Shiga Cisco Secure Client daga harsashin Linux, ba tare da GUI ba

An yi imani cewa here-document mai layi huɗu shine cikakkiyar shiga mara mu’amala, kuma hakan na tsayawa har sai ƙofar ta ba da ƙungiyoyi biyu, ta buga banner, ko ta nemi token bayan kalmar sirri. Sannan wannan script ɗin ya rubuta kalmar sirri cikin menu da ke jiran lamba. Ana iya rubuta script don abokin ciniki na layin umarni a Linux, amma kawai idan ka ba shi abin da yake jira da gaske, ba abin da koyarwar ta ɗauka ba.

Here-document ɗin da aka kayyade tatsuniya ce

Abokin ciniki na Linux na Cisco yana shigar da ƙaramin shiri a /opt/cisco/anyconnect/bin/vpn, kuma Secure Client 5 har yanzu yana kawo shi. Yayin da sabis ɗin vpnagentd ke gudana, tuta -s tana karanta amsoshi daga shigarwar daidaitacce a tsarin da abokin ciniki ke tambayarsu. Wannan tsari ba shi da ƙayyade tsakanin sabobin.

Menu na ƙungiya yana ƙara layi ɗaya. Banner na shiga yana ƙara wani. Neman token bayan kalmar sirri yana karya script mai layi huɗu gaba ɗaya, saboda layi na biyar ba zai taɓa zama token ba. Rashin yana shiru: abokin ciniki yana samun kirtani mara kyau, yunƙurin haɗi yana ƙarewa, kuma script ɗin ba ya ba da labarin wani abu mai amfani.

Gudanar da abokin ciniki da hannu sau ɗaya a kan wannan ƙofa da sigar, sannan ka rubuta tambayoyin a tsarin da suke zuwa. Wannan rikodin shine ƙayyadaddun da script ɗinka dole ya cika.

Abin da abokin ciniki ke jira

A cikin al’ada na ƙungiya ɗaya, tsarin shine sunan mai amfani, kalmar sirri, da wani lokacin tabbatar da banner. Layin farko na here-document yana zama alamar menu ne kawai lokacin da uwar garken ya nuna menu da gaske, wanda shine dalilin da yasa wannan script ɗin ke aiki a wani wuri kuma ya kasa a na gaba.

/opt/cisco/anyconnect/bin/vpn -s connect vpn.example.net <<EOF
0
alice
$VPN_PASSWORD
y
EOF

Karanta wannan a matsayin amsoshi huɗu ga tambayoyi huɗu masu yiwuwa, ba a matsayin ƙayyadadden yarjejeniya ba. Sifili zaɓin menu ne, ba kalmar sirri ba, kuma y na ƙarshe yana karɓar banner da yawancin ƙofofi ba sa turawa.

Yi amfani da expect lokacin da tsari ba zai iya hasashe ba

Lokacin da tsarin tambayoyin ya bambanta, daina kirga layuka kuma jira tambayar maimakon. Script ɗin expect yana ƙaddamar da umarnin connect, yana jira tambayar sunan mai amfani, yana aikawa, yana jira tambayar kalmar sirri, yana aikawa, sannan yana jira yanayin haɗe. Kowace jira tana da nata iyakacin lokaci.

Ɗauki ƙarewar lokaci a matsayin gazawa kuma fita. Script ɗin da ya ci gaba da aika shigarwa bayan tambayar da ba a zata ba zai rubuta kalmar sirri cikin harsashi, menu, ko duk wani abu da ke karantawa. Haka script ɗin shiga ke zama lamari.

expect kuma yana ba ka rikodin da za ka iya adanawa ba tare da asirin ba, kuma wannan ya fi ƙimar lambar fita amfani lokacin da ƙofa ta canza tambayoyinta bayan haɓakawa.

Dole asirin ya zauna wani wuri

Kowane sigar wannan matsala tana da rauni ɗaya: dole kalmar sirri ta kasance a cikin sigar da abokin ciniki zai iya karantawa. Ba da ita a matsayin hujja yana fallasa ta a teburin tsari. Maimaita ta ta bututu yakan saka ta cikin tarihin harsashi. Dukansu ana iya karantawa daga wasu masu amfani na gida a kan uwar garken tsalle da aka raba.

install -m 600 /dev/null ~/.vpn-secret
umask 077; VPN_PASSWORD=$(cat ~/.vpn-secret) /opt/cisco/anyconnect/bin/vpn -s connect vpn.example.net

Fayil mai yanayi 600 mallakar asusun shine mafi ƙaranci, kuma har yanzu asiri ne a rubutu bayyananne a faifai. secret-tool lookup yana karantawa daga zoben maɓalli na Linux, kuma a macOS security find-generic-password -w yana yin wannan aikin. Inda ƙungiyar ke goyon bayan tabbatarwa da takardar shaidar ko SAML, fifita shi, saboda kalmar sirri da aka adana tare da MFA har yanzu ba za su iya kammala shiga ba tare da mutum ba.

Tabbatar da rami, sannan ka mallaki rufewa

Kada ka dogara da rashin rubutun kuskure. Tambayi abokin ciniki game da yanayinsa kuma duba ma’aunin daban:

/opt/cisco/anyconnect/bin/vpn state
ip -brief address

Yanayin ya kamata ya karanta Connected, kuma ma’aunin rami ya kamata ya sami adireshi. Sannan nemi albarkatu ɗaya da ramin ya kamata ya isa, saboda yanayin haɗe ba tare da hanya ba sakamako ne na gaske kuma mai sauƙin mantawa.

Katse haɗi da vpn disconnect, kuma bari script ɗin da ya fara ramin ya ɗauki rufewa. Aikin da ya gaza wanda ya bar zama a buɗe yana cinye wurin lasisi kuma yana kama da matsalar tabbatarwa ga wanda zai gwada na gaba.

Tsarin aiki: tabbatar da vpnagentd, kama ainihin tsarin tambayoyin, zaɓi here-document ko expect, riƙe asirin daga argv da tarihi, tabbatar da yanayi da albarkatu ɗaya, sannan ka katse haɗi a cikin wannan script ɗin.