Adding dot1x support

2026-06-22 20:50:48 +00:00
parent 1f62e5ab17
commit dea7ca451a
13 changed files with 592 additions and 0 deletions
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# bootstrap.sh — one-time setup of the bench CA after `docker compose up -d step-ca`.
+#
+#   1. wait for step-ca, export its root to pki/root_ca.crt (-> image radius-ca.pem)
+#   2. ensure an enrolment provisioner exists (signs each host's TPM CSR)
+#   3. issue the RADIUS server cert/key into pki/radius/ (FreeRADIUS mounts it)
+#
+# Runs the `step` CLI against the running CA. Flags vary a little across step
+# versions — BENCH-VERIFY against your `step version` and adjust. Reads .env.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+[ -f .env ] && . ./.env
+CA_DNS=${CA_DNS:-ca.fleet.lab}
+CA_PORT=${CA_PORT:-8443}
+CA_URL="https://${CA_DNS}:${CA_PORT}"
+PKI=pki
+mkdir -p "$PKI/radius"
+
+# The CA's password (auto-init wrote it from this file in the container volume).
+PW="$PKI/stepca/secrets/password"
+[ -f "$PW" ] || { echo "CA not initialised yet ($PW missing) — is step-ca up?" >&2; exit 1; }
+
+step() { docker compose exec -T step-ca step "$@"; }
+
+# --- 1. export the root (becomes files/etc/dot1x/radius-ca.pem) --------------
+echo "==> exporting CA root"
+docker compose exec -T step-ca cat /home/step/certs/root_ca.crt > "$PKI/root_ca.crt"
+FP=$(step certificate fingerprint "$PKI/root_ca.crt" 2>/dev/null || \
+     openssl x509 -in "$PKI/root_ca.crt" -noout -fingerprint -sha256 | cut -d= -f2)
+echo "    root fingerprint: $FP"
+echo "    copy to: files/etc/dot1x/radius-ca.pem  (image trust anchor)"
+
+# --- 2. enrolment provisioner (idempotent) ----------------------------------
+# JWK provisioner 'enrol' is created by auto-init (DOCKER_STEPCA_INIT_PROVISIONER_NAME).
+# Enrolment authorizes a CSR with a one-time token:
+#     step ca token <host-id> --provisioner enrol  →  passed to `step ca sign`
+# That token-gated sign is what enrol/tpm-provision.sh uses.
+echo "==> provisioners:"
+step ca provisioner list --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \
+  | grep -E '"(name|type)"' || true
+
+# To UPGRADE to TPM attestation later, add an ACME attestation provisioner and
+# switch enrolment to device-attest-01 (key residency is then PROVEN, not trusted):
+#   step ca provisioner add acme-attest --type ACME \
+#     --challenge device-attest-01 \
+#     --attestation-format tpm \
+#     --attestation-root <tpm-vendor-EK-roots.pem>
+# (then `step ca acme` / an ACME client on the host instead of `step ca sign`.)
+
+# --- 3. RADIUS server cert (FreeRADIUS serves this; supplicant validates it) --
+echo "==> issuing RADIUS server cert (radius.${CA_DNS#ca.})"
+RADIUS_CN="radius.${CA_DNS#ca.}"
+step ca certificate "$RADIUS_CN" \
+  "$PKI/radius/server.pem" "$PKI/radius/server.key" \
+  --ca-url "$CA_URL" --root "$PKI/root_ca.crt" \
+  --provisioner enrol --provisioner-password-file "$PW" \
+  --not-after 720h --force
+cp "$PKI/root_ca.crt" "$PKI/radius/ca.pem"
+echo "==> done. FreeRADIUS will read pki/radius/{server.pem,server.key,ca.pem}."
+echo "    Next: cp $PKI/root_ca.crt ../../files/etc/dot1x/radius-ca.pem  &&  rebuild secure-path image."