-
Notifications
You must be signed in to change notification settings - Fork 10
/
Copy pathopenconnect.sh
executable file
·150 lines (125 loc) · 5.94 KB
/
openconnect.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
#!/bin/bash
# Credit for original concept and initial work to: Jesse Jarzynka
#
# Updated by: Ventz Petkov (11-08-23)
# * Modified VPN_EXECUTABLE default path due to dir change within `brew` on M-series Macs (m1, m2, m3) to /opt/homebrew/
# * Modified sudoers to reflect new openconnect VPN_EXECUTABLE path
# * Cleaned up KeyChain instructions around KeyChain Item name vs Account Name
#
# Updated by: Ventz Petkov (7-25-23)
# * added useragent for AnyConnect (needed for recent deployments)
# * added "VPN_GROUP" option, which is replacing the phased out "#VPN_TUNNEL_OPTIONALLY" within the "VPN_USERNAME"
# Updated by: Ventz Petkov (8-31-18)
# * merged feature for token/pin input (ex: Duo/Yubikey/Google Authenticator) contributed by Harry Hoffman <[email protected]>
# * added option to pick "push/sms/phone" (ex: Duo) vs token/pin (Yubikey/Google Authenticator/Duo)
# Updated by: Ventz Petkov (11-15-17)
# * cleared up documentation
# * incremented 'VPN_INTERFACE' to 'utun99' to avoid collisions with other VPNs
# Updated by: Ventz Petkov (9-28-17)
# * fixed for Mac OS X High Sierra (10.13)
# Updated by: Ventz Petkov (7-24-17)
# * fixed openconnect (did not work with new 2nd password prompt)
# * added ability to work with "Duo" 2-factor auth
# * changed icons
# <bitbar.title>VPN Status</bitbar.title>
# <bitbar.version>v1.1</bitbar.version>
# <bitbar.author>Ventz Petkov</bitbar.author>
# <bitbar.author.github>ventz</bitbar.author.github>
# <bitbar.desc>Connect/Disconnect OpenConnect + show status</bitbar.desc>
# <bitbar.image></bitbar.image>
#########################################################
# USER CHANGES #
#########################################################
# 1.) Updated your sudo config with (edit "mac-username" with your username):
# (NOTE: You can obtain the "mac-username" with "whoami" in a terminal)
#mac-username ALL=(ALL) NOPASSWD: /opt/homebrew/bin/openconnect
#mac-username ALL=(ALL) NOPASSWD: /usr/bin/killall -2 openconnect
# 2.) Make sure openconnect binary is located here:
# (If you don't have it installed: "brew install openconnect")
VPN_EXECUTABLE=/opt/homebrew/bin/openconnect
# 3.) Update your AnyConnect VPN host
VPN_HOST="vpn.domain.tld"
# NOTE: If you are using a VPN_GROUP (ex: domain.tld/group) -- use this, instead of "#VPN_TUNNEL" within VPN_USERNAME
VPN_GROUP="VPN_GROUP_TUNNEL_OPTIONALLY"
# 4.) Update your AnyConnect username + tunnel
# NOTE: If you are NOT using the VPN_GROUP, set it to empty, and use "#VPN_TUNNEL" within the VPN_USERNAME
VPN_USERNAME="[email protected]#VPN_TUNNEL_OPTIONALLY"
# 5.) Push 2FA (ex: Duo), or Pin/Token (ex: Yubikey, Google Authenticator, TOTP)
PUSH_OR_PIN="push"
#PUSH_OR_PIN="Yubikey"
# ---
# * For Push (and other Duo specifics), options include:
# "push", "sms", or "phone"
# ---
# * For Yubikey/Google Authenticator/other TOTP, specify any name for prompt:
# "any-name-of-product-to-be-prompted-about"
# PUSH_OR_PIN="Yubikey" | PUSH_OR_PIN="Google Authenticator" | PUSH_OR_PIN="Duo"
# (essentially, anything _other_ than the "push", "sms", or "phone" options)
# ---
# 6.) Create an encrypted password entry in your OS X Keychain:
# a.) Open "Keychain Access" and
# b.) Click on "login" keychain (top left corner)
# c.) Click on "Passwords" category (bottom left corner)
# d.) From the "File" menu, select -> "New Password Item..."
# e.) For "Keychain Item Name" "VPN_HOST" (ex: vpn.domain.tld)
# f.) For "Account Name" use the value for "VPN_USERNAME" (ex: [email protected])
# g.) For "Password" enter your VPN AnyConnect password.
# This will retrieve that password securely at run time when you connect, and feed it to openconnect
# No storing passwords unenin plain text files! :)
GET_VPN_PASSWORD="security find-generic-password -wl $VPN_HOST"
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# END-OF-USER-SETTINGS #
#########################################################
VPN_INTERFACE="utun99"
# Command to determine if VPN is connected or disconnected
VPN_CONNECTED="/sbin/ifconfig | grep -A3 $VPN_INTERFACE | grep inet"
# Command to run to disconnect VPN
VPN_DISCONNECT_CMD="sudo killall -2 openconnect"
# GUI Prompt for your token/key (ex: Duo/Yubikey/Google Authenticator)
function prompt_2fa_method() {
if [ "$1" == "push" ]; then
echo "push"
elif [ "$1" == "sms" ]; then
echo "sms"
elif [ "$1" == "phone" ]; then
echo "phone"
else
osascript <<EOF
tell app "System Events"
text returned of (display dialog "Enter $1 token:" with hidden answer default answer "" buttons {"OK"} default button 1 with title "$(basename $0)")
end tell
EOF
fi
}
case "$1" in
connect)
VPN_PASSWORD=$(eval "$GET_VPN_PASSWORD")
# VPN connection command, should eventually result in $VPN_CONNECTED,
# may need to be modified for VPN clients other than openconnect
# Connect based on your 2FA selection (see: $PUSH_OR_PIN for options)
# For anything else (non-duo) - you would provide your token (see: stoken)
echo -e "${VPN_PASSWORD}\n$(prompt_2fa_method ${PUSH_OR_PIN})\n" | sudo "$VPN_EXECUTABLE" --useragent=AnyConnect -u "$VPN_USERNAME" -i "$VPN_INTERFACE" "$VPN_HOST/$VPN_GROUP" &> /dev/null &
# Wait for connection so menu item refreshes instantly
until eval "$VPN_CONNECTED"; do sleep 1; done
;;
disconnect)
eval "$VPN_DISCONNECT_CMD"
# Wait for disconnection so menu item refreshes instantly
until [ -z "$(eval "$VPN_CONNECTED")" ]; do sleep 1; done
;;
esac
if [ -n "$(eval "$VPN_CONNECTED")" ]; then
echo "VPN 🔒"
echo '---'
echo "Disconnect VPN | bash='$0' param1=disconnect terminal=false refresh=true"
exit
else
echo "VPN ❌"
# Alternative icon -> but too similar to "connected"
#echo "VPN 🔓"
echo '---'
echo "Connect VPN | bash='$0' param1=connect terminal=false refresh=true"
# For debugging!
#echo "Connect VPN | bash='$0' param1=connect terminal=true refresh=true"
exit
fi