From Fedora Project Wiki

No edit summary
Line 41: Line 41:


== How To Test ==
== How To Test ==
<!-- This does not need to be a full-fledged document.  Describe the dimensions of tests that this feature is expected to pass when it is done.  If it needs to be tested with different hardware or software configurations, indicate them.  The more specific you can be, the better the community testing can be.  
Configure wpa_supplicant at client and Freeradius at server.


Remember that you are writing this how to for interested testers to use to check out your feature - documenting what you do for testing is OK, but it's much better to document what *I* can do to test your feature.
Configure 802.lX managed switch.


A good "how to test" should answer these four questions:
Configure tnc.


0. What special hardware / data / etc. is needed (if any)?
Configure policies at IMC (provided or custom built) client and IMV (provided or custom built) at server. 
1. How do I prepare my system to test this feature? What packages
 
need to be installed, config files edited, etc.?
Start network access.
2. What specific actions do I perform to check that the feature is
 
working like it's supposed to?
Observe if network access is allowed or not.
3. What are the expected results of those actions?
 
-->
If not, remediate the system, and try again.


== User Experience ==
== User Experience ==

Revision as of 21:20, 28 January 2013

Trusted Network Connect (TNC)

Summary

This feature provides Trusted Network Connect(TNC) framework that can be used to assess and verify clients' posture (or integrity measurements or configuration) and its compliance to a predefined policy with existing network access control (NAC) solutions.

Owner

Name: Avesh Agarwal

Email: avagarwa@redhat.com

Current status

Targeted release: Fedora 19

Last updated: 1/24/2013

Percentage of completion: 50%

Detailed Description

Traditionally network access control (NAC) has lacked the ability in its decision making to asses endpoint's security posture and its compliance to enterprise policies. This lack of assessment may leave an enterprise's network vulnerable to malicious attacks. Trusted Computing Group (TCG) (and IETF too) has defined an open architecture called Trusted network connect (TNC) (IETF's Network Endpoint Assessment (NEA)) to fill this gap. TNC, as part of its architectural components, includes integrity measurement collectors (IMCs) and TNC client at endpoint and integrity measurement verifiers (IMVs) and TNC server at enterprise network side communicating over NAC solutions such as EAP with 802.1X to evaluate and verify the security posture of the endpoint against the enterprise policies before allowing network access. For this, TCG has released transport (IF-T), session (IF-TNCCS) and messaging (IF-M) standards which are open and interoperable. TNC architecture by virtue of it's IF-M protocol can leverage NIST's SCAP's (OpenSCAP) automated security aspects for measurement collection, verification and remediation. In addition, TCG has defined IF-PTS and PTS protocol specifications to integrate platform trust services (PTS) with TNC for TPM based attestation of integrity measurements. PTS protocol defines messaging payloads to be used over IF-M protocol.

This feature includes the aforementioned functionalities and aims to provide an end-to-end network based client assessment, verification and remediation.

Benefit to Fedora

System and network administrators using fedora can now utilize the potential of open and interoperable TNC protocols over existing NAC solutions. It helps them reduce the possibility of allowing a vulnerable client accessing their network.

Scope

This feature involves following packages as of now: tncfhh, openpts, wpa_supplicant, freeradius, tpm_tools, trousers

Goals

TNC client and server functionality: TCG's IF-TNCCS 1.1 and IETF RFC 5973

Integrity measurements collector (IMC) and verifier (IMV) messaging protocol functionality: IF-M 1.2 and IETF RFC 5972

Implementation of Local IMC and IMV interfaces: IF-IMC 1.2, IF-IMV 1.2

A development library for building custom IMCc and IMVs.

OpenSCAP based IMC and IMV that follow IF-IMC, IF-IMV and IF-M specifications.

PTS protocol (PTS-IMC and PTS-IMV) functionality and its integration (IF-PTS) with platform trust services for TPM based attestation of integrity measurements.

How To Test

Configure wpa_supplicant at client and Freeradius at server.

Configure 802.lX managed switch.

Configure tnc.

Configure policies at IMC (provided or custom built) client and IMV (provided or custom built) at server.

Start network access.

Observe if network access is allowed or not.

If not, remediate the system, and try again.

User Experience

Dependencies

Contingency Plan

Documentation

Release Notes

Comments and Discussion