Linux 802.1X EAP-TLS Deployment Runbook

hostnamectl

 Static hostname: modestus-p50
       Icon name: computer-laptop
         Chassis: laptop
Operating System: Arch Linux
          Kernel: Linux 6.x.x-arch1-1
    Architecture: x86-64

{
  echo "=== DNS Resolution ==="
  host {domain} {dns-primary} 2>/dev/null && echo "DNS: OK" || echo "DNS: FAIL"
  echo ""
  echo "=== DC Connectivity ==="
  timeout 3 bash -c '</dev/tcp/{ad-dc-ip}/389' 2>/dev/null && echo "LDAP ({ad-dc-ip}:389): OK" || echo "LDAP: FAIL"
  timeout 3 bash -c '</dev/tcp/{ad-dc-ip}/636' 2>/dev/null && echo "LDAPS ({ad-dc-ip}:636): OK" || echo "LDAPS: FAIL"
  timeout 3 bash -c '</dev/tcp/{ad-dc-ip}/88' 2>/dev/null && echo "Kerberos ({ad-dc-ip}:88): OK" || echo "Kerberos: FAIL"
  echo ""
  echo "=== ISE Connectivity ==="
  timeout 3 bash -c '</dev/tcp/{ise-02-ip}/8443' 2>/dev/null && echo "ISE Admin ({ise-02-ip}:8443): OK" || echo "ISE Admin: FAIL"
  echo ""
  echo "=== Internet ==="
  timeout 3 curl -sI https://google.com >/dev/null 2>&1 && echo "Internet: OK" || echo "Internet: FAIL"
} 2>&1

{
  echo "=== Realm Status ==="
  realm list 2>/dev/null || echo "realm: not installed or not joined"
  echo ""
  echo "=== SSSD Service ==="
  systemctl is-active sssd 2>/dev/null && systemctl status sssd --no-pager -l | head -10 || echo "sssd: inactive or not installed"
  echo ""
  echo "=== Domain User Lookup ==="
  id $(whoami)@{domain} 2>&1 || echo "User lookup failed"
} 2>&1

=== Realm Status ===
inside.domusdigitalis.dev
  type: kerberos
  realm-name: INSIDE.DOMUSDIGITALIS.DEV
  domain-name: inside.domusdigitalis.dev
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd

=== SSSD Service ===
active

{
  HOSTNAME=$(hostname -s)
  echo "=== Root CA ==="
  ls -la {cert-dir}/{ca-cert} 2>/dev/null || echo "Root CA: NOT INSTALLED"
  echo ""
  echo "=== Machine Certificate ==="
  CERT="{cert-dir}/${HOSTNAME}-eaptls.pem"
  if [ -f "$CERT" ]; then
    echo "Certificate: $CERT"
    openssl x509 -in "$CERT" -noout -subject -issuer -dates 2>/dev/null
    echo ""
    echo "=== Extended Key Usage ==="
    openssl x509 -in "$CERT" -noout -text 2>/dev/null | grep -A2 "Extended Key Usage"
  else
    echo "Machine certificate: NOT INSTALLED"
  fi
  echo ""
  echo "=== Private Key ==="
  KEY="{key-dir}/${HOSTNAME}-eaptls.key"
  sudo test -f "$KEY" && echo "Private key: $KEY (exists, $(sudo stat -c %a $KEY) permissions)" || echo "Private key: NOT INSTALLED"
} 2>&1

{
  IFACE=$(ip -br link | grep -E "^en" | grep -v "docker\|veth" | awk '{print $1}' | head -1)
  echo "=== Wired Interface ==="
  echo "Interface: $IFACE"
  ip link show "$IFACE" 2>/dev/null | head -2
  echo ""
  echo "=== wpa_supplicant Config ==="
  [ -f /etc/wpa_supplicant/wpa_supplicant-wired.conf ] && {
    echo "Config exists"
    sudo grep -E "^network=|identity=|eap=|ca_cert=|client_cert=" /etc/wpa_supplicant/wpa_supplicant-wired.conf 2>/dev/null
  } || echo "wpa_supplicant-wired.conf: NOT CONFIGURED"
  echo ""
  echo "=== Service Status ==="
  systemctl is-active wpa_supplicant-wired@${IFACE} 2>/dev/null && {
    echo "Service: running"
    sudo wpa_cli -i "$IFACE" status 2>/dev/null | grep -E "wpa_state|EAP state|eap_tls"
  } || echo "wpa_supplicant service: not running"
} 2>&1

{
  echo "=== Firewall Backend ==="
  command -v nft >/dev/null 2>&1 && echo "nftables: available" || echo "nftables: not installed"
  command -v iptables >/dev/null 2>&1 && echo "iptables: available" || echo "iptables: not installed"
  echo ""
  echo "=== iptables Rules ==="
  sudo iptables -L -n --line-numbers 2>/dev/null | head -25
} 2>&1

{
  echo "=== Zabbix Agent ==="
  systemctl is-active zabbix-agent2 2>/dev/null && {
    echo "Status: running"
    zabbix_agent2 -V 2>/dev/null | head -1
    echo ""
    echo "=== Server Configuration ==="
    grep -E "^Server=|^ServerActive=" /etc/zabbix/zabbix_agent2.conf 2>/dev/null
  } || echo "zabbix-agent2: not installed or inactive"
} 2>&1

# Verify endpoint groups exist
netapi ise get-endpoint-groups | grep -i linux

# Expected:
# Linux-Workstations (parent)
# Linux-Research-Workstations (child)

# Check if endpoint is pre-registered
netapi ise get-endpoint "{ws-p50-mac}"

# If not registered:
netapi ise create-endpoint "{ws-p50-mac}" \
  --description "{ws-p50-hostname} - {ws-p50-model}"
netapi ise update-endpoint-group "{ws-p50-mac}" "{endpoint-group-research}"

# Verify authorization profiles
netapi ise get-authz-profile "{authz-profile-onboard}"
netapi ise get-authz-profile "{authz-profile-full}"
netapi ise get-authz-profile "{authz-profile-quarantine}"

# Verify dACLs exist and contain expected ACEs
netapi ise get-dacl "{dacl-onboard}"
netapi ise get-dacl "{dacl-compliant}"
netapi ise get-dacl "{dacl-quarantine}"

# Verify rules in correct order
netapi ise get-authz-rules "{policy-set-wired}"

# Expected rule order:
# #0: EAP-TLS specific rule (most specific, matches first)
# #1: AD group-based rules (when ready)
# #2: Posture rules (when implemented)
# #N: Default Deny

HOSTNAME=$(hostname -s)
DOMAIN="{domain}"

# Issue certificate from Vault
vault write pki_int/issue/{vault-pki-role} \
  common_name="${HOSTNAME}.${DOMAIN}" \
  ttl="8760h" \
  -format=json > /tmp/${HOSTNAME}-cert.json

HOSTNAME=$(hostname -s)

# Extract certificate
jq -r '.data.certificate' /tmp/${HOSTNAME}-cert.json | sudo tee {cert-dir}/${HOSTNAME}-eaptls.pem > /dev/null

# Extract private key
jq -r '.data.private_key' /tmp/${HOSTNAME}-cert.json | sudo tee {key-dir}/${HOSTNAME}-eaptls.key > /dev/null

# Secure permissions
sudo chmod 644 {cert-dir}/${HOSTNAME}-eaptls.pem
sudo chmod 600 {key-dir}/${HOSTNAME}-eaptls.key
sudo chown root:root {key-dir}/${HOSTNAME}-eaptls.key

HOSTNAME=$(hostname -s)

# Verify chain against Vault CA
openssl verify -CAfile {cert-dir}/{ca-cert} {cert-dir}/${HOSTNAME}-eaptls.pem

# Check subject and issuer
openssl x509 -in {cert-dir}/${HOSTNAME}-eaptls.pem -noout -subject -issuer

# Expected:
# subject=CN = modestus-razer.inside.domusdigitalis.dev
# issuer=CN = DOMUS-ISSUING-CA

HOSTNAME=$(hostname -s)

# Method 1: Modulus comparison (RSA)
openssl x509 -in {cert-dir}/${HOSTNAME}-eaptls.pem -noout -modulus | md5sum
sudo openssl rsa -in {key-dir}/${HOSTNAME}-eaptls.key -noout -modulus | md5sum
# Both hashes MUST be identical

# Method 2: Public key SHA256 (works with all key types)
openssl x509 -in {cert-dir}/${HOSTNAME}-eaptls.pem -pubkey -noout | openssl sha256
sudo openssl pkey -in {key-dir}/${HOSTNAME}-eaptls.key -pubout | openssl sha256
# Both hashes MUST be identical

HOSTNAME=$(hostname -s)

# Securely delete JSON with private key
shred -vuzn 3 /tmp/${HOSTNAME}-cert.json

HOSTNAME=$(hostname -s)

sudo tee /etc/wpa_supplicant/wpa_supplicant-wired.conf << EOF
ctrl_interface=/run/wpa_supplicant
ctrl_interface_group=wheel
eapol_version=2
ap_scan=0
fast_reauth=1

network={
    key_mgmt=IEEE8021X
    eap=TLS
    identity="${HOSTNAME}.{domain}"
    ca_cert="{cert-dir}/{ca-cert}"
    client_cert="{cert-dir}/${HOSTNAME}-eaptls.pem"
    private_key="{key-dir}/${HOSTNAME}-eaptls.key"
    eapol_flags=0
}
EOF

sudo chmod 600 /etc/wpa_supplicant/wpa_supplicant-wired.conf

# Get your wired interface name
IFACE=$(ip -br link | grep -E "^en" | grep -v "docker\|veth" | awk '{print $1}' | head -1)
echo "Wired interface: $IFACE"

# Plug in ethernet cable first!

# Run wpa_supplicant in foreground (Ctrl+C to stop)
sudo wpa_supplicant -i $IFACE \
  -c /etc/wpa_supplicant/wpa_supplicant-wired.conf \
  -D wired

# Watch for:
# - "CTRL-EVENT-EAP-STARTED"
# - "CTRL-EVENT-EAP-SUCCESS"
# - "CTRL-EVENT-CONNECTED"

IFACE=$(ip -br link | grep -E "^en" | grep -v "docker\|veth" | awk '{print $1}' | head -1)

# Enable and start service
sudo systemctl enable wpa_supplicant-wired@${IFACE}.service
sudo systemctl start wpa_supplicant-wired@${IFACE}.service

# Check status
sudo systemctl status wpa_supplicant-wired@${IFACE}
sudo wpa_cli -i $IFACE status

# Check active session via MnT
netapi ise mnt session "{ws-p50-mac}"

# Expected output should show:
# - NAS IP: {switch-ip}
# - Authentication method: dot1x
# - EAP method: EAP-TLS
# - Authorization profile: {authz-profile-onboard}

# Check session on switch
netapi ios exec "show access-session interface GigabitEthernet1/0/2 detail"

# Expected:
#   Status: Authorized
#   dot1x: Authc Success
#   ACS ACL: <dACL name>

# Verify current authorization rule applied
netapi ise dc session "{ws-p50-mac}"

# If showing onboard profile, update endpoint group to trigger production rule
# (ISE rule should match endpoint group + EAP-TLS for production profile)

# Issue Change of Authorization to apply new policy
netapi ise mnt coa-reauthenticate "{ws-p50-mac}"

# Verify new profile applied
netapi ise mnt session "{ws-p50-mac}"
# Expected: Authorization profile = {authz-profile-full}

# Check applied ACL on switch
netapi ios exec "show ip access-list" | grep -A20 "Linux"

# Verify ACL counters
netapi ios exec "show ip access-list" | grep -E "permit|deny" | head -15

{
  echo "=== Testing PERMITTED traffic ==="
  echo ""

  echo "Test 1: Internet ICMP (8.8.8.8)"
  timeout 3 ping -c 2 8.8.8.8 >/dev/null 2>&1 && echo "[PASS] Internet ICMP" || echo "[FAIL] Internet ICMP"

  echo "Test 2: DNS to pfSense ({dns-primary})"
  timeout 3 dig google.com @{dns-primary} +short >/dev/null 2>&1 && echo "[PASS] DNS pfSense" || echo "[FAIL] DNS pfSense"

  echo "Test 3: DNS to DC ({ad-dc-ip})"
  timeout 3 dig google.com @{ad-dc-ip} +short >/dev/null 2>&1 && echo "[PASS] DNS DC" || echo "[FAIL] DNS DC"

  echo "Test 4: HTTPS to internet"
  timeout 3 curl -sI https://google.com >/dev/null 2>&1 && echo "[PASS] HTTPS" || echo "[FAIL] HTTPS"

  echo "Test 5: Kerberos to DC ({ad-dc-ip}:88)"
  timeout 3 bash -c '</dev/tcp/{ad-dc-ip}/88' 2>/dev/null && echo "[PASS] Kerberos" || echo "[FAIL] Kerberos"

  echo "Test 6: LDAP to DC ({ad-dc-ip}:389)"
  timeout 3 bash -c '</dev/tcp/{ad-dc-ip}/389' 2>/dev/null && echo "[PASS] LDAP" || echo "[FAIL] LDAP"

  echo "Test 7: SMB to DC ({ad-dc-ip}:445)"
  timeout 3 bash -c '</dev/tcp/{ad-dc-ip}/445' 2>/dev/null && echo "[PASS] SMB" || echo "[FAIL] SMB"

  echo ""
  echo "=== Testing BLOCKED traffic (should timeout) ==="
  echo ""

  echo "Test 8: Ping to pfSense ({dns-primary}) - should FAIL"
  timeout 3 ping -c 2 {dns-primary} >/dev/null 2>&1 && echo "[SECURITY ISSUE] Internal ICMP allowed!" || echo "[PASS] Internal ICMP blocked"

  echo "Test 9: SSH to switch ({switch-ip}:22) - should FAIL"
  timeout 3 bash -c '</dev/tcp/{switch-ip}/22' 2>/dev/null && echo "[SECURITY ISSUE] Lateral movement!" || echo "[PASS] Switch SSH blocked"

  echo "Test 10: SSH to NAS ({nas-ip}:22) - should FAIL"
  timeout 3 bash -c '</dev/tcp/{nas-ip}/22' 2>/dev/null && echo "[SECURITY ISSUE] NAS access!" || echo "[PASS] NAS SSH blocked"

  echo ""
  echo "=== Summary ==="
  echo "Tests 1-7: Required services - should PASS"
  echo "Tests 8-10: Lateral movement - should be BLOCKED"
} 2>&1

# Load credentials from dsec
dsource d000 dev/network

# Or set manually
export ISE_HOST={ise-02-ip}
export ISE_USERNAME=<ers-admin>
export ISE_PASSWORD=<password>

# Check active session
netapi ise mnt session {ws-p50-mac}

# Check authentication history
netapi ise mnt auth-status {ws-p50-mac}

# Force reauthentication (CoA)
netapi ise mnt coa-disconnect {ws-p50-mac}

# List policy sets
netapi ise get-policy-sets

# Check authorization rules
netapi ise get-authz-rules "{policy-set-wired}"

# Check authorization profile
netapi ise get-authz-profile "{authz-profile-full}"

# Check dACL content
netapi ise get-dacl "{dacl-compliant}"

# Check session on switch
netapi ios exec "show access-session interface GigabitEthernet1/0/2 detail"

# Check applied ACL
netapi ios exec "show ip access-list" | grep -A20 "Linux"

# Check wpa_supplicant logs
sudo journalctl -u wpa_supplicant-wired@<interface> --since "10 minutes ago"

# Check ISE live logs
netapi ise mnt auth-status <mac-address>

# Verify certificate chain
openssl verify -CAfile {cert-dir}/{ca-cert} {cert-dir}/<hostname>-eaptls.pem

# Which authorization rule matched?
netapi ise dc session <mac-address>

# Expected fields to check:
# - AuthorizationPolicyMatchedRule
# - SelectedAuthorizationProfiles
# - NASIPAddress
# - RadiusFlowType

# Check which profile was applied
netapi ise dc session <MAC>

# Review authorization rule order
netapi ise get-authz-rules "{policy-set-wired}"

# Remove shadowing rules
netapi ise delete-authz-rule "{policy-set-wired}" "<generic-rule>" --force

# Verify rule order
netapi ise get-authz-rules "{policy-set-wired}"

# Reconnect to apply
sudo wpa_cli -i <interface> reassociate

# Check switch for applied ACL
netapi ios exec "show access-session interface <interface> detail"

# Check ISE authorization profile has dACL configured
netapi ise get-authz-profile "{authz-profile-full}"

# Compare ISE server cert issuer with client trust store
echo | openssl s_client -connect {ise-02-ip}:8443 -showcerts 2>/dev/null | grep -E "subject|issuer"

# Verify client trust store has correct CA
openssl x509 -in {cert-dir}/{ca-cert} -noout -subject -issuer