|
| 1 | +# tnc |
| 2 | + |
| 3 | +Build and run both a TNC Client and a TNC Server collocated with a [strongSwan][STRONGSWAN] |
| 4 | +IKEv2 Daemon managed via the Versatile IKE Control Interface (VICI). |
| 5 | + |
| 6 | +[STRONGSWAN]: https://www.strongswan.org |
| 7 | + |
| 8 | +## Pull Docker Images |
| 9 | + |
| 10 | +``` |
| 11 | +$ docker pull strongx509/tnc-client |
| 12 | +$ docker pull strongX509/tnc-server |
| 13 | +``` |
| 14 | + |
| 15 | +## Build Docker Image |
| 16 | + |
| 17 | +Alternatively the docker image can be built from scratch in the `tnc` directory with |
| 18 | +```console |
| 19 | +$ docker build -f Dockerfile.client -t strongx509/tnc-client . |
| 20 | +$ docker build -f Dockerfile.server -t strongx509/tnc-server . |
| 21 | + |
| 22 | +``` |
| 23 | +The build rules are defined in [Dockerfile.client](Dockerfile.client) and |
| 24 | +[Dockerfile.server](Dockerfile.server), respectively. |
| 25 | + |
| 26 | +## Create Docker Containers and Local Networks |
| 27 | + |
| 28 | + |
| 29 | +``` |
| 30 | + +----------------+ +----------------+ |
| 31 | + 10.3.0.1 --- | VPN/TNC Client | === 192.168.0.0/24 === | VPN/TNC Server | --- 10.1.0.0/16 |
| 32 | + Virtual IP +----------------+ .3 Internet .2 +----------------+ .2 Intranet |
| 33 | +``` |
| 34 | +The two docker containers `tnc-server` and `tnc-client` as well as the local networks |
| 35 | +`strongswan_internet` and `strongswan_intranet` are created with the command |
| 36 | +```console |
| 37 | +$ docker-compose up |
| 38 | +Creating tnc-server ... done |
| 39 | +Creating tnc-client ... done |
| 40 | +Attaching to tnc-server, tnc-client |
| 41 | + |
| 42 | +``` |
| 43 | +with the setup defined in [docker-compose.yml](docker-compose.yml). |
| 44 | + |
| 45 | +In an additional console window we open a `bash` shell to start and manage the strongSwan `charon` daemon in the `tnc-server` container |
| 46 | +```console |
| 47 | +server$ docker exec -ti tnc-server /bin/bash |
| 48 | +server# ./charon & |
| 49 | +# ./charon & |
| 50 | +00[DMN] Starting IKE charon daemon (strongSwan 5.9.5, Linux 5.13.0-35-generic, x86_64) |
| 51 | +00[TNC] TNC recommendation policy is 'default' |
| 52 | +00[TNC] loading IMVs from '/etc/tnc_config' |
| 53 | +00[TNC] added IETF attributes |
| 54 | +00[TNC] added ITA-HSR attributes |
| 55 | +00[TNC] added PWG attributes |
| 56 | +00[TNC] added TCG attributes |
| 57 | +00[LIB] libimcv initialized |
| 58 | +00[IMV] IMV 1 "OS" initialized |
| 59 | +00[TNC] IMV 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001 |
| 60 | +00[TNC] IMV 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imv-os.so' |
| 61 | +00[IMV] IMV 2 "Scanner" initialized |
| 62 | +00[TNC] IMV 2 supports 1 message type: 'IETF/Firewall' 0x000000/0x00000005 |
| 63 | +00[TNC] IMV 2 "Scanner" loaded from '/usr/lib/ipsec/imcvs/imv-scanner.so' |
| 64 | +``` |
| 65 | +The `OS` and `Scanner` Integrity Measurement Verifiers (`IMVs`) are loaded since |
| 66 | +they have been enabled in `/etc/tnc_config`. |
| 67 | +```console |
| 68 | +00[LIB] loaded plugins: charon random nonce x509 constraints pubkey pkcs1 pkcs8 pkcs12 pem openssl drbg sqlite kernel-netlink resolve socket-default vici updown eap-identity eap-md5 eap-ttls eap-tnc tnc-imv tnc-tnccs tnccs-20 |
| 69 | +00[JOB] spawning 16 worker threads |
| 70 | + |
| 71 | +00[DMN] executing start script 'creds' (swanctl --load-creds) |
| 72 | +01[CFG] loaded certificate 'C=CH, O=Cyber, CN=server.strongswan.org' |
| 73 | +08[CFG] loaded certificate 'C=CH, O=Cyber, CN=Cyber Root CA' |
| 74 | +12[CFG] loaded ECDSA private key |
| 75 | +16[CFG] loaded EAP shared key with id 'eap-jane' for: 'jane' |
| 76 | +09[CFG] loaded EAP shared key with id 'eap-hacker' for: 'hacker' |
| 77 | +00[DMN] creds: loaded certificate from '/etc/swanctl/x509/serverCert.pem' |
| 78 | +00[DMN] creds: loaded certificate from '/etc/swanctl/x509ca/caCert.pem' |
| 79 | +00[DMN] creds: loaded ECDSA key from '/etc/swanctl/ecdsa/serverKey.pem' |
| 80 | +00[DMN] creds: loaded eap secret 'eap-jane' |
| 81 | +00[DMN] creds: loaded eap secret 'eap-hacker' |
| 82 | + |
| 83 | +00[DMN] executing start script 'conns' (swanctl --load-conns) |
| 84 | +07[CFG] added vici connection: tnc |
| 85 | +00[DMN] conns: loaded connection 'tnc' |
| 86 | +00[DMN] conns: successfully loaded 1 connections, 0 unloaded |
| 87 | + |
| 88 | +00[DMN] executing start script 'pools' (swanctl --load-pools) |
| 89 | +08[CFG] added vici pool rw_pool: 10.3.0.0, 254 entries |
| 90 | +00[DMN] pools: loaded pool 'rw_pool' |
| 91 | +00[DMN] pools: successfully loaded 1 pools, 0 unloaded |
| 92 | +``` |
| 93 | +And in a third console window we open a `bash`shell to start and manage the strongSwan `charon` daemon in the `tnc-client` container |
| 94 | +```console |
| 95 | +client$ docker exec -ti tnc-client /bin/bash |
| 96 | +client# ./charon & |
| 97 | +00[DMN] Starting IKE charon daemon (strongSwan 5.9.5, Linux 5.13.0-35-generic, x86_64) |
| 98 | +00[TNC] loading IMCs from '/etc/tnc_config' |
| 99 | +00[TNC] added IETF attributes |
| 100 | +00[TNC] added ITA-HSR attributes |
| 101 | +00[TNC] added PWG attributes |
| 102 | +00[TNC] added TCG attributes |
| 103 | +00[LIB] libimcv initialized |
| 104 | +00[IMC] IMC 1 "OS" initialized |
| 105 | +00[IMC] processing "/etc/os-release" file |
| 106 | +00[IMC] operating system type is 'Ubuntu' |
| 107 | +00[IMC] operating system name is 'Ubuntu' |
| 108 | +00[IMC] operating system version is '20.04 x86_64' |
| 109 | +00[TNC] IMC 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001 |
| 110 | +00[TNC] IMC 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imc-os.so' |
| 111 | +00[IMC] IMC 2 "Scanner" initialized |
| 112 | +00[TNC] IMC 2 supports 1 message type: 'IETF/Firewall' 0x000000/0x00000005 |
| 113 | +00[TNC] IMC 2 "Scanner" loaded from '/usr/lib/ipsec/imcvs/imc-scanner.so' |
| 114 | +``` |
| 115 | +The `OS` and `Scanner` Integrity Measurement Collectors (`IMCs`) are loaded since |
| 116 | +they have been enabled in `/etc/tnc_config`. |
| 117 | +```console |
| 118 | +00[LIB] loaded plugins: charon random nonce x509 constraints pubkey pkcs1 pkcs8 pkcs12 pem openssl drbg sqlite kernel-netlink resolve socket-default vici updown eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 |
| 119 | +00[JOB] spawning 16 worker threads |
| 120 | + |
| 121 | +00[DMN] executing start script 'creds' (swanctl --load-creds) |
| 122 | +01[CFG] loaded certificate 'C=CH, O=Cyber, CN=client.strongswan.org' |
| 123 | +09[CFG] loaded certificate 'C=CH, O=Cyber, CN=Cyber Root CA' |
| 124 | +11[CFG] loaded ECDSA private key |
| 125 | +01[CFG] loaded EAP shared key with id 'eap-hacker' for: 'hacker' |
| 126 | +00[DMN] creds: loaded certificate from '/etc/swanctl/x509/clientCert.pem' |
| 127 | +00[DMN] creds: loaded certificate from '/etc/swanctl/x509ca/caCert.pem' |
| 128 | +00[DMN] creds: loaded ECDSA key from '/etc/swanctl/ecdsa/clientKey.pem' |
| 129 | +00[DMN] creds: loaded eap secret 'eap-hacker' |
| 130 | + |
| 131 | +00[DMN] executing start script 'conns' (swanctl --load-conns) |
| 132 | +05[CFG] added vici connection: tnc |
| 133 | +00[DMN] conns: loaded connection 'tnc' |
| 134 | +00[DMN] conns: successfully loaded 1 connections, 0 unloaded |
| 135 | +no pools found, 0 unloaded |
| 136 | +``` |
| 137 | +The setup defines the EAP-TTLS-based configuration `tnc` . |
| 138 | +```console |
| 139 | +client# swanctl --list-conns |
| 140 | +``` |
| 141 | +```console |
| 142 | +tnc: IKEv2, no reauthentication, rekeying every 14400s |
| 143 | + local: %any |
| 144 | + remote: 192.168.0.2 |
| 145 | + local EAP_TTLS authentication: |
| 146 | + eap_id: client.strongswan.org |
| 147 | + remote EAP_TTLS authentication: |
| 148 | + id: server.strongswan.org |
| 149 | + tnc: TUNNEL, rekeying every 3600s |
| 150 | + local: dynamic |
| 151 | + remote: 10.1.0.0/16 192.168.0.2/32 |
| 152 | + |
| 153 | +``` |
| 154 | + |
| 155 | +Author: [Andreas Steffen][AS] [CC BY 4.0][CC] |
| 156 | + |
| 157 | + |
| 158 | +[CC]: http://creativecommons.org/licenses/by/4.0/ |
| 159 | + |
0 commit comments