Phase 8b: 802.1X EAP-TLS

# From the Razer — check the cert that ISE trusts
sudo openssl x509 -in /etc/ssl/certs/modestus-razer-eaptls.pem -noout -subject -issuer

# Verify the nmcli connections
nmcli c s | grep -E "Domus-Wired|Domus-WiFi"

ds d000 dev/vault

vault status

echo "Extracting for: $HOSTNAME"
# If empty, set it again: HOSTNAME="modestus-p16g"

# Client certificate
jq -r '.data.certificate' /tmp/${HOSTNAME}-vault-cert.json >| /tmp/${HOSTNAME}-eaptls.pem

# Private key
jq -r '.data.private_key' /tmp/${HOSTNAME}-vault-cert.json >| /tmp/${HOSTNAME}-eaptls.key

# CA chain (issuing CA + root CA)
jq -r '.data.ca_chain[]' /tmp/${HOSTNAME}-vault-cert.json >| /tmp/DOMUS-CA-CHAIN.pem

# Issuing CA only (optional — chain file is usually sufficient)
jq -r '.data.issuing_ca' /tmp/${HOSTNAME}-vault-cert.json >| /tmp/DOMUS-ISSUING-CA.pem

# Subject, issuer, and validity dates
openssl x509 -in /tmp/${HOSTNAME}-eaptls.pem -noout -subject -issuer -dates

# CRITICAL: Must include "TLS Web Client Authentication" — without it, ISE silently rejects
openssl x509 -in /tmp/${HOSTNAME}-eaptls.pem -noout -text | grep -A1 "Extended Key Usage"

# Serial number (save this — needed for revocation)
jq -r '.data.serial_number' /tmp/${HOSTNAME}-vault-cert.json

# Expiration as human-readable date
jq -r '.data.expiration' /tmp/${HOSTNAME}-vault-cert.json | xargs -I {} date -d @{}

# Both MD5 hashes MUST match — mismatched key/cert is a common cause of "TLS handshake failed"
CERT_MOD=$(openssl x509 -in /tmp/${HOSTNAME}-eaptls.pem -noout -modulus | md5sum | cut -d' ' -f1)
KEY_MOD=$(openssl rsa -in /tmp/${HOSTNAME}-eaptls.key -noout -modulus 2>/dev/null | md5sum | cut -d' ' -f1)
echo "Cert: $CERT_MOD"
echo "Key:  $KEY_MOD"
[[ "$CERT_MOD" == "$KEY_MOD" ]] && echo "MATCH" || echo "MISMATCH — DO NOT PROCEED"

# HOSTNAME should still be set from above — verify: echo $HOSTNAME
# If empty: HOSTNAME="modestus-p16g"

# Install client cert
sudo cp /tmp/${HOSTNAME}-eaptls.pem /etc/ssl/certs/
sudo chmod 644 /etc/ssl/certs/${HOSTNAME}-eaptls.pem

# Install private key (root-only read)
sudo cp /tmp/${HOSTNAME}-eaptls.key /etc/ssl/private/
sudo chmod 600 /etc/ssl/private/${HOSTNAME}-eaptls.key
sudo chown root:root /etc/ssl/private/${HOSTNAME}-eaptls.key

# Install CA chain
sudo cp /tmp/DOMUS-CA-CHAIN.pem /etc/ssl/certs/
sudo chmod 644 /etc/ssl/certs/DOMUS-CA-CHAIN.pem

# Verify chain validates
openssl verify -CAfile /etc/ssl/certs/DOMUS-CA-CHAIN.pem /etc/ssl/certs/${HOSTNAME}-eaptls.pem

# Cleanup temp files
rm -f /tmp/${HOSTNAME}-vault-cert.json /tmp/${HOSTNAME}-eaptls.* /tmp/DOMUS-*.pem

sudo mkdir -p /etc/NetworkManager/conf.d
echo -e "[device]\nwifi.backend=wpa_supplicant" | sudo tee /etc/NetworkManager/conf.d/wifi_backend.conf

# Disable iwd completely
sudo systemctl stop iwd 2>/dev/null
sudo systemctl disable iwd 2>/dev/null
sudo systemctl mask iwd

# Enable wpa_supplicant
sudo systemctl enable wpa_supplicant
sudo systemctl start wpa_supplicant

sudo systemctl restart NetworkManager

# Find the wired interface
WIRED_IF=$(ip -o link show | awk -F': ' '/state UP/ && !/lo|wlan|docker|br-|veth/ {print $2; exit}')
echo "Wired interface: $WIRED_IF"

# Scan for a free IP on the management subnet (no DHCP — static only)
for ip in 200 201 202 203 204 205; do
    ping -c 1 -W 1 10.50.1.$ip >/dev/null 2>&1 && \
    echo "10.50.1.$ip IN USE" || echo "10.50.1.$ip FREE"
done

# Create open-mode wired connection with static IP
# Replace <FREE_IP> with a verified free address from the scan above
sudo nmcli connection add \
    type ethernet \
    con-name "Domus-Wired-Open" \
    ifname "$WIRED_IF" \
    ipv4.method manual \
    ipv4.addresses "10.50.1.<FREE_IP>/24" \
    ipv4.gateway "10.50.1.1" \
    ipv4.dns "10.50.1.90" \
    connection.autoconnect no

nmcli connection up "Domus-Wired-Open"

# Verify management subnet access — Vault should respond
curl -sk https://vault-01.inside.domusdigitalis.dev:8200/v1/sys/health | jq '.sealed'

# HOSTNAME should still be set from above — verify: echo $HOSTNAME
# If empty: HOSTNAME="modestus-p16g"

# Find the wired interface name
WIRED_IF=$(ip -o link show | awk -F': ' '/state UP/ && !/lo|wlan/ {print $2; exit}')
echo "Wired interface: $WIRED_IF"

sudo nmcli connection add \
    type ethernet \
    con-name "Domus-Wired-Mgmt-VLAN100" \
    ifname "$WIRED_IF" \
    802-1x.eap tls \
    802-1x.identity "${HOSTNAME}.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/DOMUS-CA-CHAIN.pem \
    802-1x.client-cert /etc/ssl/certs/${HOSTNAME}-eaptls.pem \
    802-1x.private-key /etc/ssl/private/${HOSTNAME}-eaptls.key \
    802-1x.private-key-password-flags 4 \
    802-1x.password-flags 4 \
    ipv4.method manual \
    ipv4.addresses "10.50.1.<STATIC_IP>/24" \
    ipv4.gateway "10.50.1.1" \
    ipv4.dns "10.50.1.90" \
    connection.autoconnect yes

nmcli connection up "Domus-Wired-Mgmt-VLAN100"

nmcli connection delete "Domus-Wired-Open"

# HOSTNAME should still be set from above — verify: echo $HOSTNAME
# If empty: HOSTNAME="modestus-p16g"

sudo nmcli connection add \
    type wifi \
    con-name "Domus-WiFi-Data-VLAN10" \
    ifname wlan0 \
    ssid "Domus-Secure" \
    wifi-sec.key-mgmt wpa-eap \
    802-1x.eap tls \
    802-1x.identity "${HOSTNAME}.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/DOMUS-CA-CHAIN.pem \
    802-1x.client-cert /etc/ssl/certs/${HOSTNAME}-eaptls.pem \
    802-1x.private-key /etc/ssl/private/${HOSTNAME}-eaptls.key \
    802-1x.private-key-password-flags 4 \
    802-1x.password-flags 4 \
    connection.autoconnect yes

HOSTNAME=$(hostnamectl --static)

sudo nmcli connection add \
    type wifi \
    con-name "Domus-WiFi-Mgmt-VLAN100" \
    ifname wlan0 \
    ssid "Domus-Secure" \
    wifi-sec.key-mgmt wpa-eap \
    802-1x.eap tls \
    802-1x.identity "${HOSTNAME}.inside.domusdigitalis.dev" \
    802-1x.ca-cert /etc/ssl/certs/DOMUS-CA-CHAIN.pem \
    802-1x.client-cert /etc/ssl/certs/${HOSTNAME}-eaptls.pem \
    802-1x.private-key /etc/ssl/private/${HOSTNAME}-eaptls.key \
    802-1x.private-key-password-flags 4 \
    802-1x.password-flags 4 \
    wifi.cloned-mac-address permanent \
    ipv4.method manual \
    ipv4.addresses "10.50.1.204/24" \
    ipv4.gateway "10.50.1.1" \
    ipv4.dns "10.50.1.90,10.50.1.91" \
    connection.autoconnect no

nmcli connection show --active | grep -E "Domus-Wired|Domus-WiFi"

# Verify 802.1X settings — clean summary of non-default fields
# Usage: replace connection name as needed
nmcli c s "Domus-Wired-Mgmt-VLAN100" | awk -F: '
BEGIN { prev = "" }
/^(connection\.|802-1x\.|802-3-ethernet\.|802-11-wireless|wifi|ipv4\.)/ && !/proxy|ipv6/ {
    val = ""
    for (i = 2; i <= NF; i++) { if (i > 2) val = val ":"; val = val $i }
    gsub(/^[ \t]+/, "", val)
    if (val == "" || val == "--" || val == "no" || val == "yes" || \
        val == "unknown" || val == "default" || val == "auto" || \
        val == "infrastructure" || val ~ /^0/ || val ~ /^-1/ || \
        val == "<hidden>" || \
        $1 ~ /phase[12]/ || $1 ~ /password-raw/ || $1 ~ /pin/ || \
        $1 ~ /wep-key/ || $1 ~ /leap-/ || $1 ~ /psk/ || \
        $1 ~ /\.timestamp$/ || $1 ~ /seen-bssids/ || \
        $1 ~ /\.uuid$/ || $1 ~ /deprecated/ || $1 ~ /may-fail/ || \
        $1 ~ /\.optional$/) next
    split($1, p, "."); s = p[1]
    if (s != prev) { if (prev != "") print ""; printf "=== %s ===\n", toupper(s); prev = s }
    printf "  %-45s %s\n", $1, val
}'

# Check IP — should be on DOMUS-Secure VLAN, not IoT VLAN
ip -4 addr show | awk '/inet / && !/127.0.0.1/ {print $NF, $2}'

ds d000 dev/network

WIRED_MAC="a8:2b:dd:8f:23:e6"
WIFI_MAC="e0:d5:5d:6c:e1:66"

# Wired — should show dot1x/EAP-TLS, not mab
netapi ise mnt session $WIRED_MAC
netapi ise dc auth-history $WIRED_MAC --hours 1

# WiFi — should show dot1x/EAP-TLS
netapi ise mnt session $WIFI_MAC
netapi ise dc auth-history $WIFI_MAC --hours 1

# Raw SQL — confirm method changed from mab to dot1x
netapi ise dc query "
SELECT mac_address, authentication_method, passed, timestamp
FROM radius_authentications
WHERE mac_address IN ('$WIRED_MAC', '$WIFI_MAC')
  AND timestamp > SYSDATE - 1
ORDER BY timestamp DESC
"

nmcli connection delete "DOMUS-IoT"

# Verify only EAP-TLS connections remain
nmcli connection show | grep -E "Domus|EAP"

# Live logs — NetworkManager + wpa_supplicant
journalctl -u NetworkManager -t wpa_supplicant -f | grep -iE "eap|tls|auth|fail"

# Certificate chain verification
openssl verify -CAfile /etc/ssl/certs/DOMUS-CA-CHAIN.pem /etc/ssl/certs/$(hostname)-eaptls.pem

# Key/cert match (both hashes must be identical)
openssl x509 -in /etc/ssl/certs/$(hostname)-eaptls.pem -noout -modulus | md5sum
sudo openssl rsa -in /etc/ssl/private/$(hostname)-eaptls.key -noout -modulus | md5sum

# Bounce connection
nmcli connection down "Domus-WiFi-Data-VLAN10" && nmcli connection up "Domus-WiFi-Data-VLAN10"