mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
59 lines
2.0 KiB
Markdown
59 lines
2.0 KiB
Markdown
# API Reference: Implementing Network Access Control
|
|
|
|
## Libraries
|
|
|
|
### pyrad (RADIUS Client)
|
|
- **Install**: `pip install pyrad`
|
|
- **Docs**: https://pypi.org/project/pyrad/
|
|
- `Client(server, secret, dict)` -- Create RADIUS client
|
|
- `CreateAuthPacket()` -- Build Access-Request
|
|
- `SendPacket(req)` -- Send and receive RADIUS reply
|
|
- Response codes: `AccessAccept`, `AccessReject`, `AccessChallenge`
|
|
|
|
### pysnmp (SNMP for Switch Queries)
|
|
- **Install**: `pip install pysnmp`
|
|
- **Docs**: https://pysnmp.readthedocs.io/
|
|
- `getCmd()` -- SNMP GET request
|
|
- `nextCmd()` -- SNMP GETNEXT/walk
|
|
- `CommunityData()` -- SNMPv2c community string
|
|
- `UsmUserData()` -- SNMPv3 authentication
|
|
|
|
## 802.1X SNMP OIDs
|
|
|
|
| OID | Description |
|
|
|-----|-------------|
|
|
| `1.3.6.1.2.1.8802.1.1.1.1.2.1.1.1` | dot1xAuthAuthControlledPortStatus |
|
|
| `1.3.6.1.2.1.8802.1.1.1.1.2.1.1.2` | dot1xAuthAuthControlledPortControl |
|
|
| `1.3.6.1.2.1.8802.1.1.1.1.2.4.1.1` | dot1xAuthSessionAuthenticMethod |
|
|
|
|
## RADIUS Attributes
|
|
|
|
| Attribute | Use |
|
|
|-----------|-----|
|
|
| `User-Name` | Client identity |
|
|
| `User-Password` | PAP password |
|
|
| `NAS-IP-Address` | Switch/AP IP |
|
|
| `NAS-Port-Type` | Port type (Ethernet, Wireless) |
|
|
| `Tunnel-Type` | VLAN assignment (13 = VLAN) |
|
|
| `Tunnel-Medium-Type` | Medium (6 = 802) |
|
|
| `Tunnel-Private-Group-Id` | VLAN ID for dynamic assignment |
|
|
| `Filter-Id` | ACL name to apply |
|
|
|
|
## EAP Methods
|
|
- **EAP-TLS**: Certificate-based (strongest, requires PKI)
|
|
- **PEAP**: Password with TLS tunnel
|
|
- **EAP-TTLS**: Tunneled TLS (flexible inner auth)
|
|
- **MAB**: MAC Authentication Bypass (fallback, no supplicant)
|
|
|
|
## PacketFence NAC API
|
|
- REST API at `https://packetfence:9999/api/v1/`
|
|
- `GET /nodes` -- List known devices
|
|
- `POST /nodes/{mac}/register` -- Register device
|
|
- `GET /violations` -- Active violations
|
|
|
|
## External References
|
|
- FreeRADIUS: https://freeradius.org/documentation/
|
|
- PacketFence NAC: https://www.packetfence.org/doc/
|
|
- Cisco ISE: https://developer.cisco.com/docs/identity-services-engine/
|
|
- 802.1X RFC 3748: https://datatracker.ietf.org/doc/html/rfc3748
|