Adding dot1x support
This commit is contained in:
Audiobuzz
Executable
+79
@@ -0,0 +1,79 @@
|
||||
#!/usr/bin/env bash
|
||||
# tpm-provision.sh <host-id>
|
||||
#
|
||||
# One-shot enrolment for ONE workstation. Models the real flow (invariant #1:
|
||||
# per-host identity is created at enrolment, never baked into the image):
|
||||
# 1. generate a signing key INSIDE the TPM, persist it at handle 0x81010001
|
||||
# 2. build a CSR using that TPM key (private key never leaves the TPM)
|
||||
# 3. have step-ca sign it (token-gated 'enrol' provisioner)
|
||||
# 4. write the issued cert (DER) to TPM NV index 0x01800001
|
||||
# At boot the dracut hook reads the cert from NV and wpa_supplicant signs EAP-TLS
|
||||
# with the persistent-handle key. hostnqn is later derived from the cert serial.
|
||||
#
|
||||
# Run on the workstation (booted into a provisioning env with tpm2-tools, an
|
||||
# openssl TPM2 provider, and the `step` CLI) on a network that can reach step-ca.
|
||||
# Works for swtpm (VMs) and a real TPM (820) — same /dev/tpmrm0 in-guest.
|
||||
#
|
||||
# Needs in this dir: root_ca.crt + ca-pw (copied from the serving host's
|
||||
# serving/dot1x-bench/pki/{root_ca.crt,stepca/secrets/password}).
|
||||
#
|
||||
# *** BENCH-VERIFY (CLAUDE.md "Known bench-verify items"): the TPM key reference
|
||||
# *** for openssl AND wpa_supplicant differs by distro build — OpenSSL TPM2
|
||||
# *** PROVIDER (handle:0x...) vs tpm2-pkcs11 URI. This script uses the provider
|
||||
# *** form; switch to the engine/pkcs11 form if your build needs it, and keep it
|
||||
# *** consistent with files/etc/dot1x/wpa_supplicant-dot1x.conf.
|
||||
set -euo pipefail
|
||||
|
||||
HOSTID=${1:?usage: tpm-provision.sh <host-id> e.g. ws-vm-a}
|
||||
HANDLE=${HANDLE:-0x81010001}
|
||||
NVINDEX=${NVINDEX:-0x01800001}
|
||||
export TPM2TOOLS_TCTI="${TPM2TOOLS_TCTI:-device:/dev/tpmrm0}"
|
||||
CA_DNS=${CA_DNS:-ca.fleet.lab}; CA_PORT=${CA_PORT:-8443}
|
||||
CA_URL="https://${CA_DNS}:${CA_PORT}"
|
||||
|
||||
cd "$(dirname "$0")"
|
||||
OUT=out; mkdir -p "$OUT"
|
||||
[ -f root_ca.crt ] || { echo "missing root_ca.crt (copy from serving pki/)" >&2; exit 1; }
|
||||
[ -f ca-pw ] || { echo "missing ca-pw (copy pki/stepca/secrets/password)" >&2; exit 1; }
|
||||
|
||||
# --- 1. persistent TPM signing key ------------------------------------------
|
||||
if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
|
||||
echo "==> creating TPM signing key, persisting at $HANDLE"
|
||||
tpm2_createprimary -C o -G ecc -g sha256 -c "$OUT/primary.ctx" >/dev/null
|
||||
tpm2_create -C "$OUT/primary.ctx" -G ecc256:ecdsa-sha256 \
|
||||
-u "$OUT/key.pub" -r "$OUT/key.priv" >/dev/null
|
||||
tpm2_load -C "$OUT/primary.ctx" -u "$OUT/key.pub" -r "$OUT/key.priv" \
|
||||
-c "$OUT/key.ctx" >/dev/null
|
||||
tpm2_evictcontrol -C o -c "$OUT/key.ctx" "$HANDLE" >/dev/null
|
||||
else
|
||||
echo "==> reusing existing persistent key at $HANDLE"
|
||||
fi
|
||||
|
||||
# --- 2. CSR signed by the TPM key (key stays in the TPM) ---------------------
|
||||
echo "==> building CSR (CN=$HOSTID) with the TPM key via the openssl tpm2 provider"
|
||||
openssl req -new -provider tpm2 -provider default \
|
||||
-key "handle:$HANDLE" \
|
||||
-subj "/O=fleet/CN=$HOSTID" \
|
||||
-out "$OUT/$HOSTID.csr"
|
||||
|
||||
# --- 3. step-ca signs the CSR -----------------------------------------------
|
||||
echo "==> requesting cert from step-ca"
|
||||
TOKEN=$(step ca token "$HOSTID" --provisioner enrol \
|
||||
--ca-url "$CA_URL" --root root_ca.crt \
|
||||
--provisioner-password-file ca-pw --not-after 720h)
|
||||
step ca sign "$OUT/$HOSTID.csr" "$OUT/$HOSTID.pem" \
|
||||
--token "$TOKEN" --ca-url "$CA_URL" --root root_ca.crt
|
||||
openssl x509 -in "$OUT/$HOSTID.pem" -outform DER -out "$OUT/$HOSTID.der"
|
||||
|
||||
# --- 4. write cert into TPM NV ----------------------------------------------
|
||||
SZ=$(stat -c%s "$OUT/$HOSTID.der")
|
||||
echo "==> writing $SZ-byte cert to NV $NVINDEX"
|
||||
tpm2_nvundefine "$NVINDEX" -C o 2>/dev/null || true
|
||||
tpm2_nvdefine "$NVINDEX" -C o -s "$SZ" -a 'ownerread|ownerwrite|authread|authwrite' >/dev/null
|
||||
tpm2_nvwrite "$NVINDEX" -C o -i "$OUT/$HOSTID.der"
|
||||
|
||||
SERIAL=$(openssl x509 -in "$OUT/$HOSTID.pem" -serial -noout | cut -d= -f2 | tr 'A-F' 'a-f')
|
||||
echo "==> enrolled $HOSTID"
|
||||
echo " cert serial : $SERIAL"
|
||||
echo " boot hostnqn: nqn.2026-06.org.example.fleet:host-$SERIAL"
|
||||
echo " key @ $HANDLE, cert @ NV $NVINDEX — the secure-path image will read these."
|
||||
Executable
+129
@@ -0,0 +1,129 @@
|
||||
#!/usr/bin/env bash
|
||||
# tpm-selftest.sh — non-destructive check that a workstation's TPM can do
|
||||
# everything the secure path needs, BEFORE turning on disable_dot1x=false.
|
||||
#
|
||||
# Run as root on a booted workstation (the open-port test image is fine — it
|
||||
# ships the same tooling). Uses SCRATCH handle/NV and cleans them up, so it never
|
||||
# touches the real 0x81010001 / 0x01800001. Pass --use-real-handles to exercise
|
||||
# the actual locations instead (still cleaned up unless --keep).
|
||||
#
|
||||
# It validates, in order:
|
||||
# 1. TPM present + tpm2-tools work
|
||||
# 2. persistent key create + evict (needed to put the EAP-TLS key at the handle)
|
||||
# 3. NV define/write/read roundtrip (the cert store the boot hook reads)
|
||||
# 4. an OpenSSL TPM2 provider/engine exists <-- the usual missing piece
|
||||
# 5. a CSR + signature USING the TPM key (proves EAP-TLS client auth can work)
|
||||
# 6. wpa_supplicant build info (macsec driver present?)
|
||||
set -u
|
||||
|
||||
USE_REAL=0; KEEP=0
|
||||
for a in "$@"; do case "$a" in
|
||||
--use-real-handles) USE_REAL=1 ;;
|
||||
--keep) KEEP=1 ;;
|
||||
*) echo "usage: tpm-selftest.sh [--use-real-handles] [--keep]" >&2; exit 2 ;;
|
||||
esac; done
|
||||
|
||||
export TPM2TOOLS_TCTI="${TPM2TOOLS_TCTI:-device:/dev/tpmrm0}"
|
||||
if [ "$USE_REAL" = 1 ]; then HANDLE=0x81010001; NV=0x01800001
|
||||
else HANDLE=0x81008000; NV=0x01500000; fi
|
||||
|
||||
WORK=$(mktemp -d); PASS=0; FAIL=0; SKIP=0
|
||||
ok() { printf ' \033[32mPASS\033[0m %s\n' "$1"; PASS=$((PASS+1)); }
|
||||
no() { printf ' \033[31mFAIL\033[0m %s\n' "$1"; FAIL=$((FAIL+1)); }
|
||||
skip() { printf ' \033[33mSKIP\033[0m %s\n' "$1"; SKIP=$((SKIP+1)); }
|
||||
|
||||
# shellcheck disable=SC2329 # invoked indirectly via trap
|
||||
cleanup() {
|
||||
[ "$KEEP" = 1 ] && { echo "(--keep: leaving $HANDLE / $NV / $WORK in place)"; return; }
|
||||
tpm2_evictcontrol -C o -c "$HANDLE" >/dev/null 2>&1 || true
|
||||
tpm2_nvundefine "$NV" -C o >/dev/null 2>&1 || true
|
||||
rm -rf "$WORK"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
echo "== TPM self-test (handle=$HANDLE nv=$NV) =="
|
||||
|
||||
# --- 1. TPM present ---------------------------------------------------------
|
||||
if [ -c /dev/tpmrm0 ] || [ -c /dev/tpm0 ]; then ok "TPM device present"; else
|
||||
no "no /dev/tpmrm0 or /dev/tpm0 — VM needs a vTPM (qm set <id> --tpmstate0 <stor>:1,version=v2.0)"
|
||||
echo; echo "Cannot continue without a TPM."; exit 1
|
||||
fi
|
||||
if command -v tpm2_getcap >/dev/null && tpm2_getcap properties-fixed >/dev/null 2>&1; then
|
||||
ok "tpm2-tools talk to the TPM"
|
||||
else
|
||||
no "tpm2-tools / TPM access failed"; exit 1
|
||||
fi
|
||||
|
||||
# pre-clean the scratch locations in case a previous run aborted
|
||||
tpm2_evictcontrol -C o -c "$HANDLE" >/dev/null 2>&1 || true
|
||||
tpm2_nvundefine "$NV" -C o >/dev/null 2>&1 || true
|
||||
|
||||
# --- 2. persistent signing key ----------------------------------------------
|
||||
if tpm2_createprimary -C o -G ecc -g sha256 -c "$WORK/prim.ctx" >/dev/null 2>&1 \
|
||||
&& tpm2_create -C "$WORK/prim.ctx" -G ecc256:ecdsa-sha256 -u "$WORK/k.pub" -r "$WORK/k.priv" >/dev/null 2>&1 \
|
||||
&& tpm2_load -C "$WORK/prim.ctx" -u "$WORK/k.pub" -r "$WORK/k.priv" -c "$WORK/k.ctx" >/dev/null 2>&1 \
|
||||
&& tpm2_evictcontrol -C o -c "$WORK/k.ctx" "$HANDLE" >/dev/null 2>&1 \
|
||||
&& tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
|
||||
ok "created + persisted an ECC signing key at $HANDLE"
|
||||
else
|
||||
no "could not create/persist a key at $HANDLE"
|
||||
fi
|
||||
|
||||
# --- 3. NV roundtrip (the cert store the boot hook reads) -------------------
|
||||
echo "fleet-tpm-selftest-$(date +%s 2>/dev/null || echo x)" > "$WORK/blob"
|
||||
SZ=$(stat -c%s "$WORK/blob")
|
||||
if tpm2_nvdefine "$NV" -C o -s "$SZ" -a 'ownerread|ownerwrite|authread|authwrite' >/dev/null 2>&1 \
|
||||
&& tpm2_nvwrite "$NV" -C o -i "$WORK/blob" >/dev/null 2>&1 \
|
||||
&& tpm2_nvread "$NV" -C o -o "$WORK/blob.out" >/dev/null 2>&1 \
|
||||
&& cmp -s "$WORK/blob" "$WORK/blob.out"; then
|
||||
ok "NV define/write/read roundtrip at $NV (matches what the boot hook does)"
|
||||
else
|
||||
no "NV roundtrip at $NV failed"
|
||||
fi
|
||||
|
||||
# --- 4. OpenSSL TPM2 provider / engine --------------------------------------
|
||||
TPM_OSSL=""
|
||||
if openssl list -providers 2>/dev/null | grep -qi tpm2; then
|
||||
TPM_OSSL=provider; ok "OpenSSL TPM2 PROVIDER present (tpm2-openssl)"
|
||||
elif openssl engine -t tpm2tss 2>/dev/null | grep -qi available; then
|
||||
TPM_OSSL=engine; ok "OpenSSL TPM2 ENGINE present (tpm2-tss-engine)"
|
||||
else
|
||||
no "no OpenSSL TPM2 provider OR engine — install 'tpm2-openssl' (provider) in the image"
|
||||
echo " (this is the likely gap: tpm2-tss alone does NOT give openssl TPM access)"
|
||||
fi
|
||||
|
||||
# --- 5. CSR + signature USING the TPM key (the EAP-TLS make-or-break) --------
|
||||
if [ -n "$TPM_OSSL" ]; then
|
||||
CSR_OK=1
|
||||
if [ "$TPM_OSSL" = provider ]; then
|
||||
openssl req -new -provider tpm2 -provider default -key "handle:$HANDLE" \
|
||||
-subj "/O=fleet/CN=tpm-selftest" -out "$WORK/test.csr" >/dev/null 2>&1 || CSR_OK=0
|
||||
else
|
||||
openssl req -new -engine tpm2tss -keyform engine -key "$HANDLE" \
|
||||
-subj "/O=fleet/CN=tpm-selftest" -out "$WORK/test.csr" >/dev/null 2>&1 || CSR_OK=0
|
||||
fi
|
||||
if [ "$CSR_OK" = 1 ] && openssl req -in "$WORK/test.csr" -verify -noout >/dev/null 2>&1; then
|
||||
ok "built + self-verified a CSR signed BY the TPM key ($TPM_OSSL) — EAP-TLS can use it"
|
||||
else
|
||||
no "openssl could not sign a CSR with the TPM key via the $TPM_OSSL"
|
||||
echo " -> the key reference method in wpa_supplicant-dot1x.conf needs adjusting"
|
||||
fi
|
||||
else
|
||||
skip "CSR/sign test (no openssl TPM integration to test with)"
|
||||
fi
|
||||
|
||||
# --- 6. wpa_supplicant build info -------------------------------------------
|
||||
if command -v wpa_supplicant >/dev/null; then
|
||||
V=$(wpa_supplicant -v 2>&1 | head -1)
|
||||
ok "wpa_supplicant present: $V"
|
||||
echo " NOTE: confirm it was built with macsec_linux + the matching TPM key"
|
||||
echo " backend; full EAP-TLS/MKA can only be proven against the authenticator."
|
||||
else
|
||||
no "wpa_supplicant not found"
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "== summary: $PASS pass, $FAIL fail, $SKIP skip =="
|
||||
[ "$FAIL" = 0 ] && echo "TPM half looks ready — proceed to the authenticator/RADIUS bench." \
|
||||
|| echo "Fix the FAILs above before enabling disable_dot1x=false."
|
||||
exit "$FAIL"
|
||||
Reference in New Issue
Block a user