/
README
142 lines (118 loc) · 5.78 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
=====================================================
_____ _ ____ _____ _ _ _ _
|_ _|_ __ _ _ ___| |_ / __ \| ___| | | | | | |
| | | '__| | | / __| __|/ / _` | |_ | |_| | |_| |
| | | | | |_| \__ \ |_| | (_| | _| | _ | _ |
|_| |_| \__,_|___/\__|\ \__,_|_| |_| |_|_| |_|
\____/
=====================================================
1. INTRODUCTION
The TNC@FHH project is an open source implementation of the Trusted Network
Connect (TNC) framework [1] which is specified by the Trusted Computing Group
(TCG) [2]. TNC@FHH allows you to provision access to a network based upon
factors like the user credentials and the requesting endpoint's integrity state.
The following TNC components and their respective interfaces are implemented by
TNC@FHH:
* IMCs (IF-IMC 1.2)
* IMVs (IF-IMV 1.2)
* TNCS (IF-TNCCS 1.1)
* NAA (IF-T EAP 1.1)
On the Policy Decision Point, TNC@FHH works as an extension to FreeRADIUS [3].
FreeRADIUS handles the user authentication and all of the standard EAP message
processing. TNC@FHH is plugged into FreeRADIUS via a new EAP module that
supports TNC.
2. INSTALLATION
To build and install all components of TNC@FHH, run the following commands:
* create a directoy that shall contain all files created within the build
process, e.g. './build'
* cd to the new directory
* call cmake -DCOMPONENT=pdp -DNAL=[8021x|vpn] and specify the path to the tncfhh directory, e.g. 'cmake -D... ../'
* call make
* call make install
* call ldconfig
In short:
$ mkdir build && cd build && cmake -DCOMPONENT=pdp -DNAL=[8021x|vpn] ../ && make && make install
In order to apply the FreeRADUS patches, do the following:
* switch to the patch directory, e.g. for eap-tnc
$ cd freeradius-eaptnc-patch
* copy the src directory to the directory containing the FreeRADIUS source
files, e.g.:
$ cp -r src/ ../freeradius-[version>=2.0.0]/
* Configure and build FreeRADIUS
see http://wiki.freeradius.org/Build
The configuration process of the PDP is quite involved. Detailed information
about it can be found in the Trust@FHH Wiki [4].
3. STRUCTURE
TNC@FHH consists of several subprojects:
* freeradius-eaptnc-patch
Patch for FreeRADIUS to add support for TNC. This is basically a new EAP
module that handles the TNC traffic and forwards the TNC specific data to the
naaeap module. The patch is implemented in C.
* freeradius-eapttls-patch
Patch for FreeRADIUS to add support for multiple EAP-methods to be tunneld
within one EAP-TTLS channel. This explicitly supports to chain multiple EAP
methods, i.e. EAP-MD5 (for user authentication) and then EAP-TNC (for
endpoint assessment) in one EAP-TTLS tunnel. The patch is implemented in C.
* naaeap
A shared library that is used by the EAP TNC module. It parses the TNC data,
handles fragmentation and forwards the parsed data to the tncs module.
Outgoing tncs messages are in turn properly encapsulated within EAP TNC.
naaeap is implemented in C++.
* tncs
tncs is a shared library that is used by the naaeap module. It represents the
TNC TNCS component and is therefore primarily responsible for handling the
IMVs that are installed on the PDP. tncs is implemented in C++.
* imunit
imunit is a framework for developing imc/v pairs. All TNC@FHH imc/v pairs are
* tncutil
A shared library that offers simple configuration file parsing.
* tncxacml
A shared library that enables support for the evaluation of measurements via
a XACML PDP. It uses xercesc and boost for creating and parsing the XML data
and sending/receiving the requests/responses to/from the XACML PDP.
based upon imunit. imunit is implemented in C++.
* imc/v pairs
TNC@FHH comes with a set of working imc/v pairs:
- example
A hello world example of an imc/v pair.
- dummy
Another hello world example with a bit more functionality.
- clamav
Checks the status of the AV software clamav.
- platid
Allows to authenticate an endpoint based upon X.509 certificates (supports
TPMs)
- hostscanner
Allows to check the status of arbitrary ports on an endpoint.
* tncsim
This is a simple test program that acts both as TNCC and TNCS, but without an
NAR or NAA component. It was developed to ease the testing of IMC/V pairs.
It uses libtnc as client and TNC@FHH tncs as server. tncsim can load
both IMCs and IMVs and starts a single TNC handshake by calling
beginHandhake() for each IMC.
In order to set up a working test environment, you will need FreeRADIUS on the
PDP, a supplicant that supports TNC on the AR (like wpa_supplicant), and a
switch that supports 802.1X.
To run a quick test with the shipped IMC/V pairs, use tncsim. The default
configuration uses the exampleimc/v.
4. ADDITIONAL INFORMATION
The 'doc' directoy contains more detailed information about TNC@FHH, including
class and sequence diagrams. For general information about TNC, please refer to
the official TCG website or to the Trust@FHH research group's website [5].
5. FEEDBACK
We really appreciate any feedback about TNC@FHH. If you find bugs, feel free to
report them via email to trust@f4-i.fh-hannover.de
6. ACKNOWLEDGEMENT
TNC@FHH is implemented by the Trust@FHH research group of the Fachhochschule
Hannvover, the University of Applied Sciences and Arts, located in Lower Saxony,
Germany [6]. Parts of this work have been carried out within the tNAC research
project (support code 1704B08) which is funded by the german BMBF (Federal
Ministry of Education and Research) [7].
7. REFERENCES
[1] http://www.trustedcomputinggroup.org/developers/trusted_network_connect
[2] http://www.trustedcomputinggroup.org
[3] http://freeradius.org/
[4] https://trust.inform.fh-hannover.de/trust_redmine/projects/tncfhh/wiki
[5] https://trust.inform.fh-hannover.de/
[6] http://www.fh-hannover.de/
[7] http://www.bmbf.de/en/index.php