Re: VPN and quarantine

Hi Frederic - 

> First of all I need to apology because I am not a tech guy 
> especially on your
> technology, so I may ask a strange question.

No apologies necessary.

Before I address your question, I should disclose that I am the security
architect for InfoExpress, a company that provides an endpoint
audit/isolate/remediate solution for remote access and LAN networks. 

I should also mention that I'm teaching two vendor neutral tutorials, on the
topics of secure remote access and endpoint enforcement, at USENIX Security
this year. More info at

http://www.usenix.org/events/sec05/

> CISCO called this project NAC, Microsoft supplies this with 
> ISA 2004 as a
> quarantine functionality.
> 
> The idea of checking the remote user configuration AFTER VPN 
> authentication and
> BEFORE any flow of data on the private lan is interesting.

Yep. Since mobile machines are a major source of problems, VPNs are a good
target - also because you've already got the remote system in something of a
captive environment, it's easier to control its access.

> I would like to know if I can implement this solution with a Linux OS.
> 
> Could you advise me ? Give me some links ?

The lovely thing about Linux is that the answer is always "Sure!" But then
you've got to make it work.

Are you using Linux for the VPN server/concentrator? How many VPN servers do
you have connecting into your network? What about dial-up?

What kinds of endpoints do you want to inspect? Do you already have scripts
or tools that collect the information you want?

If the endpoint is out of compliance, what do you want to happen? Should the
user be directed to a Web site? Do you want changes to be made to the
endpoint without the user being involved?

Once the endpoint has had whatever changes made, do you want to have the
user trigger a re-check manually, or do you want the re-check to happen
automatically?

Many of the "usual" truisms about roll-your-own apply. It's certainly
possible to hack together a system that only grants complete internal access
after checks have been made. The commercial products in the space save you a
lot of work. But we need to know more about your situation to really answer
the question.

cheers - tbird