Engineering-Tech Wiki

User Tools

Site Tools

You are here: start » auth » howto » linux » vpnclient
Trace:
auth:howto:linux:vpnclient

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
auth:howto:linux:vpnclient [2009/10/19 11:48] – kohoferauth:howto:linux:vpnclient [2020/04/21 14:16] – [Installation] kohofer
Line 1: Line 1:
-===== VPN (Virtual Private Network) at the Free University of Bolzano/Bozen =====+====== VPN (Virtual Private Network) at the Free University of Bolzano/Bozen and EURAC ======
  
-==== Infos regarding the usage of VPN ====+===== Infos regarding the usage of VPN =====
  
-http://www.unibz.it/en/ict/ComputerInternet/network/vpn/default.html+https://knowledge.scientificnet.org/workspace/#nd=ab7442f9-c4d0-4ffc-a4f7-1e0d84515cc9&ld=17f4d8ce-edff-4d42-ad33-d98e2cdebc35&ln=it
  
-==== Instructions for Windows 2000, XP and VISTA ==== +==== Instructions for MacOS X ====
-http://www.unibz.it/en/ict/ComputerInternet/network/vpn/InstallationWindows.html+
  
-==== Instructions for MacOS X 10.4 ==== +We recommend to download and install [[https://itunes.apple.com/en/app/cisco-anyconnect/id392790924?mt=8|Cisco AnyConnect]] from Apple Store for iOS and connect via Browser to https://vpn.scientificnet.org for Mac OSX
-http://www.unibz.it/en/ict/ComputerInternet/network/vpn/InstallationMacOSX.html+
  
-==== Instructions for Linux Cisco VPN Client ====+=== Unsupported Instructions for MacOS X  and iOS - use at own risk! ===
  
-1. Download and install the kernel headers corresponding to the kernel in use. Some distributions name this package kernel-headers, others name it linux-headers:+Download, unpack (doubleclick), then doupleclick the unpacked file to install it:
  
-    # sudo apt-get install kernel-headers-`uname -r` +{{:auth:howto:linux:vpn-scientificnet.org.networkconnect.zip|}}
-or +
-    # sudo apt-get install linux-headers-`uname -r`+
  
-You can get the version of your kernel by issuing the following command:+Under Network settings a new item should appear:
  
-    # uname -a+  * VPN (IPSec) 
 +  * change username to your username 
 +  * click Connect and enter your password
  
-A valid version number could be, for example, 2.6.12-9-386.+=== Uninstalling if installation is corrupt in MacOSx ===
  
-2. Download and install the vpnclient:+Uninstallation has to be done by running this command on terminal:
  
-If kernel > 2.6.24-xx then download:+sudo /opt/cisco/vpn/bin/vpn_uninstall.sh
  
-https://pro.unibz.it/vpn/client/common/linux/vpnclient-linux-x86_64-4.8.01.0640-k9_2.6.24-xx.tar.gz+Should the uninstallation or reinstallation be corrupt, run this command on terminal: 
  
-otherwise download:+sudo pkgutil --forget com.cisco.pkg.anyconnect.vpn
  
-https://pro.unibz.it/vpn/client/common/linux/vpnclient-linux-x86_64-4.8.01.0640-k9.tar.gz 
  
-3. Untar the source of vpnclient and install it. +=== Instructions for iOS 9 ===
-   Depending on the Linux Distribution you might need to install ''make'' and ''gcc-3.4'' +
-    +
-   sudo apt-get install make gcc-3.4+
  
-If kernel > 2.6.24-xx then+  - Press Settings 
 +  - Choose General 
 +  - Nearly at the end, click VPN 
 +  - Next click: Add VPN Configuration... 
 +    - **Type:** IPSec 
 +    - **Description:** VPN Scientificnet 
 +    - **Server:** vpn.scientificnet.org 
 +    - **Account:** <your-unibz-username> 
 +    - **Password:** <your-unibz-password> or leave empty to ask every time! 
 +    - **Group Name:** Unibz 
 +    - **Secret:** <file> 
 +NrW2z9sj8g3kjJrzXxJwRPbIRNInWakL 
 +</file> 
 +  - Press Done in upper right corner of window 
 +  - Status: Slide Button to the right to connect 
 +  - Enter Password if not already entered above
  
-   # tar xfz vpnclient-linux-x86_64-4.8.01.0640-k9_2.6.24-xx.tar.gz+=== Instructions for Android 7 ===
  
-otherwise+  - Press Settings 
 +  - Find VPN Settings, depends on Model  
 +  - Next click: Add VPN Configuration... 
 +    - **Name:** Unibz VPN 
 +    - **Type:** IPSec Xauth PSK 
 +    - **Server-Address:** vpn.scientificnet.org 
 +    - **IPSec Identifier:** Unibz 
 +    - **IPSec Pre-shared Key:** NrW2z9sj8g3kjJrzXxJwRPbIRNInWakL 
 +    - **Account:** <your-unibz-username> 
 +    - **Password:** <your-unibz-password> or leave empty to ask every time! 
 +     
 +  - Press Done 
 +  - Status: Slide Button to the right to connect 
 +  - Enter Password if not already entered above
  
-   # tar xfz vpnclient-linux-x86_64-4.8.01.0640-k9.tar.gz+===== Instructions for Linux using openconnect Client (recommended) =====
  
-Next install/compile software:+===== Installation =====
  
-   # cd vpnclient +Run this command to install openconnect client and OpenConnect plugin GNOME GUI 
-     +
-   # sudo ./vpn_install+
  
-You will get some messages and you will be requested to answer to some questions:+  sudo apt install openconnect network-manager-openconnect network-manager-openconnect-gnome
  
-    Directory where binaries will be installed [/usr/local/bin] <ENTER> +Once installed open Settings and go to Network, press + right of the VPN section.
-     +
-    Automatically start the VPN service at boot time [yes] no +
-     +
-    Directory containing linux kernel source code [/lib/modules/X.X.XX-X-XXX/build] <ENTER>+
  
-     +{{:auth:howto:linux:network_vpn.png?400|}}
-You only have to modify the predefined answers if they do not correspond to your actual situation. +
-If everything works, you will see some compilation messages and then the installation program will stop.+
  
-4. Download the unibz.pcf configuration file from the site of the university via web:+Select **Cisco AnyConnect Compatible VPN (openconnect)** and fill out as shown below:
  
-https://pro.unibz.it/vpn/profiles/unibz/Free%20University%20of%20Bozen-Bolzano.zip+{{:auth:howto:linux:add_vpn_openconnect.png?400|}}
  
-5. Unzip the configuration file and copy it to the correct location:+{{:auth:howto:linux:details_vpn.png?300|Details}} {{:auth:howto:linux:identity_vpn.png?300|Identity}} 
  
-    # unzip "Free University of Bozen-Bolzano.zip" +{{:auth:howto:linux:ipv4_vpn.png?300|IPv4}} {{:auth:howto:linux:ipv6_vpn.png?300|IPv6}} 
-     +
-    # sudo cp "Free University of Bozen-Bolzano.pcf" /etc/opt/cisco-vpnclient/Profiles/unibz.pcf+
  
-6. Initialize the vpnclient:+**Details** 
 +  - Make available to other users: tick if you want to allow other users on your system to use the VPN
  
-    # sudo /etc/init.d/vpnclient_init start+**Identity** 
 +  - Name: VPN work (use a descriptive name) 
 +  - VPN Protocol: Cisco AnyConnect 
 +  - Gateway: vpn.scientificnet.org 
 +  - CA Certificate: download from {{ :auth:howto:linux:vpn-scientificnet-org.pem |here}}, not really necessary!
  
-7. You can now start the vpnclient using sudo:+The rest can be left as it is.
  
-    $ sudo vpnclient connect unibz+**IPv4/IPv6** 
 +  - IPv4 Method: Automatic (DHCP) 
 +  - DNS: ON 
 +  - Routes: ON
  
-You will see some messages and then you will be requested to insert your username and password:+Press <color #22b14c>Apply</color>
  
-    Cisco Systems VPN Client Version 4.8.01 (0640) +Now you can enable the VPN connection!
-    Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved. +
-    Client Type(s): Linux +
-    Running on: Linux 2.6.22-14-generic #1 SMP Tue Dec 18 08:02:57 UTC 2007 i686 +
-    Config file directory: /etc/opt/cisco-vpnclient+
  
-    Initializing the VPN connection. +Move the slider from OFF to ON, a small window should open,
-    Contacting the gateway at 193.206.186.111 +
-    User Authentication for unibz...+
  
-    Enter Username and Password.+{{:auth:howto:linux:enable_vpn.png?400|Enable VPN}}
  
-    Username []: X +make sure that for VPN Host you select: **vpn.scientificnet.org**
-    Password []: Z +
-    Authenticating user. +
-    Negotiating security policies. +
-    Securing communication channel.+
  
-    Your VPN connection is secure.+Enter your unibz Username, without @unibz.it and your unibz Password.
  
-    VPN tunnel information. +{{:auth:howto:linux:connect_vpn.png?400|Connect VPN}}
-    Client address: 172.21.204.1 +
-    Server address: 193.206.186.111 +
-    Encryption: 128-bit AES +
-    Authentication: HMAC-SHA +
-    IP Compression: None +
-    NAT passthrough is active on port UDP 4500 +
-    Local LAN Access is disabled+
  
-Please notice that you will have to leave the console open in order to have the VPN running.+Press **Login**
  
-==== Instructions for Linux VPNC Client ====+If all goes well the slider should remain in ON position, if not check the Log. 
 +To verify launch this command in a terminal: 
 + 
 +  ifconfig 
 + 
 +You should get a new interface --> vpn0: with an IP Address: 172.xxx.xxx.xxx 
 + 
 +===== Instructions for Linux vpnc Client =====
  
 1. Install vpnc 1. Install vpnc
  
-  sudo aptitude install vpnc+  sudo apt-get install vpnc
  
-2. Config; create file unibz.conf+2. For Unibz: 
 + 
 +  * Create configuration file unibz.conf. Download from here: {{:auth:howto:linux:unibz.conf|}} 
 + 
 +2.a For Eurac: 
 + 
 +   * Create configuration file eurac.conf. Download from here: {{:auth:howto:linux:eurac.conf|}} 
 +    
 +<note important>IPSec obfuscated secret needs to be on a single line.</note> 
 +    
 +<note important>Replace <your-windows-login> with your username.</note> 
 + 
 + 
 +For Unibz:
  
   sudo vi /etc/vpnc/unibz.conf   sudo vi /etc/vpnc/unibz.conf
Line 133: Line 156:
 IPSec obfuscated secret 06294C134E0BEBDA4B449B56BFD305D35D12DABF4044EDB6794926C2CA6D5AEDFE6342DF190E566EB11215DDC1591D5CB6ABEBEB593693C6D0B2077D78034B6AFEEA3221E77F4 IPSec obfuscated secret 06294C134E0BEBDA4B449B56BFD305D35D12DABF4044EDB6794926C2CA6D5AEDFE6342DF190E566EB11215DDC1591D5CB6ABEBEB593693C6D0B2077D78034B6AFEEA3221E77F4
 C9858DD711AA8DE58F6 C9858DD711AA8DE58F6
-Xauth username <your-windows-login>+Xauth username your-windows-login 
 +# e.g. Xauth username fmoser (not fmoser@unibz.it)
 ####################################### #######################################
 </code> </code>
Line 146: Line 170:
 sudo ls -l /etc/vpnc/unibz.conf sudo ls -l /etc/vpnc/unibz.conf
 -rw------- 1 root root 250 2009-05-02 15:54 /etc/vpnc/unibz.conf -rw------- 1 root root 250 2009-05-02 15:54 /etc/vpnc/unibz.conf
 +</code>
 +
 +For Eurac:
 +
 +  sudo vi /etc/vpnc/eurac.conf
 +
 +<code>
 +#######################################
 +IPSec gateway vpn.scientificnet.org 
 +IPSec ID Eurac
 +IPSec obfuscated secret 56A1CD68CC3AD33B48DB0F727ADDBC0A354DE3287D15C8526ED4CEDE4BC2ACDD1BB2460BC2354671A405F6150EA7C294C4DBC4CF9FFE45873BECAD3A2A738C5053BE34F709D592B50AD5BC472CDFF350
 +Xauth username your-windows-login
 +# e.g. Xauth username fmoser (not fmoser@eurac.edu)
 +#######################################
 +</code>
 +
 +apply this rights:
 +
 +  sudo chmod 600 /etc/vpnc/eurac.conf
 +  
 +  sudo chown root.root /etc/vpnc/eurac.conf
 +
 +<code>
 +sudo ls -l /etc/vpnc/eurac.conf
 +-rw------- 1 root root 250 2009-05-02 15:54 /etc/vpnc/eurac.conf
 </code> </code>
  
 3. Start vpnc 3. Start vpnc
  
-  sudo vpnc-connect unibz+For Unibz: 
 + 
 +  sudo vpnc-connect --domain unibz unibz
  
 This will first ask for your sudo password and then This will first ask for your sudo password and then
-you <windows-password>+your <unibz-password> 
 + 
 +For Eurac: 
 + 
 +  sudo vpnc-connect --domain eurac eurac 
 + 
 +This will first ask for your sudo password and then 
 +your <eurac-password> 
  
 4. Stop vpnc 4. Stop vpnc
Line 159: Line 218:
   sudo vpnc-disconnect   sudo vpnc-disconnect
  
- --- //[[kohofer@unibz.it|kohofer]] 2009/10/19 11:43//+ 
 +==== Possible errors ==== 
 + 
 +If you get the following error:  **vpnc-connect: no response from target**\\ 
 +try adding the line below to your configuration file (unibz.conf) 
 + 
 +**NAT Traversal Mode cisco-udp** 
 + 
 +---- 
 + 
 +When one attempts to connect to their VPN after installing and configuring vpnc on Ubuntu Oneiric,\\ 
 +the following error occurs: 
 + 
 +<code> 
 +root@ubuntu:~# vpnc-connect 
 +Error: either "to" is duplicate, or "ipid" is a garbage. 
 +</code> 
 + 
 +It appears that the Ubuntu package vpnc comes with an old version of vpnc-script.\\ 
 +This script is what sets up all the addresses and routes for you. The OpenConnect project\\ 
 +provides an updated / revised release of this script. Download the latest copy from [[http://git.infradead.org/users/dwmw2/vpnc-scripts.git/blob_plain/HEAD:/vpnc-script|here]].\\ 
 +Replace the vpnc-script script that comes with the Ubuntu vpnc package: /etc/vpnc/vpnc-script 
 + 
 +---- 
 + 
 +Access via ssh not possible, MTU value to high! 
 + 
 +In some cases the MTU value is too high, which results in an very strange 
 +situation: ping works, but ssh hangs at this point: 
 + 
 +... 
 +debug1: sending SSH2_MSG_KEX_ECDH_INIT 
 +debug1: expecting SSH2_MSG_KEX_ECDH_REPLY  
 + 
 + 
 +There are 2 bug reports for this:\\ 
 + 
 +https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1110787\\ 
 +https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1254085 
 + 
 +and a possible solution/workaround for Linux Mint: 
 + 
 +https://community.hide.me/threads/setup-problem-on-linux-mint-17.1839/ 
 + 
 +Check the current MTU value: 
 + 
 +  ip link | grep mtu 
 + 
 +Set MTU value on interface eth0 to 1392 
 + 
 +  /sbin/ifconfig eth0 mtu 1392 
 + 
 + 
 +==== Decode Group Password ==== 
 + 
 +[[https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode|cisco vpnclient password decoder]] 
 + 
 + 
 +===== Instructions for Linux Cisco AnyConnect Client ===== 
 + 
 +=== Installation === 
 + 
 +1. Open with your browser (tested with firefox 11.0) the following URL: 
 + 
 +https://vpn.scientificnet.org 
 + 
 +2. Enter your Username and password, then press **Login** 
 + 
 +3. A "Warning - Security" Windows opens: This will install the Cisco AnyConnect Client \\ 
 +in /opt/cisco of your Platform. 
 + 
 +4. Press **Run** on the "Warning - Security" Window 
 + 
 +{{:auth:howto:linux:cisco-anyconnect_1.png?direct&200}} 
 + 
 +5. In order to install Cisco AnyConnect, Admin (sudo) rights are required; a Window opens,\\ 
 +enter your local password. 
 + 
 +{{:auth:howto:linux:cisco-anyconenct_2.png?direct&200|}} 
 + 
 +6. The Cisco AnyConnect is installed and running, you can close the URL. 
 + 
 +{{:auth:howto:linux:cisco-anyconnect_3.png?direct&200|}} 
 + 
 +=== Launching Cisco AnyConnect GUI === 
 + 
 +This allows you to connect and disconnect the VPN service. 
 + 
 +  /opt/cisco/anyconnect/bin/vpnui 
 + 
 +Please note the vpnagentd must be running for this 
 + 
 +  * ps auxww | grep vpn 
 +<code> 
 +root      1759  0.0  0.3  17984  7644 ?        S    12:58   0:00 /opt/cisco/anyconnect/bin/vpnagentd 
 +</code> 
 + 
 +=== Launching Cisco AnyConnect NON-GUI === 
 + 
 +This allows you to connect and disconnect the VPN service. 
 + 
 +  * /opt/cisco/anyconnect/bin/vpn 
 + 
 +<code> 
 +Cisco AnyConnect Secure Mobility Client (version 3.0.5080) . 
 + 
 +Copyright (c) 2004 - 2011 Cisco Systems, Inc. 
 +All Rights Reserved. 
 + 
 + 
 +  >> state: Disconnected 
 +  >> state: Disconnected 
 +  >> notice: Ready to connect. 
 +  >> registered with local VPN subsystem. 
 +VPN> connect vpn.unibz.it 
 +connect vpn.unibz.it 
 +  >> contacting host (vpn.unibz.it) for login information... 
 +  >> notice: Contacting vpn.unibz.it. 
 +VPN>  
 +  >> Please enter your username and password. 
 +    0) clientless 
 +    1) scientificnetwork 
 +Group: [clientless]  
 + 
 +Username: <your-username> 
 +Password:  
 +  >> state: Connecting 
 +  >> notice: Establishing VPN session... 
 +  >> notice: Checking for profile updates... 
 +  >> notice: Checking for product updates... 
 +  >> notice: Checking for customization updates... 
 +  >> notice: Performing any required updates... 
 +  >> state: Connecting 
 +  >> notice: Establishing VPN session... 
 +  >> notice: Establishing VPN - Initiating connection... 
 +  >> notice: Establishing VPN - Examining system... 
 +  >> notice: Establishing VPN - Activating VPN adapter... 
 +  >> notice: Establishing VPN - Configuring system... 
 +  >> notice: Establishing VPN... 
 +  >> state: Connected 
 +  >> notice: Connected to vpn.unibz.it. 
 +VPN>exit 
 + 
 + 
 +</code> 
 + 
 +=== Uninstalling the AnyConnect Client === 
 + 
 +The client comes with an uninstallation script 
 + 
 +  * sudo /opt/cisco/vpn/bin/vpn_uninstall.sh 
 + 
 +However it doesn't actually uninstall everything properly, it removes files but leaves behind directories.\\ 
 +You can clean up what it leaves behind by deleting the directory /opt/cisco/ and /opt/.cisco/ 
 + 
 +  * sudo rm -r /opt/cisco /opt/.cisco 
 + 
 +Per-user configuration is stored in your home directory in a file called .anyconnect 
 + 
/data/www/wiki.inf.unibz.it/data/pages/auth/howto/linux/vpnclient.txt · Last modified: 2022/06/20 11:40 by kohofer