ipsec attest Tool
Synopsis
ipsec attest --components|--devices|--sessions|--files|--hashes|--keys [options] ipsec attest --measurements|--packages|--products|--add|--del [options]
Description
The ipsec attest utility manages measurement reference values used for
TPM-based remote attestation, e.g. of the Linux Integrity Measurement
Architecture (IMA). See Trusted Network Connect for examples.
The auxiliary ipsec command, if available, sets the execution path to
${libexecdir}/ipsec/ which is usually /usr/libexec/ipsec/ or
/usr/local/libexec/ipsec/. The ${libexecdir} directory can be configured
with the --libexecdir ./configure
option defaulting to ${prefix}/libexec).
The ipsec attest utility is automatically enabled with the
./configure option
--enable-imv-attestation
and can be configured with the following
strongswan.conf options
| Key | Default | Description |
|---|---|---|
database |
File measurement information database URI. If it contains a password, make sure to adjust the access permissions of the config file accordingly |
|
load |
Plugins to load in |
The simple ipsec attest tool has been obsoleted by the much more powerful
capabilities of the strongTNC web-based management framework.
Options
--components [--key <digest>|--kid <id>]-
Show a list of components with an AIK digest or its primary key as an optional selector.
--devices [--utc]-
Show a list of registered devices and associated collected information.
--sessions [--utc]-
Show a chronologically sorted list of all TNC sessions.
--files [--product <name>|--pid <id>]-
Show a list of files with a software product name or its primary key as an optional selector.
--hashes [--sha1|--sha256|--sha384] [--product <name>|--pid <id>]-
Show a list of measurement hashes for a given software product or its primary key as an optional selector.
--hashes [--sha1|--sha256|--sha384] [--file <path>|--fid <id>]-
Show a list of measurement hashes for a given file or its primary key as an optional selector.
--keys [--components <cfn>|--cid <id>]-
Show a list of AIK key digests with a component or its primary key as an optional selector.
--measurements [--sha1|--sha256|--sha384] [--component <cfn>|--cid <id>]-
Show a list of component measurements for a given component or its primary key as an optional selector.
--measurements [--sha1|--sha256|--sha384] [--key <digest>|--kid <id>|--aik <path>]-
Show a list of component measurements for a given AIK or its primary key as an optional selector.
--packages [--product <name>|--pid <id>] [--utc]-
Show a list of software packages for a given product or its primary key as an optional selector.
--products [--file <path>|--fid <id>]-
Show a list of supported software products with a file path or its primary key as an optional selector.
--add --file <path>|--dir <path>|--product <name>|--component <cfn>-
Add a file, directory, product or component entry. Component
<cfn>entries must be of the form<vendor_id>/<name>-<qualifier>. --add [--owner <name>] --key <digest>|--aik <path>-
Add an AIK public key digest entry preceded by an optional owner name.
--add --product <name>|--pid <id> --sha1|--sha256|--sha384 --dir <path>|--file <path> [--relative|--rel] [--package <name> --version <string>]-
Add hashes of a single file or all files in a directory under absolute or relative filenames
--add --key <digest|--kid <id> --component <cfn>|--cid <id> --sequence <no>|--seq <no>-
Add an ordered key/component entry
--add --package <name> --version <string> [--security|--blacklist] [--product <name>|--pid <id>]-
Add a package version for a given product optionally with security or blacklist flag
--del --file <path>|--fid <id>|--dir <path>|--did <id>-
Delete a file or directory entry referenced either by value or primary key.
--del --product <name>|--pid <id>|--component <cfn>|--cid <id>-
Delete a product or component entry referenced either by value or primary key.
--del --product <name>|--pid <id> --file <path>|--fid <id>|--dir <path>|--did <id>-
Delete a product/file entry referenced either by value or primary key
--del --key <digest>|--kid <id>|--aik <path>-
Delete an AIK entry referenced either by value or primary key.
--del --key <digest|--kid <id> --component <cfn>|--cid <id>-
Delete a key/component entry
--del --product <name>|--pid <id> --sha1|--sha1-ima|--sha256|--sha384 [--dir <path>|--did <id>] --file <path>|--fid <id>-
Delete a file hash given an absolute or relative filename
Examples
List all sessions
# /usr/libexec/ipsec/attest --sessions 2: Mar 29 09:15:29 2022 1 Ubuntu 20.04 x86_64 a488651e36664792b306 hacker - no access 1: Mar 29 06:30:45 2022 1 Ubuntu 20.04 x86_64 a488651e36664792b306 client.strongswan.org - no access
List all devices
# /usr/libexec/ipsec/attest --devices 1: - a488651e36664792b306cf8be72dd630 - Ubuntu 20.04 x86_64 - 2: Mar 29 09:15:29 2022 hacker - no access 1: Mar 29 06:30:45 2022 client.strongswan.org - no access 1 device found
List all files
# /usr/libexec/ipsec/attest --files
2: /etc
6: tnc_config
5: /lib/x86_64-linux-gnu
1: libcrypto.so.1.0.0
3: libssl.so.1.0.0
8: /usr/bin
5: openssl
11: /usr/lib/x86_64-linux-gnu
2: libcrypto.so.1.1
4: libssl.so.1.1
6 files found
List all software packages
# /usr/libexec/ipsec/attest --packages 1: libssl-dev 2: libssl1.0.0 3: libssl1.0.0-dbg 4: openssl 4 packages found