I can no longer connect to our VPN server and work from home. Today the server suddenly asks me to run a 'Cisco Secure Desktop' trojan, and I've configured OpenConnect to do this (both via a GUI dialog, and the --csd-user command line option to openconnect), still I'm no longer able to get the VPN connection working.
The VPN connection log ends with these four lines repeated over and over again:
GET https://vpn.server.com/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
Do you have any idea about what's happening or how I can fix this?
Would you guess that the problem is a VPN server side configuration change? The 'Cisco Secure Desctop' script perhaps? The VPN server has never asked me to run the 'Cisco Secure Desktop' script before, when I was able to connect. — Or do you think my OS has upgraded OpenConnect to a somehow incompatible version?
"Refreshing .../sdesktop/wait.html", what's that, why? And +CSCOE+, sounds weird.
My OS: Linux Mint 17. OpenConnect version v5.02. Other people are able to connect to the VPN server — they use Mac or Windows, not Linux, though.
Here's the full OpenConnect log:
POST https://vpn.server.com/
Attempting to connect to server 111.222.333.444:443
Using client certificate 'My-Full-Name'
Adding supporting CA 'TC TrustCenter Class 2 L1 CA XI'
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Got HTTP response: HTTP/1.0 302 Object Moved
GET https://vpn.server.com/
Attempting to connect to server 111.222.333.444:443
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Got HTTP response: HTTP/1.0 302 Object Moved
GET https://vpn.server.com/+webvpn+/index.html
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
GET https://vpn.server.com/CACHE/sdesktop/install/binaries/sfinst
GET https://vpn.server.com/+CSCOE+/sdesktop/wait.html
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET https://vpn.server.com/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET https://vpn.server.com/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET https://vpn.server.com/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET https://vpn.server.com/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.server.com
Connected to HTTPS on vpn.server.com
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
(... continues forever)
Edit With the -v (verbose) flag, openconnect keeps repeating these lines:
$ openconnect -v -c cert.pem --csd-user=kajmagnus vpn.example.com
...
GET https://vpn.example.com/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.example.com
Connected to HTTPS on vpn.example.com
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Close
Date: Thu, 06 Nov 2014 11:10:18 GMT
HTTP body chunked (-2)
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
- A@achara
Try wrapping the 'Cisco Secure Desktop' script in a shell script, via the
--csd-wrapperoption, like so:#!/bin/bash -x exec 2>&1 > /dev/null CSD_BINARY="$1" shift $CSD_BINARY "$@"You can read more here -- apparently there's something wrong about how OpenConnect calls the binary.
- TIn reply toMagnus⬆:Thamas Davis @thamas
You could try adding
--no-xmlpost. It makes OpenConnect behave more like older versions, maybe some compatibility issue.- NNovica Jajcanin @Novica
Nobody knkws this...
- C@coolio312
Interesting
- C@coolio312
How many levels
- In reply tothamas⬆:GRobe tus @Gdjwjd
- K@KajMagnus
Twitter tweet embeds will work soon, in 1 or 2 weeks (mostly just code review left now).
- KKhotso Mphale @KekkelApp
Testing reply..Testing trply
- YIn reply toMagnus⬆:Ying Yue @ying
Are you using the Cisco Secure Desktop trojan? You may need 32-bit libraries for it, if your OS is 64 bit. Here's how to add that: https://wiki.debian.org/FAQsFromDebianUser#Multiarch
- AIn reply toMagnus⬆:Arjana Mwanaj @arjana
The VPN server no longer supports Linux. You can run Windows in a virtual machine, and login and work from home, in the VM. Here're our Windows installers: //nfs02/os/win11/iso/
Thanks, this works. I've logged in via Windows in a VM and I'm working from home again now. But why isn't Linux supported any longer?
- AArjana Mwanaj @arjana
Company wide policy. Only Windows and Mac allowed in the future, someone has decided that the company cannot support other OSes for security reasons
- QLafif Astahdziq @qutek
tes
- D2In reply toMagnus⬆:Sem Spiri @doomstar
I logged in with google, but had to refresh the page because it was showing me the error about unable to load editor. I didn't make a screenshot though
- D2
- D2Sem Spiri @doomstar
lol
- Progress
testing screenshot capability