HOWTO set up Juniper Network Connect VPN on Ubuntu Dapper

[WockaNation]

very new to Linux, trying to get my works Juniper VPN working. found this http://mad-scientist.net/junipernc (very helpful, btw) but I am still having issues. I saw a comment from a few months back that you updated the script to not check hostname - my work doesn't have a hostname, just an IP that I browse to - but whenever I try to run the script it says "Cannot resolve hostname xx.xxx.xxx.xxx. Please try again." anyone have any idea?

[DevinD]

Ah ha, i worked out that the 'jar' program not installed was becaused i forgot to install the sun-java6-jdk package. I've now managed to get it working in that it opens network connect and connects me to the vpn, however i seem to be nothing more than 'connected' on the network connect applet - i still can not do anything over the vpn.

I've tried ssh-ing to the server i need to get into, and i've tried looking it up using 'host', but it can't find the hostname. I've fiddled with resolv.conf again to see if it'll fix it, it didn't. I've tried again to ssh using the ip address directly, but still no joy..and still it says 0 bytes sent and received.

[DevinD]

Oh, in the end i seem to have answered my own questions. I noticed that I couldn't ping anyone in the vpn either, so i had a scout to see if there were any forum topics about ping not working, and there were. Basically my iptables was a bit strict. If anyone has the same problem, see http://www.issociate.de/board/post/1..._messages.html
Sorry for my seemingly pointless input into this topic...i guess 3 days of trying to get something to work sometimes pays off

[madscientist]

very new to Linux, trying to get my works Juniper VPN working. found this http://mad-scientist.net/junipernc (very helpful, btw) but I am still having issues. I saw a comment from a few months back that you updated the script to not check hostname - my work doesn't have a hostname, just an IP that I browse to - but whenever I try to run the script it says "Cannot resolve hostname xx.xxx.xxx.xxx. Please try again." anyone have any idea?

The script looks at the hostname and if it contains any characters other than numbers or periods, it assumes it's a hostname. I've tested this and it works for me. If you double-check this and it still doesn't work let me know and I'll tell you how to get more debugging information out.

[WockaNation]

The script looks at the hostname and if it contains any characters other than numbers or periods, it assumes it's a hostname. I've tested this and it works for me. If you double-check this and it still doesn't work let me know and I'll tell you how to get more debugging information out.

Thanks, I'll try to do this again when I get home from work today, and I'll post the results.

[WockaNation]

I have attached a screenshot of the message I get when I enter the IP address of my VPN connection. Still not working unfortunately.

[PerJ]

In previous posts, people have said they need "two" passwords, but then they list username/realm/password... what's the "other" password?

Is anyone in this situation able to connect at all, even with the web interface? If you can then one thing you can try is replacing the ncsvc application with a simple shell script that just prints its arguments to a temporary file... that's a simple way to find out how the command is being invoked, and how the passwords/etc. you are entering into the web interface are being passed to the command. If you can connect via the web and want more help with this, let me know.

As a couple of others have reported, I am also able to use the web interface to connect, but not by invoking Network Connect from your script (getting the "Incorrect credentials" error).
I use username, password (AD password) and securetoken + PIN to connect on the web. I'm sure the realm from the webpage gets passed along as an argument as well.

Replacing the ncsvc application with a script for logging the arguments being passed to it, does not work, as a new application seems to be installed when invoking Network Connect.
If there are any alternative methods of getting the parameters passed to the ncsvc, I would happily try them out...

[PerJ]

Okay, so searching for more information on this subject, led me to this site: juniper-vpn-64-bit-linux-an-unsolved-mystery.

It seems that the information one uses to log in to the webservice, gets validated and subsequently stored as a DSID cookie. And it is this cookie that is passed along when invoking Network Connect.

Unfortunately it is not straight forward to pass on the information from this cookie when starting Network Connect manually. The short story is that libncui.so needs to be converted to an executable, where you can pass this argument with the -c flag.
The bonus is that this can also enable NC to be utilized directly from a 64-bit environment.

Alas, I am not succesful in my attempts to run the executable.
It fails with the following errormessage:

./ncui: error while loading shared libraries: libncui.so: cannot open shared object file: No such file or directory

If anyone more adept in the fine art of C hacking, than I am myself, were to take a stab at making this work. I would appreciate if they would post their findings in this thread.

[josephellengar]

I just did everything exactly as instructed: http://mad-scientist.net/juniper.htmlpam_authenticate: Conversation error

I received the following error and it failed:

Run as: /usr/bin/junipernc.sh 
sudo: pam_authenticate: Conversation error

Any ideas? Thanks for the great script. I really needed to get this set up. I'm on 64bit karmic.

[josephellengar]

I just did everything exactly as instructed: http://mad-scientist.net/juniper.htmlpam_authenticate: Conversation error

I received the following error and it failed:

Run as: /usr/bin/junipernc.sh 
sudo: pam_authenticate: Conversation error

Any ideas? Thanks for the great script. I really needed to get this set up. I'm on 64bit karmic.

Ok, I figured this out, but now I'm getting another error: unable to connect to IVE. I've followed all of the directions to the letter.