2.9 KiB
Always on Openconnect VPN
This script uses Openconnect to automatically connect to Cisco Anyconnect VPN server.
Server address, username, password and 2fa seed is retreived from macOS/Linux keychain. You can skip keychain and provide those details through environment or stdin instead.
Additionaly routing for only specific subnets can be added in routes.txt
Setup
git clone this repo
brew install openconnect
brew install vpn-slice
brew install oath-toolkit
brew install swiftbar
brew install terminal-notifier
brew install bind
On Macos add server address, username, password and 2fa seed in keychain with these names:
Openconnect VPN Server
Openconnect Username
Openconnect Account Password
Openconnect TOTP Seed
On Linux you can use keychain (gnome-keychain/seahorse), add following entries:
secret-tool store --label='openconnect-server' server openconnect
secret-tool store --label='openconnect-username' username openconnect
secret-tool store --label='openconnect-password' password openconnect
secret-tool store --label='openconnect-seed' seed openconnect
Security considerations
For ease of use you can allow automatic keychain access to some of the attributs, but you shouldn't allow automatic access to password and especially the 2fa seed (but you can).
On Macos secrets might be available in the environment of the vpn process.
On Linux secrets will be shortly stored in tmpfs (memory) and deleted once they are passed to openconnect.
After setting up, change the run-vpn.sh, routing.sh and hostscan-bypass.sh ownership to root:
chown root:root run-vpn.sh
chown root:root hostscan-bypass.sh
chown root:root routing.sh
Defining routes
Rename routes.txt.sample to routes.txt or create an empty routes.txt and add subnets to be routed through VPN there.
Usage
Usage from terminal
DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS sudo -E ./run-vpn.sh
You can stop it by pressing CTRL+C
or killing the process.
GUI usage from bitbar/xbar/swaybar/argos
Consult the bitbar-openconnect.6s.sh
script for sudoers entries needed to run it. Add them to /etc/sudoers
Symlink(!) the bitbar-openconnect.6s.sh
script to your bitbar config folder:
ln -s ~/Documents/git/always-on-openconnect-vpn/bitbar-openconnect.6s.sh ~/.config/argos/
Enable running from your user
, add this to /etc/sudoers:
user ALL=(ALL) NOPASSWD:SETENV: /home/user/Documents/git/always-on-openconnect-vpn/run-vpn.sh
user ALL=(ALL) NOPASSWD: /usr/bin/killall -2 openconnect
Yubikey
Yubikey can be used for safe storage of TOTP seed. Configure TOTP in Yubikey Authenticator app or ykman oath
if using command line. Then use ykman oath list
to get the name of the entry and set that name in OC_YUBIKEY
environment variable.
For example:
OC_YUBIKEY=VPN:organization sudo -E ./run-vpn.sh