End-to-End 802.1X Validation Guide

# Wired - check authentication state
wpa_cli -i enp0s31f6 status
# Look for: wpa_state=COMPLETED, EAP state=SUCCESS

# Wireless - check authentication state
wpa_cli -i wlan0 status
# Look for: wpa_state=COMPLETED, EAP state=SUCCESS, ssid=Domus-Secure

# Check IP assignment
ip addr show enp0s31f6
ip addr show wlan0

# Check default route
ip route | grep default

# Check dhcpcd status
systemctl status dhcpcd

# Check DHCP leases
cat /var/lib/dhcpcd/dhcpcd-enp0s31f6.lease 2>/dev/null
cat /var/lib/dhcpcd/dhcpcd-wlan0.lease 2>/dev/null

# Force DHCP renewal
sudo dhcpcd -n enp0s31f6
sudo dhcpcd -n wlan0

# Check SSSD status
systemctl status sssd

# Verify domain join
realm list

# Check user resolution
id username@domain.com

# Test SSSD authentication directly
sudo sssctl user-checks username@domain.com -a auth

# Test su login
su - username@domain.com

# List issued certificates
Get-ChildItem -Path Cert:\LocalMachine\CA | Where-Object { $_.Subject -like "*modestus-p50*" }

# Check certificate details
certutil -view -restrict "CommonName=modestus-p50.{domain}"

# Check CRL
certutil -URL http://ca.{domain}/CertEnroll/HOME-ROOT-CA.crl

# Verify certificate not revoked
certutil -isvalid <SerialNumber>

# Download and check CRL
curl -s http://ca.inside.domusdigitalis.dev/CertEnroll/HOME-ROOT-CA.crl -o /tmp/ca.crl
openssl crl -in /tmp/ca.crl -inform DER -text -noout | head -30

# Check if certificate serial is in CRL
SERIAL=$(openssl x509 -in /etc/ssl/certs/<hostname>-eaptls.pem -noout -serial | cut -d= -f2)
openssl crl -in /tmp/ca.crl -inform DER -text -noout | grep -i $SERIAL && echo "REVOKED!" || echo "NOT REVOKED"

# Check active sessions (MnT API)
uv run netapi ise mnt sessions
uv run netapi ise mnt sessions --details

# Get specific session by MAC
uv run netapi ise mnt session <MAC_ADDRESS>

# Check session count
uv run netapi ise mnt count

# Check failed authentications
uv run netapi ise mnt failed

# DataConnect - comprehensive session view
uv run netapi ise dc session <MAC_ADDRESS>

# Recent authentications
uv run netapi ise dc recent --hours 4 --limit 50

# Failed authentications
uv run netapi ise dc failed --hours 24

# Load ISE credentials
dsource d000 dev/network

# Ensure netapi and SSH access configured

#!/bin/bash
# Complete ISE Configuration Verification for Linux EAP-TLS
# Save as: verify-ise-complete.sh
# Usage: dsource d000 dev/network && ./verify-ise-complete.sh

set -e

echo "╔════════════════════════════════════════════════════════════════╗"
echo "║  ISE Linux EAP-TLS Complete Configuration Verification         ║"
echo "╚════════════════════════════════════════════════════════════════╝"

echo -e "\n=== 1. Authorization Profile: Linux_EAPTLS_Admins ==="
PROFILE=$(netapi ise -f json get-authz-profiles | jq -r '.[] | select(.name == "Linux_EAPTLS_Admins")')
if [ -n "$PROFILE" ]; then
    echo "✓ Profile exists"
    echo "$PROFILE" | jq '{name, vlan, dacl: .dacl_name, access_type}'
else
    echo "✗ Profile NOT found - needs creation"
    echo "  Command: netapi ise create-authz-profile --name Linux_EAPTLS_Admins --vlan RESEARCH_VLAN --dacl LINUX_EAPTLS_PERMIT_ALL"
fi

echo -e "\n=== 2. DACL: LINUX_EAPTLS_PERMIT_ALL ==="
DACL=$(netapi ise get-dacls | grep "LINUX_EAPTLS_PERMIT_ALL")
if [ -n "$DACL" ]; then
    echo "✓ DACL exists: $DACL"
else
    echo "✗ DACL NOT found - needs creation"
    echo "  Command: netapi ise create-dacl -n LINUX_EAPTLS_PERMIT_ALL --acl 'permit ip any any'"
fi

echo -e "\n=== 3. Active Directory Configuration ==="
echo "Checking AD join point and groups (may require ISE GUI access)..."
netapi ise -f json get-ad-join-points 2>/dev/null | jq -r '.[] | {name, domain, groups}' || \
    echo "  Note: AD join point verification requires ISE GUI:"
    echo "  - Administration → Identity Management → External Identity Sources → Active Directory"
    echo "  - Verify join point: inside.domusdigitalis.dev"
    echo "  - Groups tab → verify GRP-Linux-Admin-Workstations is added"

echo -e "\n=== 4. AD Group: GRP-Linux-Admin-Workstations ==="
echo "Checking via PowerShell on DC..."
ssh home-dc01 'powershell -Command "Get-ADGroup -Identity GRP-Linux-Admin-Workstations -Properties Members | Select-Object Name, @{Name=\"MemberCount\";Expression={$_.Members.Count}}"' 2>/dev/null || \
    echo "  Cannot verify via SSH - check manually"

echo -e "\n=== 5. Computer Account in AD Group ==="
ssh home-dc01 'powershell -Command "Get-ADGroupMember -Identity GRP-Linux-Admin-Workstations | Select-Object Name, SamAccountName"' 2>/dev/null || \
    echo "  Cannot verify via SSH - check manually"

echo -e "\n=== 6. Authorization Rule: Linux_Admin_EAP-TLS ==="
RULE=$(netapi ise get-authz-rules "Wired Dot1X Closed" | grep -A5 "Linux_Admin_EAP-TLS")
if [ -n "$RULE" ]; then
    echo "✓ Rule exists:"
    echo "$RULE"
else
    echo "✗ Rule NOT found - needs creation"
    echo "  Command:"
    echo "  netapi ise add-authz-rule \"Wired Dot1X Closed\" \\"
    echo "    \"Linux_Admin_EAP-TLS\" \\"
    echo "    \"Linux_EAPTLS_Admins\" \\"
    echo "    --dict \"INSIDE-AD\" \\"
    echo "    --attr \"ExternalGroups\" \\"
    echo "    --value \"inside.domusdigitalis.dev/Groups/GRP-Linux-Admin-Workstations\" \\"
    echo "    --operator contains"
fi

echo -e "\n=== 7. Client Certificate Configuration ==="
echo "Checking modestus-razer certificate..."
if [ -f /etc/ssl/certs/modestus-razer-eaptls.pem ] && [ -f /etc/ssl/private/modestus-razer-eaptls.key ]; then
    CERT_MOD=$(openssl x509 -noout -modulus -in /etc/ssl/certs/modestus-razer-eaptls.pem | openssl md5)
    KEY_MOD=$(openssl rsa -noout -modulus -in /etc/ssl/private/modestus-razer-eaptls.key 2>/dev/null | openssl md5)

    if [ "$CERT_MOD" = "$KEY_MOD" ]; then
        echo "✓ Certificate and key match"
        echo "  Subject: $(openssl x509 -noout -subject -in /etc/ssl/certs/modestus-razer-eaptls.pem)"
        echo "  Issuer: $(openssl x509 -noout -issuer -in /etc/ssl/certs/modestus-razer-eaptls.pem)"
        echo "  Expiry: $(openssl x509 -noout -enddate -in /etc/ssl/certs/modestus-razer-eaptls.pem)"
    else
        echo "✗ Certificate/key mismatch!"
        echo "  Cert hash: $CERT_MOD"
        echo "  Key hash: $KEY_MOD"
    fi
else
    echo "✗ Certificate or key file not found"
fi

echo -e "\n=== 8. NetworkManager 802.1X Configuration ==="
if nmcli connection show "Wired-802.1X" &>/dev/null; then
    echo "✓ Connection profile exists"
    nmcli connection show "Wired-802.1X" | grep -E "802-1x\.(eap|identity|client-cert|private-key|private-key-password-flags)"
else
    echo "✗ No Wired-802.1X connection found"
fi

echo -e "\n=== 9. Domain Join Status ==="
if sudo net ads testjoin 2>&1 | grep -q "Join is OK"; then
    echo "✓ Domain join successful"
    echo "  Computer: $(hostname)"
    echo "  Domain: $(sudo net ads info 2>/dev/null | grep "LDAP server name" || echo "inside.domusdigitalis.dev")"
else
    echo "✗ Not domain joined or join issue"
fi

echo -e "\n=== 10. SSSD Status ==="
if systemctl is-active sssd &>/dev/null; then
    echo "✓ SSSD running"
    if id administrator@inside.domusdigitalis.dev &>/dev/null; then
        echo "✓ AD user resolution working"
    else
        echo "✗ AD user resolution failing"
    fi
else
    echo "✗ SSSD not running"
fi

echo -e "\n╔════════════════════════════════════════════════════════════════╗"
echo "║  Configuration Summary                                         ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo "Review the checks above. Items marked with ✗ need attention."
echo ""
echo "To create missing ISE components, use the commands shown above."
echo "After configuration is complete, test with:"
echo "  sudo nmcli connection down Wired-802.1X && sudo nmcli connection up Wired-802.1X"
echo "  netapi ise mnt session \$(cat /sys/class/net/enp130s0/address)"

╔════════════════════════════════════════════════════════════════╗
║  ISE Linux EAP-TLS Complete Configuration Verification         ║
╚════════════════════════════════════════════════════════════════╝

=== 1. Authorization Profile: Linux_EAPTLS_Admins ===
✓ Profile exists
{
  "name": "Linux_EAPTLS_Admins",
  "vlan": "RESEARCH_VLAN",
  "dacl": "LINUX_EAPTLS_PERMIT_ALL",
  "access_type": "ACCESS_ACCEPT"
}

=== 2. DACL: LINUX_EAPTLS_PERMIT_ALL ===
✓ DACL exists: │ LINUX_EAPTLS_PERMIT_ALL │ 948779a0-f18b-11f0-b76e-52c54a1d1f56 │

=== 3. Active Directory Configuration ===
✓ AD join point configured: INSIDE-AD

=== 4. AD Group: GRP-Linux-Admin-Workstations ===
Name                         MemberCount
----                         -----------
GRP-Linux-Admin-Workstations           1

=== 5. Computer Account in AD Group ===
Name           SamAccountName
----           --------------
MODESTUS-RAZER MODESTUS-RAZER$

=== 6. Authorization Rule: Linux_Admin_EAP-TLS ===
✓ Rule exists:
  Name:    Linux_Admin_EAP-TLS
  Profile: Linux_EAPTLS_Admins
  Rank:    0
  Condition: INSIDE-AD.ExternalGroups contains 'GRP-Linux-Admin-Workstations'

=== 7. Client Certificate Configuration ===
✓ Certificate and key match
  Subject: O=Domus Digitalis, OU=Endpoints, CN=modestus-razer.{domain}
  Issuer: CN=HOME-ROOT-CA, DC=inside, DC=domusdigitalis, DC=dev
  Expiry: notAfter=Jan 27 00:00:00 2028 GMT

=== 8. NetworkManager 802.1X Configuration ===
✓ Connection profile exists
802-1x.eap:                             tls
802-1x.identity:                        modestus-razer.{domain}
802-1x.client-cert:                     file://{cert-dir}/modestus-razer-eaptls.pem
802-1x.private-key:                     file://{key-dir}/modestus-razer-eaptls.key
802-1x.private-key-password-flags:      4

=== 9. Domain Join Status ===
✓ Domain join successful
  Computer: modestus-razer
  Domain: {domain}

=== 10. SSSD Status ===
✓ SSSD running
✓ AD user resolution working