HOWTO set up Juniper Network Connect VPN on Ubuntu Dapper

[madscientist]

Hi all; I'm surprised that you were seeing an issue with 32bit/64bit with my script (or were you not using my script)?

A while ago I added code to my script to detect this problem and suggest the solution; if you try to invoke the script and it can only find a 64bit java it will give you an error message:

The Network Connect GUI needs a 32-bit Java
Ignoring 64-bit Java from $PATH (/usr/bin/java)

Then it will give you a file chooser dialog asking you to find a 32bit java. If you quit or cancel it will say:

Cannot locate valid 32-bit Java.
Please install it with your package manager
or run junipernc with the '-nojava' flag.

So, at least for junipernc, you don't need to replace the java application. Once the script finds a 32bit java it will remember where it is and always use it when invoking Network Connect.

The problem with replacing the java binary with a script like this is that when your package updates it will overwrite that binary and you'll have to do it again. Personally I don't like that solution.

Also I just put up a new version of the script that allows a special URL for connections, for those that need it.

[Rkcrawl]

Anyone have any success with this script on 11.10 and Firefox 7.0.1?
I had jnc working well until the 11.10 upgrade and am now having trouble getting it working again.

The script is called and uses the 32 bit version of java, but I don't get the nc dialog, nor a tunnel.

[madscientist]

Anyone have any success with this script on 11.10 and Firefox 7.0.1?
I had jnc working well until the 11.10 upgrade and am now having trouble getting it working again.

The script is called and uses the 32 bit version of java, but I don't get the nc dialog, nor a tunnel.

If you use my script then you don't use FireFox at all so the version of FireFox should not be an issue. I'm not using the latest Ubuntu yet but so far I've never seen a new version of Ubuntu break things.

What exactly happens? The script seems to be running (you don't get an exit dialog) but you don't have a tunnel? Or something else?

I've just uploaded a new version 1.16 which dumps the Network Connect output to a log file in /tmp.

Also you can try running it from the CLI and see if anything is printed. And you can try running with the "-nojava" and/or "-nogui" options (-nogui implies -nojava) and see if you get any more information on what the issue is.

[Rkcrawl]

If you use my script then you don't use FireFox at all so the version of FireFox should not be an issue. I'm not using the latest Ubuntu yet but so far I've never seen a new version of Ubuntu break things.

What exactly happens? The script seems to be running (you don't get an exit dialog) but you don't have a tunnel? Or something else?

I've just uploaded a new version 1.16 which dumps the Network Connect output to a log file in /tmp.

Also you can try running it from the CLI and see if anything is printed. And you can try running with the "-nojava" and/or "-nogui" options (-nogui implies -nojava) and see if you get any more information on what the issue is.

By script, I was referring to the script posted by dvo one page back. However I did try your script earlier today, I'll give it another spin and provide feedback. Thanks.

[Rkcrawl]

By script, I was referring to the script in the original post. However I did try your script earlier today, I'll give it another spin and provide feedback. Thanks.

SOLVED: The script in this thread posted by dvo works on ubuntu 11.10, AFTER, I installed ia32-libs:

"sudo apt-get install ia32-libs"

32-bit java was unhappy about a library in the wrong ELF format: libXtst.

Madscientist, I did give your script a try and it is what clued me into the library issue. It still failed after I updated the library, but that is likely because I hadn't configured the realm.

[dvo]

Hi all; I'm surprised that you were seeing an issue with 32bit/64bit with my script (or were you not using my script)?

A while ago I added code to my script to detect this problem and suggest the solution;

Hi Madscientist, I was not aware that your your script solved the 32-/64-bit issue in essentially the same way as I did with my simple switcher script.

if you try to invoke the script and it can only find a 64bit java it will give you an error message:

The Network Connect GUI needs a 32-bit Java
Ignoring 64-bit Java from $PATH (/usr/bin/java)

Then it will give you a file chooser dialog asking you to find a 32bit java.

I just downloaded the latest version of your script and gave it a try again. At first, I tried giving the full path of the Java binary itself, but then I found the file chooser disabling the "Ok" button, until I realized that one is supposed to provide the path of the 32-bit JRE, which in my case is /usr/lib/jvm/ia32-java-6-sun/jre .

So, at least for junipernc, you don't need to replace the java application. Once the script finds a 32bit java it will remember where it is and always use it when invoking Network Connect.

Correct. Yet your script does not work in cases like mine where the user is not authenticated by username, realm and password, but using a hardware token (smart card). In such cases, the co-operation of the browser is needed, in order to access the smart card. (Ok, in principle one could access the smart card also directly, e.g. using an openssl plugin, but this is non-trivial.)

The problem with replacing the java binary with a script like this is that when your package updates it will overwrite that binary and you'll have to do it again. Personally I don't like that solution.

I am aware of this minor drawback of my script, but on the other hand this is the only solution I found that both supports smart card based user authentication and is straightforward to implement.

Regards, David

http://ddvo.net/

[AutoStatic]

Hello all,

Anybody any idea where these errors come from?

20111118202721.627033 ncsvc[p4263.t4264] worker.error connect to myhostname:443 failed. IVE returned error 20001069 (ncp_dsssl.cpp:1062)
20111118202721.627267 ncsvc[p4263.t4263] ncphandler.info control channel disconnected due to error 20001069, reconnecting (ncphandler.cpp:335)

These errors appear on both 10.04 and 11.10 with Sun Java 6 (10.04) and Oracle Java 7 (11.10) when using the junipernc script or running ncsvc/NC.jar directly.

./ncsvc --version
Juniper Network Connect Server for Linux.
Version : 7.1
Release Version : 7.1-0-Build19525
Build Date/time : Oct 11 2011 00:51:15
Copyright 2001-2010 Juniper Network

Thanks in advance!

Jeremy

Edit: JSAM is disabled so I'm not allowed to use the Network Connect functionality.

[joseluisbcn]

Hello.

I am the system administrator in one university.

We would need to use the Network Connect with Ubuntu 10.04 clients. In certain machines it works without problems but in others, it fails. When I use the script Mad Scientist the popup says "Connecting to NCSVC" but doesn't say anymore. The timeout arrives at 22 seconds and it disappears, saying "Aborted". No log to the user, and the last lines in "~/.juniper-networks/ncui.log" are:

20111121205922.185223 ncui[p6343.t6366] dsclient.info --> GET /dana/home/starter0.cgi?check=yes (authenticate.cpp:179)
20111121205922.600307 ncui[p6343.t6366] dsclient.info <-- 200 (authenticate.cpp:211)
20111121205922.600501 ncui[p6343.t6366] authStateLogin.info starter0.cgi has asked for tz_offset parameter (authenticate.cpp:372)
20111121205922.600637 ncui[p6343.t6366] authStateLogin.info starter0.cgi has asked for clienttime parameter (authenticate.cpp:379)
20111121205922.600802 ncui[p6343.t6366] dsclient.info --> POST /dana/home/starter0.cgi?check=yes (authenticate.cpp:179)
20111121205922.948673 ncui[p6343.t6366] dsclient.info <-- 302 /dana/home/starter.cgi (authenticate.cpp:211)
20111121205922.948778 ncui[p6343.t6366] dsclient.info --> GET /dana/home/starter.cgi (authenticate.cpp:179)
20111121205923.300980 ncui[p6343.t6366] dsclient.info <-- 200 (authenticate.cpp:211)
20111121205923.301123 ncui[p6343.t6366] dsclient.info state: kStateAuthenticated (dsclient.cpp:376)
20111121205946.352102 ncui[p6343.t6366] IpcConn.error connect failed with error 110 (ncipc.cpp:199)

However, we can see the connection is opened (for exemple, we can do the logout or if we try another, the system says there is another connection).

We have also tested with several browsers (Firefox, Chrome and Chromium), with several users in the same client, with differents versions of Java, and the result is the same. But if we test with one Windows in the same machine, it works.

Can you help us?

Thanks in advance.

[userdce]

This is also good way to install on 64bit:

http://wireless.siu.edu/install-ubuntu-64.htm

[jittopjose]

Hi,
I also strugling to configure this in my Ubuntu 11.10 netbook. any body please send me the file libstdc++2.10-glibc2.2_2.95.4-24_i386.deb via mail. I searched in many places. but couldnt get. Plese help. My id is jittopjose[at]gmail.com

thanks.
Jitto P.Jose