Network Access Protection (NAP) : Linux

Avenda Announces $1 eAgent Introductory Pricing – From now until after the RSA Conference 2009

MS NAP Team — Fri, 09 Jan 2009 20:41:00 GMT

Here is a follow-up guest posting from our NAP Partner Avenda Systems.

Due to the interest in our recent blog entry - Five Ways to Draw More Value from Microsoft NAP Deployments - we’ve decided to help customers kick off 2009 with a little cost savings. The calls and email have been overwhelming and have helped us understand that a lot of you are looking at role-based access and endpoint posture and health validation as a real way to leverage Microsoft’s NAP technology.

With the release of Windows Server 2008, network policy and services is something everyone should be considering to secure 802.1X-based wireless, wired, and VPN deployments. Additionally, the NAP agent for Windows XP is in Service Pack 3, which was released worldwide earlier in 2008. As a result, a NAP client was expected to be available to some 80% or more of Windows laptops, by the end of 2008.

Avenda’s eAgents add the ability to extend Microsoft NAP capabilities and to support non-Microsoft operating systems.

From now until April 30^th, one week after the end of the RSA Conference 2009 in San Francisco, each copy of our eAgents can be purchased for $1 each. This includes the Windows and Linux NAP agents.

NAP clients for Linux and Macintosh are available

MS NAP Team — Wed, 17 Dec 2008 01:36:00 GMT

NAP Clients for Linux and Macintosh are available from Avenda and UNETsystem, Inc.

Avenda

The Avenda Linux NAP Agent includes 802.1X enforcement, the Avenda System Health Agent (SHA), and the Avenda Linux NAP Agent System Health Validator (SHV), which you install on your NAP health policy server. For more information, see the Linux Agent tab of the Avenda NAP Agents Web page.

For the datasheet on the Avenda Linux NAP Agent, click here.

UNETsystem

UNETsystem, Inc. provides both a Linux and Macintosh NAP client.

The UNETsystem Linux NAP Client includes 802.1X and DHCP enforcement, the UNET SHA, and the UNET SHV to install on your NAP health policy server. To download it, click here.

The UNETsystem Macintosh NAP Client also includes 802.1X and DHCP enforcement, the UNET SHA, and the UNET SHV to install on your NAP health policy server. To download it, click here.

For more information, see the datasheet available here.

Download, install, play, and enjoy!

Joe Davies

NAP @ TechEd Podcast

JeffSigman — Wed, 11 Jun 2008 23:14:00 GMT

NAP - with Jeff Sigman and Others

Jeff Sigman – Microsoft
Chris Boscolo - Napera Networks, Inc.
Alex Chalmers - Ball State University
Pattabhi Attaluri - Avenda Systems

In this podcast from Tech·Ed NA 2008 IT Pro, Jeff Sigman talks about Network Access Protection (NAP). Alex Chalmers of Ball State University shares his experiences rolling out a large NAP deployment. Chris Boscolo (Napera Networks, Inc.) and Pattabhi Attaluri (Avenda Systems) talk about products their companies provide to add value to a NAP environment.

PowerPoint from the session.

Special thanks to Kevin Remde for making this podcast happen!

Video: NAP World Tour @ RSA 2008 San Francisco

JeffSigman — Tue, 15 Apr 2008 18:56:00 GMT

I just got back from San Francisco where I was speaking to anyone who would listen about how NAP is changing the world. :-> I wanted to share the video I put together of the trip to give you a flavor of what it was like to be there.

My effort leading up to the show was putting together the 802.1x NAP Interoperability Showcase, which you will see in the video. If you are interested, I also discuss it here in my personal blog about the whole trip.

Hope you enjoy!

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Hot news: Want to try out the Linux NAP Client?

MS NAP Team — Tue, 04 Dec 2007 01:42:00 GMT

I just got word this morning and had to blog it immediately...

NAP Partner Avenda Systems Inc. just let us know that they are now offering an “Evaluation Beta 1 Release” from their website. WOW! Cool!

Please feel free to grab it and send feedback directly to Avenda. Details are here.

NAP THE WORLD!

Jeff Sigman
Senior Program Manager

Network Access Protection (NAP)

NAP Blog

NAP Forum

NAP Site

Partners Will Extend NAP to Linux and Mac Desktops ...

MS NAP Team — Tue, 13 Nov 2007 21:50:00 GMT

Partners Will Extend Network Access Protection to Linux and Mac Desktops, and Create a New Appliance Form Factor

The Network Access Protection (NAP) ecosystem hits 150,000 deployed desktops milestone.

BARCELONA, Spain, Nov. 13, 2007 — Microsoft today announced key additions to the Network Access Protection (NAP) ecosystem with new third-party products that extend NAP to Macintosh and Linux desktops, as well as the first NAP-powered appliance. The new products will extend NAP, a policy enforcement platform built into the Windows Vista operating system and the upcoming versions of Windows Server 2008 and Windows XP SP 3, to non-Microsoft operating systems in heterogeneous network environments. Microsoft also announced that NAP has hit a milestone of 150,000 pre-release adoptions worldwide.

Announcements today included:

• UNETsystem Inc. announced that Linux and Macintosh versions of the company’s Anyclick for NAP will be released in 2008, extending NAP technology to these desktops.

• Avenda Systems Inc. announced the upcoming release of the Avenda Linux Network Access Protection Agent, which extends Network Access Protection technology to network endpoints running the Linux operating system.

• Celestix Networks Inc. announced that it has developed the first purpose-built appliance for delivering the NAP policy-enforcement platform. Celestix has scheduled the release of the new appliances shortly after Microsoft releases Windows Server 2008 next spring.

• Gaining momentum for Windows Server 2008, NAP is now deployed in more than 150,000 desktops worldwide, including 70,000 desktops at Microsoft. Microsoft also released a case study describing NAP deployment at Microsoft.

Reposted from presspass.

NAP the World,

- Jeff

XP NAP Rude Q and A

MS NAP Team — Fri, 09 Nov 2007 03:09:00 GMT

Since I spend nearly 1/3 of my week answering (or ignoring :->) emails about the XP NAP Client, I thought it might be smart to give a very concise Q&A. Here goes:

Questions	Jeff’s (brilliant) Answers
How do I get a copy of the BETA?	While it is on MSConnect, it is easier just to email me to get a copy. I have US-English and Language Neutral versions from the April 2007 Beta release. Remember, this is a BETA and is not officially supported (i.e. no QFEs); see XP SP3 info below.
How will this actually release officially?	ONLY via Windows XP Service Pack 3.
When will XP SP3 RTM?	1H CY2008
Will you please ship it outside of SP3?	I am sorry, no.
Why won’t you ship it outside of SP3?	In brief, the risk and cost to Windows was too high. NAP on XP changes 19+ core OS files (e.g. RAS, Wireless, EAP, etc) and we wouldn’t get the same testing coverage outside of SP3. Also, OOB releases are notoriously expensive to sustain. The code base would have to be maintained, orthogonally to XP itself, for 10+ years (i.e. MSRC’s). Wow.
How does the XP client compare with Vista?	Read my cool blog post.
Is it true that you brought all the great Vista Wired 802.1x features to XP?	Very true. Many customers have wanted Group Policy configuration for Wired 802.1x on XP. NAP gave us the needed business justification to pull it off in XP SP3.
Will the NAP Client release for any other Microsoft O/S’s?	Not at this time. No support for Windows Bob, 3.x, 9x, ME, 2000 and/or 2003.
What about Linux, Mac, etc?	Oh yeah baby, we have Linux right now. Mac is nearly here. This is the dude making it all happen.
What administration tools are available in the XP Client?	Only the command-line (netsh.exe nap). The MMC was written in managed code and isn’t available on XP. Also, our assumption is that Group Policy / script is good enough for XP.
What Active Directory schema changes are required, if any?	NAP, in general, does NOT require any AD schema updates. NAP fits in well with existing Server 2000/2003 deployments and simply requires a minimum of ONE Server 2008 computer (NAP Server / NPS). However, in order to manage Vista (and XP SP3) Wired 802.1x settings a schema update may be required. If you are using Server 2008 AD, it is included. Server 2003 AD requires an updated schema.
Will XP NAP honor my GP configuration settings just like Vista NAP (i.e. NAPAgent, QECs, etc)?	Yup!

Thanks for helping us NAP the WORLD!

Jeff Sigman
Senior Program Manager

Network Access Protection (NAP)

NAP Blog

NAP Forum

NAP Site

Linux NAP progress + "scriptable" health checker

MS NAP Team — Thu, 08 Nov 2007 00:23:00 GMT

I am horribly busy at the moment, but I simply can’t stop myself from posting this. Check out the details on the Linux NAP Client from Avenda Systems. Oh yeah baby! That’s an awesome page to see! I am going to see if I can get a copy to demo via a webcast. I love it.

While I am on the topic of cool NAP partners, check out UNETsystem’s “Anyclick” NAP extension. Wow, it really gives the administrator fine-grained control of what he defines as “healthy”. Want to do NAP based on:

· Registry value/key Check

· File exist, size, version, date, checksum Check

· Process Check

· OS Version Check

· TCP/UDP Port Check

· Installed Program Check

· INI File

Download their free beta and try it out on Windows Server 2008 RC0 / Vista / XP SP3!

I love it; my excitement for NAP is palpable. :-> Back to work.

Jeff Sigman
Senior Program Manager
Network Access Protection (NAP)

NAP Blog
NAP Forum
NAP Site

NAP FAQ: Are you planning on releasing NAP Clients for Mac, Linux, BeOS, etc?

MS NAP Team — Mon, 23 Jul 2007 23:11:00 GMT

I also get asked this ALL THE TIME. :->

As of this moment, *Microsoft* has released a NAP Client in Windows Vista and will be releasing a Windows XP NAP Client in forthcoming XP Service Pack 3.

No other NAP Clients are planned by Microsoft at this time. Instead, we are working directly with partners so that they may provide NAP Client support to the "ecosystem". It should be the same experience as buying a 3rd party Anti-Virus or Firewall.

I have discussed the Avenda Systems Linux NAP Client we showed in N+I Vegas here on the blog. I hope to be making a Linux update as well as an exciting Mac announcement soon!

NAP the WORLD in 2007,

Jeff Sigman

NAP Release Manager

Jeff.Sigman@online.microsoft.com *

- http://blogs.technet.com/nap

- http://microsoft.com/nap

- http://forums.microsoft.com/TechNet/ShowForum.aspx?ForumID=576&SiteID=17

* Remove the "online" to actually email me.

** This posting is provided "AS IS" with no warranties, and confers no rights.

NAP featured on RunAs Radio (from TechEd Orlando)

MS NAP Team — Wed, 11 Jul 2007 21:28:00 GMT

Richard Campbell and Greg Hughes, the hosts of RunAs Radio, caught me on the show floor at TechEd Orlando. They were hot on the topic of NAP and spent 30 minutes with me discussing it. It is a great interview, take a listen and feel free to comment here!

NAP the WORLD in 2007,

Jeff Sigman
NAP Release Manager
Jeff.Sigman@online.microsoft.com *

- http://blogs.technet.com/nap
- http://microsoft.com/nap
- http://forums.microsoft.com/TechNet/ShowForum.aspx?ForumID=576&SiteID=17

* Remove the "online" to actually email me.
** This posting is provided "AS IS" with no warranties, and confers no rights.

PS - Special thanks to Aaron Parker at stealthpuppy.com for noticing the radio show before I did! :->

NAP @ Interop 2007 – Las Vegas

MS NAP Team — Mon, 21 May 2007 22:13:00 GMT

I am flying out to Las Vegas tomorrow for the Interop show. If you haven’t already heard, NAP and the Trusted Computing Group (TCG) made a HUGE announcement today.

We are showing some amazing things at the show this year. Check out just a few of them:

· Live Demo of a Linux-based NAP Client (by Avenda Systems)

· Live Demo of a Trusted Platform Module (TPM) Client/Server integrated with NAP (by Wave Systems)

· NAP + 802.1x Demo with 10+ different switches: Aruba, Extreme, Foundry, Nortel, HP Procurve, Cisco, Meru, Alaxala, DLINK and Enterasys – all working with NAP

· Even more exciting stuff

I hope you can join the NAP team in Las Vegas for the fun!

NAP the WORLD in 2007,

Jeff Sigman
NAP Release Manager
Jeff.Sigman@online.microsoft.com *
http://blogs.technet.com/nap

* Remove the "online" to actually email me.
** This posting is provided "AS IS" with no warranties, and confers no rights.

Network Access Protection (NAP) announcement with the Trusted Computing Group (TCG)

MS NAP Team — Mon, 21 May 2007 21:45:00 GMT

Today, we are announcing a fairly significant development in our relationship with the Trusted Network Connect (TNC) subgroup of the Trusted Computing Group (TCG) standards body. Microsoft has been a supporter of the TCG since its inception and serves on its board. In April 2005, Microsoft announced that it would be supporting the TNC architecture for Network Access Control. And we did. The basic NAP architecture of clients, infrastructure and servers maps pretty clearly to the TNC architecture of Access Requestors, Policy Enforcement Points and Policy Decision Points respectively.

Today, we are announcing that NAP’s Statement of Health (SoH) protocol is being adopted and published as a standard TCG protocol. SoH is NAP’s primary protocol that enables a NAP client to report its state to a NAP server. It also carries a response from the NAP server that informs the client as to its level of compliance to corporate policy as well as instructions for remediation.

The TCG specification for the SoH protocol is called IF-TNCCS-SOH. The name may be a mouthful but it makes sense if you break down its meaning. All TNC standards start with “IF-TNC” which means “TNC Interface.” The “CS” means “client to server protocol” and the SoH means “Statement of Health.”

What this announcement means is that Network Access Control is getting a whole lot simpler. Client and server vendors can now implement the IF-TNCCS-SOH standard and interoperate with any other TNC or NAP client or server.

Vista supports IF-TNCCS-SOH today and Windows Server 2008 and XPSP3 will support it when they are released. This means that any third party client that implements IF-TNCCS-SOH will be able to participate in a NAP deployment that is being controlled by the Windows Server 2008 Network Policy Server (NPS). In fact, at Interop we are partnering with a company, Avenda Systems, to demonstrate a Linux NAP client working with Windows Server 2008 NPS Server based on the IF-TNCCS-SOH protocol.

Likewise, Vista and XPSP3 will be able to interoperate with any TNC server that supports IF-TNCCS-SOH. We are working with Juniper Networks to demonstrate this kind of interoperability at Interop this week as well. We will show a Vista client authenticating to a Juniper Infranet Controller using IF-TNCCS-SOH and then being granted access accordingly. Commercial availability of TNC clients and servers supporting IF-TNCCS-SOH is expected in the first half of 2008.

Customers have told us that they want standards in the NAC space because they don’t want to buy one solution today that doesn’t work with other solutions tomorrow. They want interoperability as a form insurance against depreciation of their investments in NAC infrastructure. With this announcement today, TCG and Microsoft took a significant step towards providing that investment protection. Customers can buy clients and servers based on IF-TNCCS-SOH and know that they will interoperate over time.

One nice property of the IF-TNCCS-SOH is that it is agnostic to the infrastructure that provides network connectivity. We have yet to find an 802.1x switch or access point that doesn’t already ‘just work’ with IF-TNCCS-SOH. At Interop, we will demonstrate NAP working based on IF-TNCCS-SOH with switches from over 10 vendors including Aruba, Extreme, Foundry, Nortel, HP Procurve, Cisco, Meru, Alaxala, DLINK and Enterasys. This is great news to customers because it means that they wont need to upgrade their 802.1x-capable infrastructure to support IF-TNCCS-SOH. They will only have to upgrade their servers to Windows Server 2008 or a compatible TNC server. They can use the built in NAP agent and 802.1x supplicant in XPSP3 and Vista and avoid client upgrades/deployments as well. This greatly reduces the cost and complexity of a Network Access Control deployment.

We think this announcement is a really good thing and we have already heard some positive feedback around it. It doesn’t, however, represent the end of our standards work. We will continue to participate in the TNC to help develop new standards, particularly in the areas of integrating the Trusted Platform Module (TPM) into solutions like NAP. (Another Interop demo will be the TPM integrated with NAP that we are showing with one of our partners, Wave Systems). We will also continue to participate in the IETF’s Network Endpoint Assessment (NEA) working group to promote interoperability there.

Some people have asked us what this announcement means in terms of our relationship with Cisco. Last September, we announced that NAP and Cisco’s NAC would interoperate. I’m happy to report that that interoperability is progressing well. It is in production at our joint beta customers and support for it is included in Beta 3 of Windows Server 2008 which is already released. Our relationship with Cisco remains strong and we look forward to continuing to work with them at the IETF NEA and in our products in general.

Well that about sums up our announcement. We are super excited. You can find more technical information about IF-TNCCS-SOH in the whitepaper we authored with TCG which is published on the TCG website as well as Microsoft.com/nap.

We’d love to get your feedback on this announcement and hear your opinions about standards and interoperability in NAC in general.

Paul Mayfield

Group Program Manager

Network Access Protection

What OS’es should NAP support?

MS NAP Team — Tue, 20 Jun 2006 23:24:00 GMT

We visit many customers and partners around the world. One thing we hear consistently is “NAP client enforcement MUST BE SUPPORTED on XP”.

Which OS’es would block / hinder your NAP deployments if they weren’t supported? Any nice-to-have’s (non-blocking)? Raw numbers and/or supporting facts about your deployments, to justify the need, would really help us judge how big the problem really is.

Do you need support for:

1.) Windows 2000

2.) Windows Server 2003

3.) Mac

4.) Linux

5.) Other

Please post your comments through the blog.

Jeff Sigman [MSFT]
NAP Release Manager
Jeff.Sigman@online.microsoft.com *
http://blogs.technet.com/nap

* Remove the "online" to actually email me.
** This posting is provided "AS IS" with no warranties, and confers no rights.