OpenConnect

https://www.infradead.org/openconnect/
Admin
OpenConnect is a cross-platform multi-protocol SSL VPN client that supports Cisco AnyConnect, Array...
Tokens:22,413
Snippets:377
Trust Score:9.4
Update:1 month ago
Show doc for...
Tokens:
Raw
### PKCS#11 Token Output Example

Source: https://www.infradead.org/openconnect/pkcs11.html

Example output from p11tool showing token details including the PKCS#11 URL.

```text
Token 7:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29
	Label: PIV_II (PIV Card Holder pin)
	Type: Hardware token
	Manufacturer: piv_II
	Model: PKCS#15 emulated
	Serial: 108421384210c3f5
```

--------------------------------

### p11tool Output Example

Source: https://www.infradead.org/openconnect/pkcs11.html

Example output showing private key objects found on a PIV token.

```text
Token 'PIV_II (PIV Card Holder pin)' with URL 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29' requires user PIN
Enter PIN:
Object 0:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%01;object=PIV%20AUTH%20key;object-type=private
	Type: Private key
	Label: PIV AUTH key
	Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_SENSITIVE;
	ID: 01

Object 1:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%02;object=SIGN%20key;object-type=private
	Type: Private key
	Label: SIGN key
	Flags: CKA_PRIVATE; CKA_SENSITIVE;
	ID: 02

Object 2:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%03;object=KEY%20MAN%20key;object-type=private
	Type: Private key
	Label: KEY MAN key
	Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_SENSITIVE;
	ID: 03

Object 3:
	URL: pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%04;object=CARD%20AUTH%20key;object-type=private
	Type: Private key
	Label: CARD AUTH key
	Flags: CKA_SENSITIVE;
	ID: 04
```

--------------------------------

### OpenConnect PKCS#11 Configuration Examples

Source: https://www.infradead.org/openconnect/pkcs11.html

Various ways to specify certificate and key locations using PKCS#11 URIs, ranging from verbose to simplified formats.

```bash
openconnect -c 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%01;object=Certificate%20for%20PIV%20Authentication' vpn.example.com
```

```bash
openconnect -c 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%01' vpn.example.com
```

```bash
openconnect -c 'pkcs11:manufacturer=piv_II;id=%01' vpn.example.com
```

```bash
openconnect -c 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%01;object=Certificate%20for%20PIV%20Authentication;object-type=cert' -k 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29;id=%01;object=PIV%20AUTH%20key;object-type=private' vpn.example.com
```

--------------------------------

### Importing an SDTID file

Source: https://www.infradead.org/openconnect/token.html

This example demonstrates how to import an RSA sdtid-formatted XML file using the '--token-secret' argument prefixed with '@_FILE_'.

```bash
--token-secret @_FILE.SDTID_
```

--------------------------------

### Configure and Build OpenConnect

Source: https://www.infradead.org/openconnect/building.html

Standard commands to configure, build, and optionally install OpenConnect from source. Use --without-gnutls to use OpenSSL instead of GnuTLS.

```bash
./configure
make
make install
```

```bash
./configure --without-gnutls
```

--------------------------------

### List System Keys Output

Source: https://www.infradead.org/openconnect/connecting.html

Example output from the list-system-keys.exe tool used to identify certificate and key URIs in the Windows store.

```text
Label: (null)
Cert URI: system:win:id=37835fdcdfe2817ee22d6b161e54812fe95867fe;type=cert
Key URI: system:win:id=37835fdcdfe2817ee22d6b161e54812fe95867fe;type=privkey
Cert info: subject `CN=d1ab215ccab521bc', issuer `CN=Token Signing Public Key', serial 0x2ce0193a3ecf4da9f0591cee9158e48ec53a8e54, RSA key 1024 bits, signed using DSA-SHA1 (broken!), activated `2020-05-07 06:48:59 UTC', expires `2020-05-14 06:48:59 UTC', pin-sha256="2XOidBPfppXj4REiuj9fIE3UYQK6TTQIODQajIOiLFi="
```

--------------------------------

### Example SecurID Token Formats

Source: https://www.infradead.org/openconnect/token.html

These are examples of different formats for SecurID tokens that can be imported by the 'stoken import' command. They include pure numeric, iPhone-compatible, Android-compatible, and XML formats.

```text
286510182209303756117707012447003320623006...
```

```text
29658-21098-45467-64675-65731-01441-11337...
```

```text
com.rsa.securid.iphone://ctf?ctfData=229639330774927764401...
```

```text
http://127.0.0.1/securid/ctf?ctfData=250494932146245277466...
```

```text
http://127.0.0.1/securid/ctf?ctfData=AwAAfBc3QSopPxxjLGnxf...
```

```xml
<?xml version=...
```

--------------------------------

### Connect to Fortinet SSL VPN

Source: https://www.infradead.org/openconnect/fortinet.html

Use this command to initiate a connection to a Fortinet SSL VPN. Ensure you have OpenConnect installed and the Fortinet protocol support enabled.

```bash
openconnect --protocol=fortinet fortigate.example.com
```

--------------------------------

### Apply LGPLv2.1 License Notice

Source: https://www.infradead.org/openconnect/licence.html

Standard notice to be placed at the start of source files to convey the library's licensing terms.

```text
one line to give the library's name and an idea of what it does.
Copyright (C) year  name of author

This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
```

--------------------------------

### Authenticate and get connection variables

Source: https://www.infradead.org/openconnect/manual.html

Use --authenticate to get connection variables like COOKIE, HOST, CONNECT_URL, FINGERPRINT, and RESOLVE without establishing a full VPN connection. This is useful for non-privileged users to obtain connection details before a privileged user initiates the actual connection.

```bash
eval ‘openconnect --authenticate https://vpnserver.example.com‘;
[ -n"$COOKIE" ] && echo "$COOKIE" | 
sudo openconnect --cookie-on-stdin $CONNECT_URL --servercert $FINGERPRINT --resolve $RESOLVE
```

```bash
sudo openconnect --cookie-on-stdin ${CONNECT_URL:-$HOST} --servercert $FINGERPRINT ${RESOLVE:+--resolve=$RESOLVE}
```

--------------------------------

### Referencing a stoken rcfile

Source: https://www.infradead.org/openconnect/token.html

This example shows how to reference a stoken rcfile using the '@' prefix. This is equivalent to the default behavior when no --token-secret file is provided.

```bash
@_${HOME}_ /.stokenrc
```

--------------------------------

### Prepare Build System

Source: https://www.infradead.org/openconnect/building.html

Run this command first if you checked out the source code from git to prepare the build system.

```bash
./autogen.sh
```

--------------------------------

### Connect with Client Certificates

Source: https://www.infradead.org/openconnect/connecting.html

Use the -c option to specify certificate files or PKCS#11/system URIs. Use -k if the private key is stored in a separate file.

```bash
openconnect -c cert_and_private_key.pem https://vpn.mycompany.com/
```

```bash
openconnect -c certificate.pem -k private_key.pem https://vpn.mycompany.com/
```

```bash
openconnect -c pkcs11:id=X_%b04%c3%85%d4u%e7%0b%10v%08%c9%0dA%8f%3bl%df https://vpn.mycompany.com/
```

```bash
openconnect -c system:win:id=37835fdcdfe2817ee22d6b161e54812fe95867fe https://vpn.mycompany.com/
```

--------------------------------

### Connect to AnyConnect/ocserv VPN

Source: https://www.infradead.org/openconnect/connecting.html

Run as root to initiate a connection to an AnyConnect or ocserv VPN server.

```bash
openconnect https://vpn.mycompany.com/
```

--------------------------------

### Connect to a GlobalProtect VPN

Source: https://www.infradead.org/openconnect/globalprotect.html

Initiate a connection to a GlobalProtect VPN server using the command line.

```bash
  openconnect --protocol=gp vpn.example.com

```

--------------------------------

### Run Test Suite

Source: https://www.infradead.org/openconnect/building.html

Execute the included test suite for OpenConnect. This requires ocserv, socket_wrapper, and uid_wrapper to be available.

```bash
make check
```

--------------------------------

### Pre-configure a tun device on Linux

Source: https://www.infradead.org/openconnect/nonroot.html

Command to create a persistent tun device that a specific user can access without elevated privileges.

```bash
# ip tuntap add vpn0 mode tun user dwmw2
```

--------------------------------

### Run OpenConnect with a custom script

Source: https://www.infradead.org/openconnect/vpnc-script.html

Use the --script argument to specify a custom routing script location instead of the default build-time configuration.

```bash
openconnect --script /etc/vpnc/vpnc-script https://vpn.example.com/
```

--------------------------------

### Connect to Juniper VPN

Source: https://www.infradead.org/openconnect/juniper.html

Initiate a connection to a Juniper VPN server using the Network Connect protocol.

```bash
  openconnect --protocol=nc vpn.example.com

```

--------------------------------

### Mimic Old Client for Certificate Issues

Source: https://www.infradead.org/openconnect/pulse.html

Use an older user agent string to resolve errors when a VPN requests but does not require a client certificate.

```bash
  ./openconnect --protocol=pulse --useragent "Pulse-Secure/3.0.0.0"
```

--------------------------------

### Connect to F5 SSL VPN

Source: https://www.infradead.org/openconnect/f5.html

Use the `--protocol=f5` option to connect to an F5 SSL VPN. This command initiates the connection to the specified BIG-IP server.

```bash
openconnect --protocol=f5 big-ip.example.com
```

--------------------------------

### Listing Private Keys with p11tool

Source: https://www.infradead.org/openconnect/pkcs11.html

Use p11tool to identify available private keys on a PKCS#11 token.

```bash
p11tool --list-privkeys --login pkcs11:manufacturer=piv_II
```

--------------------------------

### List all certificates on a token

Source: https://www.infradead.org/openconnect/pkcs11.html

Use `p11tool` with a PKCS#11 URI to list all certificates available on a specific token. Ensure the URI is quoted if it contains semicolons.

```bash
p11tool --list-all-certs 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29'
```

```bash
p11tool --list-all-certs pkcs11:manufacturer=piv_II
```

--------------------------------

### Connect to Array VPN

Source: https://www.infradead.org/openconnect/array.html

Initiate a connection to an Array Networks SSL VPN server using the specified protocol flag.

```bash
openconnect --protocol=array vpn.lon.softlayer.com
```

--------------------------------

### List PKCS#11 Tokens

Source: https://www.infradead.org/openconnect/pkcs11.html

Query available PKCS#11 modules and tokens using the p11tool utility.

```bash
p11tool --list-tokens
```

--------------------------------

### Connect to GlobalProtect VPN

Source: https://www.infradead.org/openconnect/connecting.html

Specify the protocol using the --protocol flag for non-AnyConnect VPN types.

```bash
openconnect --protocol=gp https://vpn.mycompany.com/
```

--------------------------------

### Run OpenConnect with Juniper Host Checker wrapper

Source: https://www.infradead.org/openconnect/tncc.html

Execute OpenConnect using a specific protocol, user agent, and the tncc-wrapper script to handle Host Checker requirements.

```bash
  ./openconnect --protocol=nc --useragent 'Mozilla/5.0 (Linux) Firefox' --csd-wrapper=trojans/tncc-wrapper.py vpn.example.com
```

--------------------------------

### Connect to Pulse VPN

Source: https://www.infradead.org/openconnect/pulse.html

Initiate a connection to a Pulse Connect Secure server using the pulse protocol.

```bash
  openconnect --protocol=pulse vpn.example.com
```

--------------------------------

### Connect with PKCS#11 URI

Source: https://www.infradead.org/openconnect/pkcs11.html

Use a PKCS#11 URI to specify a certificate or key for OpenConnect authentication.

```bash
openconnect -c _pkcs11:id=%01_ vpn.example.com
```

--------------------------------

### Wrap Key with IBM TPM2 Tool

Source: https://www.infradead.org/openconnect/tpm.html

Command to encrypt an existing key file for use with the TPM using the IBM tool.

```bash
create_tpm_key -w key_file.pem tpm_key.pem
```

--------------------------------

### Print cookie before connecting

Source: https://www.infradead.org/openconnect/manual.html

Use --printcookie to display the session cookie to standard output before initiating the VPN connection. This cookie can be used for subsequent operations, as explained with the --authenticate option.

```bash
openconnect --printcookie
```

--------------------------------

### Enable CSD Wrapper Execution

Source: https://www.infradead.org/openconnect/csd.html

Run the CSD wrapper script with restricted user privileges to mitigate security risks associated with executing server-provided binaries.

```bash
--csd-user=nobody --csd-wrapper=trojans/csd-wrapper.sh
```
Tokens:
Raw