Ukungena ku-Cisco Secure Client kusuka ku-shell ye-Linux, ngaphandle kwe-GUI

Inkolelo ukuthi i-here-document enemigqa emine ukungena okuphelele okungasebenzisani, futhi lokho kuhlala kuze kube yilapho i-gateway inikeza amaqembu amabili, iphrinta ibhanela, noma icela ithokheni ngemva kwephasiwedi. Ngaleso sikhathi iskripthi esifanayo sibhala iphasiwedi kumenyu obelindele inombolo. Ikhleyenti yomugqa womyalo ku-Linux iyaskripthwa, kodwa kuphela uma uyinika lokho ekulindele ngempela, hhayi lokho okucatshangwa yisiqondiso.

I-here-document engaguquki iyinganekwane

Ikhleyenti ye-Linux yakwa-Cisco ifaka uhlelo oluncane ku-/opt/cisco/anyconnect/bin/vpn, futhi i-Secure Client 5 isayihambisa. Ngesikhathi isevisi ye-vpnagentd isebenza, ifulegi -s lifunda izimpendulo kusuka kokokufaka okujwayelekile ngokulandelana okucelwa yikhleyenti. Lokho kulandelana akuguquki phakathi kwamasiphuli.

Imenyu yeqembu yengeza umugqa owodwa. Ibhanela lokungena yengeza omunye. Isicelo sethokheni ngemva kwephasiwedi sidiliza ngokuphelele iskripthi semigqa emine, ngoba umugqa wesihlanu wawungeke ube ithokheni. Ukwehluleka kuthule: ikhleyenti ithola uchungechunge olungalungile, umzamo wokuxhuma uphela, futhi iskripthi asibiki lutho olusizo.

Sebenzisa ikhleyenti ngesandla kanye ngokumelene ne-gateway efanayo nenguqulo efanayo, bese ubhala phansi imibuzo ngokulandelana evela ngakho. Lowo mbhalo uyisicaciso okufanele iskripthi sakho sisifeze.

Ikhleyenti ilindeleni

Esimweni esijwayelekile seqembu elilodwa, ukulandelana igama lomsebenzisi, iphasiwedi futhi ngezinye izikhathi ukuqinisekiswa kwebhanela. Umugqa wokuqala we-here-document uba yinkomba yemenyu kuphela lapho isiphuli sikhombisa imenyu ngempela, yingakho iskripthi esifanayo sisebenza endaweni eyodwa futhi sehluleke kwelandelayo.

/opt/cisco/anyconnect/bin/vpn -s connect vpn.example.net <<EOF
0
alice
$VPN_PASSWORD
y
EOF

Funda lokhu njengezimpendulo ezine zemibuzo emine engaba khona, hhayi njengephrothokholi engaguquki. Uziro ukukhetha kwemenyu, hhayi iphasiwedi, futhi u-y wokugcina wamukela ibhanela iziphuli eziningi ezingalokothi zilithumele.

Sebenzisa i-expect lapho ukulandelana kungabikezelwa

Lapho ukulandelana kwemibuzo kushintsha, yeka ukubala imigqa futhi ulinde umbuzo. Iskripthi se-expect siqala umyalo we-connect, silinde umbuzo wegama lomsebenzisi, sithumele, silinde umbuzo wephasiwedi, sithumele, bese silinde isimo esixhunyiwe. Ukulinda ngakunye kunesikhathi sako sokuphelelwa.

Thatha ukuphelelwa kwesikhathi njengokwehluleka bese uphuma. Iskripthi esiqhubeka sithumela okokufaka ngemva kombuzo ongalindelekile sizobhala ngokujabulisa iphasiwedi ku-shell, kumenyu noma kunoma yini enye efundayo. Yileyo ndlela iskripthi sokungena esiba yisigameko.

I-expect ikunikeza futhi umbhalo ongawugcina ngemva kokususa imfihlo, futhi lokho kubaluleke kakhulu kunekhodi yokuphuma lapho i-gateway ishintsha imibuzo yayo ngemva kokuthuthukiswa.

Imfihlo kufanele ihlale endaweni ethile

Inguqulo ngayinye yale nkinga inobuthakathaka obubodwa: iphasiwedi kufanele ibe khona ngendlela ikhleyenti engayifunda. Ukuyidlulisa njenge-agumenti kuyiveza kuthebula lezinqubo. Ukuyiphinda ngombhoshongo kuvame ukuyifaka emlandweni we-shell. Kokubili kufundwa abanye abasebenzisi basendaweni kusiphuli sokugxuma esabiwe.

install -m 600 /dev/null ~/.vpn-secret
umask 077; VPN_PASSWORD=$(cat ~/.vpn-secret) /opt/cisco/anyconnect/bin/vpn -s connect vpn.example.net

Ifayela elinemodi engu-600 eliphethwe yi-akhawunti liyingcosane, futhi lisayimfihlo yombhalo ocacile kudiski. I-secret-tool lookup ifunda ku-keyring ye-Linux, kanti ku-macOS umsebenzi ofanayo wenziwa yi-security find-generic-password -w. Lapho inhlangano isekela ukuqinisekiswa ngesitifiketi noma nge-SAML, khetha lokho, ngoba iphasiwedi egciniwe kanye ne-MFA noma kunjalo akukwazi ukuqedela ukungena ngaphandle komuntu.

Qinisekisa ithaneli, bese uthatha umthwalo wokunqamula

Ungathembi ukungabikho kombhalo wephutha. Buza ikhleyenti ngesimo sayo futhi uhlole isixhumanisi ngokuzimela:

/opt/cisco/anyconnect/bin/vpn state
ip -brief address

Isimo kufanele sifunde i-Connected, futhi isixhumanisi sethaneli kufanele sibe nekhileli. Bese ucela insiza eyodwa ithaneli okufanele ifinyelele kuyo, ngoba isimo esixhunyiwe esingenayo indlela siwumphumela wangempela futhi kulula ukusiphuthelwa.

Nqamula nge-vpn disconnect, futhi vumela iskripthi esiqale ithaneli sithathe umthwalo wokunqamula. Umsebenzi ohlulekile oshiya isikhathi sivuliwe udla isihlalo selayisense futhi ubonakala njengenkinga yokuqinisekisa kumuntu olandelayo ozamayo.

Ukulandelana komsebenzi: qinisekisa i-vpnagentd, rekhoda ukulandelana kwemibuzo kwangempela, khetha i-here-document noma i-expect, gcina imfihlo ngaphandle kwe-argv nomlando, qinisekisa isimo nensiza eyodwa, bese unqamula kuleso skripthi.