|
||||||
alice::ln -s /etc/freeradius/sites-available/inner-tunnel-second /etc/freeradius/sites-enabled/inner-tunnel-second
|
|
||||||
alice::cat /etc/freeradius/sites-enabled/inner-tunnel-second
|
|
||||||
alice::sed -i "s:DEBIAN_VERSION:\`cat /etc/debian_version\`:" /etc/pts/data1.sql
|
|
||||||
alice::cd /usr/local/share/strongswan/templates/database/imv; cat tables.sql data.sql /etc/pts/data1.sql | sqlite3 /etc/db.d/config.db
|
|
||||||
alice::LEAK_DETECTIVE_DISABLE=1 LOG4CXX_CONFIGURATION=/etc/tnc/log4cxx.properties radiusd
|
|
||||||
alice::cat /etc/tnc_config
|
|
||||||
carol::cat /etc/tnc_config
|
|
||||||
dave::cat /etc/tnc_config
|
|
||||||
carol::rm /etc/swanctl/rsa/*
|
|
||||||
dave::rm /etc/swanctl/rsa/*
|
|
||||||
carol::rm /etc/swanctl/x509/*
|
|
||||||
dave::rm /etc/swanctl/x509/*
|
|
||||||
moon::systemctl start strongswan-swanctl
|
|
||||||
carol::systemctl start strongswan-swanctl
|
|
||||||
dave::systemctl start strongswan-swanctl
|
|
||||||
moon::expect-connection rw-allow
|
|
||||||
moon::expect-connection rw-isolate
|
|
||||||
carol::expect-connection home
|
|
||||||
carol::swanctl --initiate --child home
|
|
||||||
dave::expect-connection home
|
|
||||||
dave::swanctl --initiate --child home
|
|
||||||
alice::ipsec attest --sessions
|
|
||||||
alice::ipsec attest --devices
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
#
|
|
||||||
# This configuration file provides information on the
|
|
||||||
# guest instances used for this test
|
|
||||||
|
|
||||||
# All guest instances that are required for this test
|
|
||||||
#
|
|
||||||
VIRTHOSTS="alice venus moon carol winnetou dave"
|
|
||||||
|
|
||||||
# Corresponding block diagram
|
|
||||||
#
|
|
||||||
DIAGRAM="a-v-m-c-w-d.png"
|
|
||||||
|
|
||||||
# Guest instances on which tcpdump is to be started
|
|
||||||
#
|
|
||||||
TCPDUMPHOSTS="moon"
|
|
||||||
|
|
||||||
# Guest instances on which IPsec is started
|
|
||||||
# Used for IPsec logging purposes
|
|
||||||
#
|
|
||||||
IPSECHOSTS="moon carol dave"
|
|
||||||
|
|
||||||
# Guest instances on which FreeRadius is started
|
|
||||||
#
|
|
||||||
RADIUSHOSTS="alice"
|
|
||||||
|
|
||||||
# Guest instances on which databases are used
|
|
||||||
#
|
|
||||||
DBHOSTS="alice"
|
|
||||||
|
|
||||||
# charon controlled by swanctl
|
|
||||||
#
|
|
||||||
SWANCTL=1
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
|
|
||||||
At the outset the gateway authenticates itself to the clients by sending an IKEv2
|
|
||||||
<b>RSA signature</b> accompanied by a certificate.
|
|
||||||
<b>carol</b> and <b>dave</b> then set up an <b>EAP-TTLS</b> tunnel each via <b>moon</b> to the
|
|
||||||
<a href="http://trust.f4.hs-hannover.de/projects/tncatfhh.html" target="popup">
|
|
||||||
<b>TNC@FHH</b></a>-enhanced FreeRADIUS server <b>alice</b> authenticated by an X.509 AAA certificate.
|
|
||||||
The strong EAP-TTLS tunnel protects the ensuing weak client authentication based on <b>EAP-MD5</b>.
|
|
||||||
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
|
|
||||||
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
|
|
||||||
The communication between IMCs and IMVs is based on the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
|
||||||
<p>
|
|
||||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the clients
|
|
||||||
are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
|
||||||
carol::cat /var/log/daemon.log::TNCCS-Recommendation.*allow::YES
|
|
||||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
|
||||||
dave:: cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
|
|
||||||
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
|
||||||
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
|
|
||||||
moon:: cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
|
|
||||||
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/28]::YES
|
|
||||||
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.16/28]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw-allow.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-allow.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/28] remote-ts=\[192.168.0.100/32]::YES
|
|
||||||
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw-isolate.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*rw-isolate.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.16/28] remote-ts=\[192.168.0.200/32]::YES
|
|
||||||
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
|
||||||
carol::ping -c 1 -W 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::NO
|
|
||||||
dave:: ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_.eq=1::YES
|
|
||||||
dave:: ping -c 1 -W 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::NO
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
eap {
|
|
||||||
md5 {
|
|
||||||
}
|
|
||||||
default_eap_type = ttls
|
|
||||||
tls {
|
|
||||||
private_key_file = /etc/raddb/certs/aaaKey.pem
|
|
||||||
certificate_file = /etc/raddb/certs/aaaCert.pem
|
|
||||||
CA_file = /etc/raddb/certs/strongswanCert.pem
|
|
||||||
cipher_list = "DEFAULT"
|
|
||||||
dh_file = /etc/raddb/certs/dh
|
|
||||||
random_file = /etc/raddb/certs/random
|
|
||||||
}
|
|
||||||
ttls {
|
|
||||||
default_eap_type = md5
|
|
||||||
use_tunneled_reply = yes
|
|
||||||
virtual_server = "inner-tunnel"
|
|
||||||
tnc_virtual_server = "inner-tunnel-second"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
eap eap_tnc {
|
|
||||||
default_eap_type = tnc
|
|
||||||
tnc {
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
realm strongswan.org {
|
|
||||||
type = radius
|
|
||||||
authhost = LOCAL
|
|
||||||
accthost = LOCAL
|
|
||||||
}
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
authorize {
|
|
||||||
suffix
|
|
||||||
eap {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
preacct {
|
|
||||||
preprocess
|
|
||||||
acct_unique
|
|
||||||
suffix
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
accounting {
|
|
||||||
detail
|
|
||||||
unix
|
|
||||||
radutmp
|
|
||||||
attr_filter.accounting_response
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
exec
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pre-proxy {
|
|
||||||
}
|
|
||||||
|
|
||||||
post-proxy {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
-32
@@ -1,32 +0,0 @@
|
|||||||
server inner-tunnel {
|
|
||||||
|
|
||||||
authorize {
|
|
||||||
suffix
|
|
||||||
eap {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
files
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
pre-proxy {
|
|
||||||
}
|
|
||||||
|
|
||||||
post-proxy {
|
|
||||||
eap
|
|
||||||
}
|
|
||||||
|
|
||||||
} # inner-tunnel server block
|
|
||||||
-36
@@ -1,36 +0,0 @@
|
|||||||
server inner-tunnel-second {
|
|
||||||
|
|
||||||
authorize {
|
|
||||||
eap_tnc {
|
|
||||||
ok = return
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
authenticate {
|
|
||||||
eap_tnc
|
|
||||||
}
|
|
||||||
|
|
||||||
session {
|
|
||||||
radutmp
|
|
||||||
}
|
|
||||||
|
|
||||||
post-auth {
|
|
||||||
if (control:TNC-Status == "Access") {
|
|
||||||
update reply {
|
|
||||||
Tunnel-Type := ESP
|
|
||||||
Filter-Id := "allow"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
elsif (control:TNC-Status == "Isolate") {
|
|
||||||
update reply {
|
|
||||||
Tunnel-Type := ESP
|
|
||||||
Filter-Id := "isolate"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Post-Auth-Type REJECT {
|
|
||||||
attr_filter.access_reject
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
} # inner-tunnel-second block
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
carol Cleartext-Password := "Ar3etTnp"
|
|
||||||
dave Cleartext-Password := "W7R0g3do"
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
load = random nonce sha1 sha2 md5 gmp pubkey x509
|
|
||||||
debug_level = 3
|
|
||||||
assessment_result = no
|
|
||||||
plugins {
|
|
||||||
imv-test {
|
|
||||||
rounds = 1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# Set root logger level to DEBUG and its appenders to A1 and A2.
|
|
||||||
log4j.rootLogger=DEBUG, A1, A2
|
|
||||||
|
|
||||||
# A1 is set to be a ConsoleAppender.
|
|
||||||
log4j.appender.A1=org.apache.log4j.ConsoleAppender
|
|
||||||
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A1.layout.ConversionPattern=[FHH] %m%n
|
|
||||||
|
|
||||||
# A2 is set to be a SyslogAppender
|
|
||||||
log4j.appender.A2=org.apache.log4j.net.SyslogAppender
|
|
||||||
log4j.appender.A2.Facility=DAEMON
|
|
||||||
log4j.appender.A2.SyslogHost=localhost
|
|
||||||
log4j.appender.A2.Threshold=DEBUG
|
|
||||||
log4j.appender.A2.layout=org.apache.log4j.PatternLayout
|
|
||||||
log4j.appender.A2.layout.ConversionPattern=[FHH] %m%n
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMV configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMV "Test" /usr/local/lib/ipsec/imcvs/imv-test.so
|
|
||||||
IMV "Scanner" /usr/local/lib/ipsec/imcvs/imv-scanner.so
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
imc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
plugins {
|
|
||||||
imc-test {
|
|
||||||
command = allow
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
libtls {
|
|
||||||
suites = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.100
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap
|
|
||||||
aaa_id = aaa.strongswan.org
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "Ar3etTnp"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
#IMC configuration file for strongSwan client
|
|
||||||
|
|
||||||
IMC "Test" /usr/local/lib/ipsec/imcvs/imc-test.so
|
|
||||||
IMC "Scanner" /usr/local/lib/ipsec/imcvs/imc-scanner.so
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# /etc/strongswan.conf - strongSwan configuration file
|
|
||||||
|
|
||||||
charon-systemd {
|
|
||||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
|
||||||
|
|
||||||
multiple_authentication=no
|
|
||||||
|
|
||||||
syslog {
|
|
||||||
daemon {
|
|
||||||
tnc = 3
|
|
||||||
imc = 3
|
|
||||||
}
|
|
||||||
}
|
|
||||||
plugins {
|
|
||||||
eap-tnc {
|
|
||||||
protocol = tnccs-1.1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
libimcv {
|
|
||||||
plugins {
|
|
||||||
imc-test {
|
|
||||||
command = isolate
|
|
||||||
}
|
|
||||||
imc-scanner {
|
|
||||||
push_info = no
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
connections {
|
|
||||||
|
|
||||||
home {
|
|
||||||
local_addrs = 192.168.0.200
|
|
||||||
remote_addrs = 192.168.0.1
|
|
||||||
|
|
||||||
local {
|
|
||||||
auth = eap
|
|
||||||
aaa_id = aaa.strongswan.org
|
|
||||||
id = [email protected]
|
|
||||||
}
|
|
||||||
remote {
|
|
||||||
auth = pubkey
|
|
||||||
id = moon.strongswan.org
|
|
||||||
}
|
|
||||||
children {
|
|
||||||
home {
|
|
||||||
remote_ts = 10.1.0.0/16
|
|
||||||
|
|
||||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
|
||||||
esp_proposals = aes128gcm16-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
version = 2
|
|
||||||
proposals = aes128-sha256-modp3072
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
secrets {
|
|
||||||
|
|
||||||
eap {
|
|
||||||
id = [email protected]
|
|
||||||
secret = "W7R0g3do"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user