testing: Removed TCG SWID IMC/IMV scenarios
This commit is contained in:
@@ -6,7 +6,9 @@ authenticated by an X.509 AAA certificate. The strong EAP-TTLS tunnel protects t
|
||||
client authentication based on <b>EAP-MD5</b>. In a next step the EAP-TNC protocol is used within
|
||||
the EAP-TTLS tunnel to determine the health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 2.0</b>
|
||||
client-server interface defined by <b>RFC 5793 PB-TNC</b>. The communication between IMCs and IMVs
|
||||
is based on the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>.
|
||||
is based on the <b>IF-M</b> protocol defined by <b>RFC 5792 PA-TNC</b>. The <b>SWIMA</b> IMC on <b>carol</b>
|
||||
is requested to deliver a concise <b>Software ID Inventory</b> whereas <b>dave</b> must send a full
|
||||
<b>Software Inventory</b>.
|
||||
<p>
|
||||
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the clients
|
||||
are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
dave:: cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
||||
dave:: cat /var/log/daemon.log::PDP server.*aaa.strongswan.org.*is listening on port 271::YES
|
||||
dave:: cat /var/log/daemon.log::collected ... SWID tags::YES
|
||||
dave:: cat /var/log/daemon.log::collected ... SW records::YES
|
||||
dave:: cat /var/log/daemon.log::PB-TNC access recommendation is .*Quarantined::YES
|
||||
dave:: cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
carol::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA.* successful::YES
|
||||
carol::cat /var/log/daemon.log::PDP server.*aaa.strongswan.org.*is listening on port 271::YES
|
||||
carol::cat /var/log/daemon.log::collected ... SWID tag IDs::YES
|
||||
carol::cat /var/log/daemon.log::collected 1 SWID tag::YES
|
||||
carol::cat /var/log/daemon.log::collected ... SW ID records::YES
|
||||
carol::cat /var/log/daemon.log::strongswan.org__strongSwan.*swidtag::YES
|
||||
carol::cat /var/log/daemon.log::collected 1 SW record::YES
|
||||
carol::cat /var/log/daemon.log::PB-TNC access recommendation is .*Access Allowed::YES
|
||||
carol::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established::YES
|
||||
alice::cat /var/log/daemon.log::user AR identity.*dave.*authenticated by password::YES
|
||||
alice::cat /var/log/daemon.log::IMV 2 handled SWIDT workitem 3: allow - received inventory of 0 SWID tag IDs and ... SWID tags::YES
|
||||
alice::cat /var/log/daemon.log::received software inventory with.*items for request 3 at last eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::user AR identity.*carol.*authenticated by password::YES
|
||||
alice::cat /var/log/daemon.log::IMV 2 handled SWIDT workitem 9: allow - received inventory of ... SWID tag IDs and 1 SWID tag::YES
|
||||
alice::cat /var/log/daemon.log::failed to collect SW ID events, fallback to SW ID inventory::YES
|
||||
alice::cat /var/log/daemon.log::received software ID inventory with.*items for request 9 at last eid 1 of epoch::YES
|
||||
alice::cat /var/log/daemon.log::1 SWID tag target::YES
|
||||
alice::cat /var/log/daemon.log::received software inventory with 1 item for request 9 at last eid 1 of epoch::YES
|
||||
moon:: cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
|
||||
moon:: cat /var/log/daemon.log::RADIUS authentication of 'dave' successful::YES
|
||||
moon:: cat /var/log/daemon.log::authentication of '192.168.0.200' with EAP successful::YES
|
||||
|
||||
@@ -34,8 +34,11 @@ libimcv {
|
||||
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
|
||||
|
||||
plugins {
|
||||
imv-swid {
|
||||
rest_api_uri = http://admin-user:[email protected]/api/
|
||||
imv-swima {
|
||||
rest_api
|
||||
{
|
||||
uri = http://admin-user:[email protected]/api/
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#IMV configuration file for strongSwan client
|
||||
#IMV configuration file for strongSwan client
|
||||
|
||||
IMV "OS" /usr/local/lib/ipsec/imcvs/imv-os.so
|
||||
IMV "SWID" /usr/local/lib/ipsec/imcvs/imv-swid.so
|
||||
IMV "SWIMA" /usr/local/lib/ipsec/imcvs/imv-swima.so
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
|
||||
IMC "SWID" /usr/local/lib/ipsec/imcvs/imc-swid.so
|
||||
IMC "SWIMA" /usr/local/lib/ipsec/imcvs/imc-swima.so
|
||||
|
||||
@@ -32,7 +32,7 @@ libimcv {
|
||||
imc-os {
|
||||
push_info = no
|
||||
}
|
||||
imc-swid {
|
||||
imc-swima {
|
||||
swid_directory = /usr/share
|
||||
swid_pretty = no
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#IMC configuration file for strongSwan client
|
||||
#IMC configuration file for strongSwan client
|
||||
|
||||
IMC "OS" /usr/local/lib/ipsec/imcvs/imc-os.so
|
||||
IMC "SWID" /usr/local/lib/ipsec/imcvs/imc-swid.so
|
||||
IMC "SWIMA" /usr/local/lib/ipsec/imcvs/imc-swima.so
|
||||
|
||||
Reference in New Issue
Block a user