23

I use openconnect in Ubuntu 16.04 terminally, when I want to run it, I need to enter three phases:

  • "yes/no"
  • "username"
  • "password"

How can I bypass above phases using openconnect in a line (e.g. using openconnect options)?
Are there any options for that such as the following line?

sudo openconnect <server-name> --user=<'username'> --pass=<'password'>

I used openconnect --help and found out a way to filling username, but I haven't any idea to filling password and SSL verification.

38

If you type man openconnect in a terminal you will get a manual page describing usage.

Relevant sections:

-u,--user=NAME
Set login username to NAME

--passwd-on-stdin
Read password from standard input

Additionally, you may need to disable certificate warnings:

--no-cert-check
Do not require server SSL certificate to be valid. Checks will still happen and failures will cause a warning message, but the connection will continue anyway. You should not need to use this option - if your servers have SSL certificates which are not signed by a trusted Certificate Authority, you can still add them (or your private CA) to a local file and use that file with the --cafile option.

Or you could add the certificate to a file.

All this can be combined:

echo "password" | sudo openconnect server --user=username --passwd-on-stdin --no-cert-check
2
  • 8
    The answer above is still correct except for --no-cert-check which has been removed due to security risks. This is the error message now when using it: The --no-cert-check option was insecure and has been removed. Fix your server's certificate or use --servercert to trust it. (can't comment above because not enough points; mods feel free to clear this up) – movAX13h Dec 18 '18 at 14:21
  • Seems like if they prompt for 2FA it goofs up the response code if you do --passwd-on-stdn – Mark Jan 5 at 17:10
4

This works for me:

echo mypassword | openconnect --protocol=anyconnect --user=myusername --passwd-on-stdin 
1
  • yep, this works if the server does not require a certificate. You can also omit --protocol=anyconnect since it's the default value anyway. – Wlad Feb 1 at 13:17
2

To skip the certificate check, The --no-cert-check parameter was removed in new versions. You can use --servercert instead.

--servercert sha256:sdflkdsjflsdjkfds

1
  • 1
    Actually, I don't have any server certification, in this new version how can I bypass it? – Benyamin Jafari Jan 10 at 11:46
1

I was able to automate both sudo password, VPN user, VPN password and secondary challenge using the following command (tested on mac):

challange=<code> && sudo -S <<< "<sudo_password>" echo I am super user && { printf '<vpn_password>\n'; sleep 1; printf "$challange\n"; } | sudo openconnect <server_name> --user <vpn_username> --passwd-on-stdin
3
  • What's the <code>? – Benyamin Jafari Nov 19 '20 at 8:10
  • <code> is some code/number you get from a 2-Factor Authentication (2FA) service. In my case its a smartphone application with some rotating number. – dux2 Nov 19 '20 at 10:43
  • This worked perfectly fine with my MFA. One change that I made was, create a sh file and pass the MFA code as an arg to it Change in script: `challange="$1" ScriptName: vpn.sh terminal: ./vpn,sh <code> – Sniper Dec 28 '20 at 5:50
0

You can try this very easy to use shell script: https://github.com/sorinipate/vpn-up-for-openconnect

From the project's description:

vpn-up-for-openconnect

VPN Up for OpenConnect

Features

A shell script for openconnect which allows:

  • to define multiple VPN connections
  • to run openconnect without entering the username and password.

Sample configuration section

#Company VPN
export COM_NAME="My Company VPN"
export COM_HOST=vpn.mycompany.com
export COM_AUTHGROUP=developers
export COM_USER=sorin.ipate
export COM_PASSWD="MyPassword"

Run VPN Up

% alias vpn-up='~/bin/vpn-up.command'
% vpn-up
0
echo "YourPassword" | sudo openconnect vpn.yourserver.com --user=yourUseraname --passwd-on-stdin
  • For me password needs " "
  • In the latest version --no-cert-check is deprecated from the command argument by openconnect (my version: OpenConnect version v7.08-3ubuntu0.18.04.2)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.