HOWTO set up Juniper Network Connect VPN on Ubuntu Dapper

[jwingy]

I've modified the script to accept hardcoded passwords from a profile if you choose to do so. This is handy if you're using the -nogui option and need the script to automate connections.

Of course this isn't the most secure method of authenticating, but I'm sure some use cases will find this useful.

[GolanTrevize]

My solution for the problem:

to cut a long story short: I can connect again. What I did was stopping apparmor:

sudo /etc/init.d/apparmor teardown

Next step will be of course configuring apparmor correctly.

My problem was the same as described multiple times here on this thread. Error "SL0x12" while connecting via browser, no narport.txt when using the junipernc script.

So propably it is not a problem of the used jdk - which explains, why there was no difference in using openjdk, sun1.6.0.22 and now sun1.6.0.24.

So - if you got a "SL0x12" try disabling apparmor.

golan

[kees]

Please, never use "teardown". You should have ample details in "dmesg" to see which specific profile in AppArmor is causing you problems, and you can just disable that one profile itself without compromising your entire system's security. You cannot recover from "teardown" without restarting apparmor and every single program that has profiles defined (i.e. you might as well reboot).

[sambrightman]

I haven't yet tried the script from madscientist, but I have a couple of questions:

1) Is there something particular about the Juniper setup that requires the proprietary binaries and non-integrated setup? Why can't one add the right settings to built-in VPN support?
2) If the use of proprietary programs *is* required, can the necessary commands at least be integrated better with the existing system/desktop so that the VPN connection can be brought up and down as other connections are?

[islanddancer]

The unpack error went away with "chmod u+x ncsvc".

In the script, there is this line:

(cd "$_ncpath" && jar xf "$_jarfile" && [ -x "$_svc" ]) >> "$_errlog" 2>&1 \
|| die "Could not unpack Juniper Network Connect!"

Well, the -x was failing due to the ncsvc file in my case being not executable.

Still, with that I get the IVE error:

20080602221611.127751 ncui[9551] dsclient.info <-- 302 https://***/url_default/welcome.cgi?p=failed (authenticate.cpp:168)
20080602221611.127865 ncui[9551] dsclient.info state: kStateError (dsclient.cpp:358)
20080602221611.128164 ncui[9551] ncapp.error Failed to connect/authenticate with IVE. Error 104 (ncapp.cpp:174)

The output of the first time run of madscientists script:

irfan@leibniz:~$ ./junipernc
Connecting to sslvpn.vmware.com port 443
Generating Certificate .... done.
Searching for ncsvc in current working directory
Searching for ncsvc in /home/irfan/.juniper_networks/network_connect done.
ncapp> Failed to connect/authenticate with IVE. Error 104
ncapp> Incorrect credentials. Please check the username/password/realm.

Anyone know how to get around the IVE error? I'm completely stuck.

I am seeing the same error here and couldn't find how to fix, pls help!

[islanddancer]

Not the best instructions, but I managed to connect after getting that error. I went back to the webpage I'm supposed to use to connect, logged in (username + RSA key password) there, and when the terminal window popped up and asked for the root password I closed that window. Then the Network Connect window opened and I was connected (yes I verified it by connecting to an internal computer).

So... give that a shot. My guess is that the junipernc script by The Wonderful and Amazing madscientist got nearly everything configured, and then the web interface added the final piece to the puzzle. Tomorrow I'll ask on our internal forums if anyone knows if our Realm is something other than RSA.

Oh, also: when I ran junipernc and entered 123456 for my password, I got the same error. So my problem might be anything in the username/password realm that is getting translated by the web interface.

I see the same IVE error 104,

how did you use junipernc script in your case here? did u use that
script?

[nsk7even]

Hello guys,

how can I use this junipernc_password_hack.sh script with proxy?

The system (Ubuntu Maverick) is configured to use the company proxies for all protocols, but I already encountered the necessity for application specific configuration (e. g. wget I think.. cannot remember for sure).

So do I have to configure the proxy somewhere else?


Other question: what is realm and what do I have to enter there?

Thanks in advance,
7even

[CodeFooTyping]

I see the same IVE error 104,

how did you use junipernc script in your case here? did u use that
script?

In the case of error 104, it could just be that you entered the relm incorrectly. This seems to be case sensitive. In my case there is a drop down with two choices and I have to enter the right one all UPPERCASE.

Of course when I get past that I still get error 10.

[gsker]

In the case of error 104, it could just be that you entered the relm incorrectly. This seems to be case sensitive. In my case there is a drop down with two choices and I have to enter the right one all UPPERCASE.

Of course when I get past that I still get error 10.

I got error 10 until I added a -U option to the ncsvc lines in the junipernc file. I got the url from the HTML code,
<form name="frmLogin" action="login.cgi"
I just made it the complete URL to the "login.cgi"

[mynk]

@gsker - I am not sure I understood you fully. I am getting the following error -

$ junipernc
Searching for ncsvc in current working directory
Searching for ncsvc in /home/mayankr/.juniper_networks/network_connect done.
Password:
ncapp> Failed to connect/authenticate with IVE. Error 10


I am assuming you are talking about the same issue here. I checked the junipernc file but could not figure out where you changed and what exactly you changed. Can you kindly elaborate?

I am hoping this is the last hurdle to get this script working on a 64 bit environment (11.04). I have been using 32 bit just because the vpn doesn't work. Never got the junipernc script to work on either 32 bitor 64 bit. Please advice.

Thanks in advance,
Mayank