PT-TLS-CLIENT(1)

📦
version 6.0.7 · 8 versions
, in ubuntu stonking

🦋 pt-tls-client — section 1 of the manual, strongSwan edition 🦋

okay so bestie, sit down, hydrate, because today we're reading pt-tls-client(1) and it's honestly giving main character energy. it's a section-1 manual page from strongSwan, and by the end of this you're gonna know it fr fr. no cap.

✨ NAME ✨

pt-tls-client — a simple client using PT-TLS to collect integrity information 💅

✨ SYNOPSIS ✨

pt-tls-client --connect hostname|address [--port port] [--certid
              hex|--cert file]+ [--keyid hex|--key file] [--key-type
              rsa|ecdsa] [--client client-id] [--secret password]
              [--mutual] [--options filename] [--quiet] [--debug level]

pt-tls-client -h | --help

like yes, that's a lot of brackets, but every single one of them is doing something, okay? 🫶

✨ DESCRIPTION ✨

so pt-tls-client is a simple client that uses the PT-TLS transport protocol — that's RFC 6876, for the citation girlies — to collect integrity measurements on the client platform. collecting receipts, but for your platform's integrity. iconic.

PT-TLS kicks off with an initial TLS handshake that does certificate-based server authentication, plus optional certificate-based client authentication. and if certs aren't your vibe? alternatively, simple password-based SASL client authentication protected by TLS can be used. options, we love to see them. 🌸

attribute requests and integrity measurements get exchanged via the PA-TNC message protocol (RFC 5792) between:

  • any number of Integrity Measurement Verifiers (IMVs) residing on the remote PT-TLS server, and
  • multiple Integrity Measurement Collectors (IMCs) loaded dynamically by the PT-TLS client according to a list defined by /etc/tnc_config.

and then the PA-TNC messages — the ones that contain one or several PA-TNC attributes — get multiplexed into PB-TNC (RFC 5793) client or server data batches, which in turn are transported via PT-TLS. it's layers on layers on layers. it's giving onion. it's giving protocol stack realness. 🧅✨

✨ OPTIONS ✨

every single one, bestie. not skipping a crumb. 💖

  • -h, --help — prints usage information plus a short summary of the available commands. your lil map. 🗺️
  • -c, --connect _hostname_|_address_ — sets the hostname or IP address of the PT-TLS server. this is the "where are we going" one.
  • -p, --port _port_ — sets the port of the PT-TLS server. default: 271.
  • -x, --cert _file_ — sets the path to an X.509 certificate file. you can repeat this option to load multiple client and CA certificates. stack 'em. 🎀
  • -X, --certid _hex_ — sets the handle of the certificate stored in a smartcard or a TPM 2.0 Trusted Platform Module. hardware girlies rise. 🔥
  • -k, --key _file_ — sets the path to the client's PKCS#1 or PKCS#8 private key file. 🔑
  • -t, --key-type _type_ — defines the type of the private key if it's stored in PKCS#1 format. can be omitted with PKCS#8 keys. so if you're on PKCS#8 you can just… not. ✨
  • -K, --keyid _hex_ — sets the keyid of the private key stored in a smartcard or a TPM 2.0 Trusted Platform Module. 👑
  • -i, --client _client-id_ — sets the username or client ID of the client, required for password-based SASL authentication. it's your name tag at the party. 🏷️
  • -s, --secret _password_ — sets the preshared secret or client password required for password-based SASL authentication. 🤫
  • -q, --mutual — enables mutual attestation between the PT-TLS client and the PT-TLS server. both of y'all showing receipts. 💞
  • -v, --debug _level_ — sets the debug level. default: 1.
  • -q, --quiet — disables debug output to stderr. 🤐
  • -+, --options _file_ — reads command line options from _file_.
okay so like… -q shows up twice in this list, once for --mutual and once for --quiet. we do not make the rules, we just report them accurately. 🙈

✨ EXAMPLES ✨

💖 cert-based auth with a private ECDSA key in a file

connect to a PT-TLS server using certificate-based authentication, storing the private ECDSA key in a file:

pt-tls-client --connect pdp.example.com --cert ca.crt \
              --cert client.crt --key client.key --key-type ecdsa

💖 cert-based auth with the private key in a smartcard or TPM 2.0

connect to a PT-TLS server using certificate-based authentication, storing the private key in a smartcard or a TPM 2.0 Trusted Platform Module:

pt-tls-client --connect pdp.example.com --cert ca.crt \
              --cert client.crt --keyid 0x81010002

💖 SASL password-based auth on port 443

connect to a PT-TLS server listening on port 443, using SASL password-based authentication:

pt-tls-client --connect pdp.example.com --port 443 --cert ca.crt \
              --client jane --password p2Nl9trKlb

ate. no notes. 🔥

✨ FILES ✨

  • /etc/tnc_config — the list that decides which IMCs get loaded dynamically. your guest list. 📋

✨ SEE ALSO ✨

and that's the whole page, bestie!! you understood it, i'm so proud of you. this was strongSwan version 6.0.7, dated 2018-11-20, and it was written in section 1 of the manual, which is where the user commands live. slay, periodt, and go collect those integrity measurements. 💅🌈🦋💖

📦 where this page comes from