# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
+ syslog {
+ daemon {
+ default = 1
+ }
+ auth {
+ default = 0
+ }
}
plugins {
eap-radius {
- secret = gv6URkSs
- server = 10.1.0.10
+ secret = gv6URkSs
+ server = 10.1.0.10
filter_id = yes
}
}
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
alice::killall radiusd
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
moon::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw
carol::expect-connection home
carol::swanctl --initiate --child home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
retransmit_tries = 5
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-radius updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
+ syslog {
+ daemon {
+ default = 1
+ }
+ auth {
+ default = 0
+ }
}
plugins {
eap-radius {
- secret = gv6URkSs
- server = 10.1.0.10
+ secret = gv6URkSs
+ server = 10.1.0.10
filter_id = yes
}
}
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
alice::killall radiusd
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
carol::echo 1 > /proc/sys/net/ipv4/ip_forward
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
- syslog {
+ syslog {
auth {
default = 0
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
+ syslog {
+ daemon {
+ default = 1
+ }
+ auth {
+ default = 0
+ }
}
plugins {
eap-radius {
- secret = gv6URkSs
- server = 10.1.0.10
+ secret = gv6URkSs
+ server = 10.1.0.10
filter_id = yes
}
}
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
alice::killall radiusd
alice::rm /etc/freeradius/sites-enabled/inner-tunnel-second
moon::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-11 tnc-imv updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imc = 2
+ imc = 2
}
}
}
libimcv {
plugins {
imc-test {
- command = isolate
+ command = isolate
retry = yes
retry_command = allow
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imc = 2
+ imc = 2
}
}
plugins {
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
libimcv {
plugins {
imv-test {
- rounds = 0
+ rounds = 0
}
imv-scanner {
closed_port_policy = yes
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=Linux strongSwan, OU=Accounting, CN=dave@strongswan.org.*authenticated by certificate::YES
alice::cat /var/log/daemon.log::received software inventory with ... items for request 3 at last eid 1 of epoch::YES
alice::cat /var/log/daemon.log::role=.softwareCreator licensor tagCreator::YES
-alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
+alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
alice::cat /var/log/daemon.log::received software ID events with ... items for request 9 at last eid 2 of epoch::YES
alice::cat /var/log/daemon.log::3 SWID tag target::YES
alice::cat /var/log/daemon.log::received software inventory with 3 items for request 9 at last eid 2 of epoch::YES
-alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
+alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce pem pkcs1 x509 openssl revocation constraints curl vici socket-default kernel-netlink tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
syslog {
}
imv_policy_manager {
- command_allow = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is allowed\""'
- command_block = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is blocked\""'
+ command_allow = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is allowed\""'
+ command_block = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is blocked\""'
}
carol::ip route del 10.1.0.0/16 via 192.168.0.1
dave::ip route del 10.1.0.0/16 via 192.168.0.1
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
-alice::service charon stop
-alice::service apache2 stop
+alice::systemctl stop strongswan-swanctl
+alice::systemctl stop apache2
alice::rm /etc/swanctl/rsa/aaaKey.pem
alice::rm /etc/swanctl/x509/aaaCert.pem
alice::iptables-restore < /etc/iptables.flush
alice::/usr/local/bin/init_tnc
alice::rm /etc/swanctl/x509/aliceCert.pem
alice::rm /etc/swanctl/rsa/aliceKey.pem
-alice::service charon start
-alice::service apache2 start
+alice::systemctl start apache2
+alice::systemctl start strongswan-swanctl
alice::swanctl --load-creds
winnetou::ip route add 10.1.0.0/16 via 192.168.0.1
dave::ip route add 10.1.0.0/16 via 192.168.0.1
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
tnccs-20 {
tests {
- pb_tnc_noskip = yes
+ pb_tnc_noskip = yes
}
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
carol::cat /etc/tnc_config
carol::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imc = 2
+ imc = 2
}
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
+
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imc = 2
+ imc = 2
}
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici socket-default kernel-netlink eap-identity eap-ttls eap-tnc tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imv = 3
}
}
libimcv {
debug_level = 3
- policy_script = /usr/local/libexec/ipsec/imv_policy_manager
+ policy_script = /usr/local/libexec/ipsec/imv_policy_manager
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 3
}
}
plugins {
imc-hcd {
- push_info = no
+ push_info = no
subtypes {
system {
attributes_natural_language = en
}
fw-2 {
name = Firmware UVW for ARMv6 32 bit strongPrint OS 1.0
- patches = "security patch CVE-2014-1288 2014-01-01\r\nsecurity patch CVE-2014-1492 2014-02-01\r\nsecurity patch CVE-2014-1622 2014-05-01\r\nsecurity patch CVE-2014-2775 2014-07-01\r\n\security patch CVE-2014-4453 2014-08-01\r\nsecurity patch CVE-2014-6108 2014-11-01\r\nsecurity patch CVE-2015-0555 2015-01-01\r\nsecurity patch CVE-2015-4319 2015-07-01\r\n"
+ patches = "security patch CVE-2014-1288 2014-01-01\r\nsecurity patch CVE-2014-1492 2014-02-01\r\nsecurity patch CVE-2014-1622 2014-05-01\r\nsecurity patch CVE-2014-2775 2014-07-01\r\n\security patch CVE-2014-4453 2014-08-01\r\nsecurity patch CVE-2014-6108 2014-11-01\r\nsecurity patch CVE-2015-0555 2015-01-01\r\nsecurity patch CVE-2015-4319 2015-07-01\r\n"
string_version = 13.8.5
version = 0000000D000000080000000500000000
}
resident_application {
resident-app-1 {
- name = Resident App XYZ
+ name = Resident App XYZ
patches = "xmas patch 2014-12-24\r\nservice patch for App XYZ 2015-05-22\r\n"
string_version = 2.5
version = 00000002000000050000000000000000
version = 00000007000000080000000000000000
}
}
-
+
resident_application {
resident-app-if {
name = Resident Interface App
scanner {
attributes_natural_language = en
-
+
firmware {
fw-scanner {
- name = Scanner Firmware
+ name = Scanner Firmware
patches = "security patch 2013-08-11\r\nsecurity patch 2015-5-30\r\n"
string_version = 2.5.3
version = 00000002000000050000000300000000
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 3
}
}
vendor_smi_code = 36906
pstn_fax_enabled = yes
time_source = 0.ch.pool.ntp.org
- user_application_enabled = no
+ user_application_enabled = no
user_application_persistence_enabled = no
firmware {
fw-1 {
- name = Firmware ABC
+ name = Firmware ABC
patches = "security patch 2014-05-08\r\nupgrade 2014-08-16\r\nsecurity patch 2015-3-22\r\n"
string_version = 1.0.7
version = 00000001000000000000000700000000
}
fw-2 {
- name = Firmware UVW
+ name = Firmware UVW
string_version = 13.8.5
version = 0000000D000000080000000500000000
}
resident_application {
resident-app-1 {
- name = Resident App XYZ
+ name = Resident App XYZ
patches = "xmas patch 2014-12-24\r\nservice patch 2015-05-22\r\n"
string_version = 2.5
version = 00000002000000050000000000000000
interface {
attributes_natural_language = en
-
+
firmware {
fw-if {
name = Interface Firmware
scanner {
attributes_natural_language = en
-
+
firmware {
fw-scanner {
- name = Scanner Firmware
+ name = Scanner Firmware
patches = "security patch 2013-08-11\r\nsecurity patch 2015-5-30\r\n"
string_version = 2.5.3
version = 00000002000000050000000300000000
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-radius updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
+ syslog {
+ daemon {
+ default = 1
+ }
+ auth {
+ default = 0
+ }
}
plugins {
eap-radius {
secret = gv6URkSs
- #server = PH_IP6_ALICE
+ #server = PH_IP6_ALICE
server = PH_IP_ALICE
filter_id = yes
}
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
-alice::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
+alice::systemctl stop strongswan-swanctl
alice::rm /etc/swanctl/rsa/aaaKey.pem
alice::rm /etc/swanctl/x509/aaaCert.pem
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
dave::echo aabbccddeeff11223344556677889900 > /var/lib/dbus/machine-id
alice::rm /etc/swanctl/rsa/aliceKey.pem
alice::rm /etc/swanctl/x509/aliceCert.pem
-alice::service charon start
-moon::service charon start
-carol::service charon start
-dave::service charon start
+alice::systemctl start strongswan-swanctl
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
imv = 2
}
libimcv {
plugins {
imc-test {
- command = allow
+ command = allow
}
imv-test {
rounds = 1
- }
+ }
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no
-
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
+
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
imv = 2
}
libimcv {
plugins {
imc-test {
- command = none
+ command = none
}
imv-test {
- rounds = 1
- }
+ rounds = 1
+ }
}
}
-moon::service charon stop
-sun::service charon stop
+moon::systemctl stop strongswan-swanctl
+sun::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
moon::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
-moon::service charon start
-sun::service charon start
+moon::systemctl start strongswan-swanctl
+sun::systemctl start strongswan-swanctl
sun::expect-connection mutual
moon::expect-connection mutual
moon::swanctl --initiate --child mutual
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
imv = 2
}
}
imv-test {
rounds = 1
- }
+ }
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-tnc tnc-tnccs tnc-imc tnc-imv tnccs-20 updown
multiple_authentication = no
-
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
+
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
imv = 2
}
libimcv {
plugins {
imc-test {
- command = allow
+ command = allow
}
imv-test {
- rounds = 1
- }
+ rounds = 1
+ }
}
}
-moon::service charon stop
-sun::service charon stop
+moon::systemctl stop strongswan-swanctl
+sun::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
moon::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
-moon::service charon start
-sun::service charon start
+moon::systemctl start strongswan-swanctl
+sun::systemctl start strongswan-swanctl
sun::expect-connection mutual
moon::expect-connection mutual
moon::swanctl --initiate --child mutual
# /etc/strongswan.conf - strongSwan configuration file
-charon {
- load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default tnc-pdp tnc-tnccs tnc-imc tnc-imv tnccs-20
+charon-systemd {
+ load = random nonce x509 openssl pem pkcs1 revocation curl vici kernel-netlink socket-default tnc-pdp tnc-tnccs tnc-imc tnc-imv tnccs-20
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
imv = 2
}
libimcv {
plugins {
imc-test {
- command = allow
+ command = allow
}
imv-test {
- rounds = 1
- }
+ rounds = 1
+ }
}
}
-sun::service charon stop
+sun::systemctl stop strongswan-swanctl
-sun::service charon start
+sun::systemctl start strongswan-swanctl
moon::cat /etc/pts/options
moon::sleep 1
moon::/usr/local/bin/pt-tls-client --optionsfrom /etc/pts/options
alice::cat /var/log/daemon.log::skipping SASL, client already authenticated by TLS certificate::YES
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=Linux strongSwan, OU=Accounting, CN=dave@strongswan.org.*authenticated by certificate::YES
alice::cat /var/log/daemon.log::received software inventory with ... items for request 3 at last eid 1 of epoch::YES
-alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
+alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
alice::cat /var/log/daemon.log::1 SWID tag target::YES
alice::cat /var/log/daemon.log::received software inventory with 1 item for request 9 at last eid 1 of epoch::YES
alice::cat /var/log/daemon.log::strongswan.org__strongSwan.*@ /usr/local/share/strongswan::YES
-alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
+alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce pem pkcs1 x509 openssl revocation constraints curl vici socket-default kernel-netlink tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
syslog {
}
imv_policy_manager {
- command_allow = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is allowed\""'
- command_block = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is blocked\""'
+ command_allow = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is allowed\""'
+ command_block = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is blocked\""'
}
carol::ip route del 10.1.0.0/16 via 192.168.0.1
dave::ip route del 10.1.0.0/16 via 192.168.0.1
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
-alice::service charon stop
-alice::service apache2 stop
+alice::systemctl stop strongswan-swanctl
+alice::systemctl stop apache2
alice::rm /etc/swanctl/rsa/aaaKey.pem
alice::rm /etc/swanctl/x509/aaaCert.pem
alice::iptables-restore < /etc/iptables.flush
alice::/usr/local/bin/init_tnc
alice::rm /etc/swanctl/x509/aliceCert.pem
alice::rm /etc/swanctl/rsa/aliceKey.pem
-alice::service charon start
-alice::service apache2 start
+alice::systemctl start apache2
+alice::systemctl start strongswan-swanctl
alice::swanctl --load-creds
winnetou::ip route add 10.1.0.0/16 via 192.168.0.1
dave::ip route add 10.1.0.0/16 via 192.168.0.1
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 3
pts = 3
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
retransmit_tries = 5
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 3
pts = 3
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
- syslog {
+ syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imv = 3
pts = 3
}
libimcv {
database = sqlite:///etc/db.d/config.db
- policy_script = /usr/local/libexec/ipsec/imv_policy_manager
+ policy_script = /usr/local/libexec/ipsec/imv_policy_manager
plugins {
imv-attestation {
hash_algorithm = sha256
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
dave::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici socket-default kernel-netlink eap-identity eap-ttls eap-md5 eap-tnc tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imv = 3
}
}
}
libimcv {
- debug_level = 3
+ debug_level = 3
database = sqlite:///etc/db.d/config.db
policy_script = /usr/local/libexec/ipsec/imv_policy_manager
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 3
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 3
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-radius updown
multiple_authentication=no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
+ syslog {
+ daemon {
+ default = 1
+ }
+ auth {
+ default = 0
+ }
}
plugins {
eap-radius {
secret = gv6URkSs
- #server = PH_IP6_ALICE
+ #server = PH_IP6_ALICE
server = PH_IP_ALICE
filter_id = yes
}
-moon::service charon stop
-carol::service charon stop
-dave::service charon stop
-alice::service charon stop
-alice::service apache2 stop
+moon::systemctl stop strongswan-swanctl
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+alice::systemctl stop strongswan-swanctl
+alice::systemctl stop apache2
alice::rm /etc/swanctl/x509/aaaCert.pem
alice::rm /etc/swanctl/rsa/aaaKey.pem
moon::iptables-restore < /etc/iptables.flush
alice::cd /usr/local/share/strongswan/templates/database/imv; cat tables.sql data.sql /etc/pts/data1.sql | sqlite3 /etc/db.d/config.db
alice::chgrp -R www-data /etc/db.d/config.db; chmod -R g+w /etc/db.d/config.db
alice::/usr/local/bin/init_tnc
-alice::service apache2 start
-alice::service charon start
-moon::service charon start
-dave::service charon start
-carol::service charon start
+alice::systemctl start apache2
+alice::systemctl start strongswan-swanctl
+moon::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
dave::expect-connection home
alice::cat /var/log/daemon.log::skipping SASL, client already authenticated by TLS certificate::YES
alice::cat /var/log/daemon.log::user AR identity.*C=CH, O=Linux strongSwan, OU=Accounting, CN=dave@strongswan.org.*authenticated by certificate::YES
alice::cat /var/log/daemon.log::received SWID tag inventory with ... items for request 3 at eid 1 of epoch::YES
-alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
+alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.200 is blocked::YES
moon:: cat /var/log/auth.log::host with IP address 192.168.0.200 is blocked::YES
alice::cat /var/log/daemon.log::accepting PT-TLS stream from PH_IP_CAROL::YES
alice::cat /var/log/daemon.log::SASL PLAIN authentication successful::YES
alice::cat /var/log/daemon.log::1 SWID tag target::YES
alice::cat /var/log/daemon.log::received SWID tag inventory with 1 item for request 9 at eid 1 of epoch::YES
alice::cat /var/log/daemon.log::strongswan.org__strongSwan-::YES
-alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
+alice::cat /var/log/daemon.log::successful system command: ssh root@moon.*logger -t charon-systemd -p auth.alert.*host with IP address 192.168.0.100 is allowed::YES
moon::cat /var/log/auth.log::host with IP address 192.168.0.100 is allowed::YES
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce pem pkcs1 x509 openssl revocation constraints curl vici socket-default kernel-netlink tnc-pdp tnc-imv tnc-tnccs tnccs-20 sqlite
syslog {
}
imv_policy_manager {
- command_allow = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is allowed\""'
- command_block = ssh root@moon 'logger -t charon -p auth.alert "\"host with IP address %s is blocked\""'
+ command_allow = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is allowed\""'
+ command_block = ssh root@moon 'logger -t charon-systemd -p auth.alert "\"host with IP address %s is blocked\""'
}
carol::ip route del 10.1.0.0/16 via 192.168.0.1
dave::ip route del 10.1.0.0/16 via 192.168.0.1
winnetou::ip route del 10.1.0.0/16 via 192.168.0.1
-alice::service charon stop
-alice::service apache2 stop
+alice::systemctl stop strongswan-swanctl
+alice::systemctl stop apache2
alice::rm /etc/swanctl/rsa/aaaKey.pem
alice::rm /etc/swanctl/x509/aaaCert.pem
alice::iptables-restore < /etc/iptables.flush
alice::/usr/local/bin/init_tnc
alice::rm /etc/swanctl/x509/aliceCert.pem
alice::rm /etc/swanctl/rsa/aliceKey.pem
-alice::service charon start
-alice::service apache2 start
+alice::systemctl start apache2
+alice::systemctl start strongswan-swanctl
alice::swanctl --load-creds
winnetou::ip route add 10.1.0.0/16 via 192.168.0.1
dave::ip route add 10.1.0.0/16 via 192.168.0.1
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
libimcv {
database = sqlite:///etc/db.d/config.db
- policy_script = /usr/local/libexec/ipsec/imv_policy_manager
+ policy_script = /usr/local/libexec/ipsec/imv_policy_manager
plugins {
imv-attestation {
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-dave::service charon start
-carol::service charon start
+moon::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
dave::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 3
+ tnc = 3
imc = 3
- pts = 3
+ pts = 3
}
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce openssl pem pkcs1 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown sqlite
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
libimcv {
database = sqlite:///etc/db.d/config.db
- policy_script = /usr/local/libexec/ipsec/imv_policy_manager
+ policy_script = /usr/local/libexec/ipsec/imv_policy_manager
plugins {
imv-attestation {
hash_algorithm = sha1
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-dave::service charon start
-carol::service charon start
+moon::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
dave::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imc = 2
+ imc = 2
}
}
}
libimcv {
plugins {
imc-test {
- command = retry
+ command = retry
retry_command = allow
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imc = 2
+ imc = 2
}
}
plugins {
libimcv {
plugins {
imc-test {
- command = retry
+ command = retry
retry_command = isolate
}
imc-scanner {
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
tnc = 3
- imv = 2
+ imv = 2
}
}
plugins {
libimcv {
plugins {
imv-test {
- rounds = 0
+ rounds = 0
}
imv-scanner {
closed_port_policy = yes
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imc = 2
}
}
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnccs-20 tnc-imv updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
}
daemon {
- tnc = 2
+ tnc = 2
imv = 2
}
}
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
moon::cat /etc/tnc_config
carol::cat /etc/tnc_config
dave::cat /etc/tnc_config
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-tnccs tnc-imc tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-imv tnc-tnccs tnccs-20 updown
multiple_authentication = no
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
multiple_authentication=no
integrity_test = yes
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-20 updown
multiple_authentication=no
integrity_test = yes
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
# /etc/strongswan.conf - strongSwan configuration file
-charon {
+charon-systemd {
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-ttls eap-md5 eap-tnc tnc-tnccs tnccs-dynamic tnccs-11 tnccs-20 tnc-imv updown
multiple_authentication=no
integrity_test = yes
- start-scripts {
- creds = /usr/local/sbin/swanctl --load-creds
- conns = /usr/local/sbin/swanctl --load-conns
- }
syslog {
auth {
default = 0
-carol::service charon stop
-dave::service charon stop
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
dave::rm /etc/swanctl/rsa/*
carol::rm /etc/swanctl/x509/*
dave::rm /etc/swanctl/x509/*
-moon::service charon start
-carol::service charon start
-dave::service charon start
+moon::systemctl start strongswan-swanctl
+carol::systemctl start strongswan-swanctl
+dave::systemctl start strongswan-swanctl
moon::expect-connection rw-allow
moon::expect-connection rw-isolate
carol::expect-connection home
projects / thirdparty / strongswan.git / commitdiff
