Authenticating remotely with CLI link without window prompt

[dantaeusb]

I want to use GlobalProtect on a IDE thin client host machine, and instead of opening a window on that machine, I'd like to receive the authentication URL in the CLI and use it on a client to authenticate. Is it possible? Machines are in the same network under NAT so I expect them to not cause any conflicts.

[yuezk]

Hi @dantaeusb,

You may try this if I understand your requirements correctly:

1. Use gpauth to authenticate and obtain the auth cookie outside. gpauth <portal> > cookie.txt
2. Copy cookie.txt to your thin client host machine and run cat cookie.txt | sudo gpclient connect <portal> --cookie-on-stdin

[dantaeusb]

Thank you, I think I got the idea.
Running gpauth on host opens the window on the host machine, which I'd like to disconnect from the display. Unfortunately, the client is macOS, but I would try to build gpauth for macOS, maybe it'll work, and then I'll just send cookie over ssh. Probably that's the best way to do that – as even if I had had the URI, I'd still needed to extract the cookie and transfer it to the host somehow.

[dantaeusb]

Ok that would require me to do webview on something like DarwinWerKit, but hopefully that shouldn't be too much of a problem.

[yuezk]

Currently, the gpauth doesn't support macOS.

[yuezk]

Currently, the gpauth doesn't support macOS.

gpauth now supports macOS. You can build the gpauth binary with cargo build -p gpauth on macOS

[dantaeusb]

That works flawlessly, a little shell script and I can authenticate the host easily – the only extra step I did is allow running client without sudo to avoid passing password.
A million thanks!

[mlanner]

@dantaeusb Do you have a sample script you could provide? I tried the same building my own script, but couldn't quite get it to work. I successfully used gpauth locally, used scp to transfer the cookie file to the remote machine and then tried to connect by issuing the command cat cookie.txt | sudo gpclient connect <portal> --cookie-on-stdin over ssh, but it fails. Any suggestions or a sample script would be greatly appreciated.

[dantaeusb]

@mlanner first what I did to avoid passing password over ssh or using superuser is to add to sudoers sudo visudo the option to run gpclient without auth, like
<username> ALL = NOPASSWD: /usr/bin/gpclient
Then I use the following script

#!/bin/bash
set -e

DATE=$(date +"%Y-%m-%d-%H-%M")
FILENAME="cookie_${DATE}.txt"
./gpauth <portal> > $FILENAME
scp ./$FILENAME <user>@<host>:~/Tools/$FILENAME
ssh <user>@<host> "cat ~/Tools/$FILENAME | sudo -E gpclient connect <portal> --cookie-on-stdin"
rm $FILENAME

I recommend also extending it with screen or tmux so you don't have to keep terminal but have access to what's happening inside like:
ssh user@ip "tmux new-session -d -s VPN 'cat ~/Tools/$FILENAME | sudo -E gpclient connect <portal> --cookie-on-stdin'" (tmux/screen should answer the #462 as well)
And deleting file from host later. You can probably skip file transfer altogether, but while I was writing the script it was useful for retries and debugs.

[mlanner]

@dantaeusb Thx! That's very similar to what I did, and I did actually try to run it in tmux, but it somehow didn't work. My test Linux account has full passwordless sudo, so I think the sudoers part is sorted. I'll take your version and see if I can get it to work without tmux first.

[buldezir]

simplier script, without file copying and without tmux:

function vm_vpn_connect() {
  _GPPORTAL="gp.example.com"
  _GPCOOKIE=$(gpauth -q $_GPPORTAL)
  ssh user@host "sudo pkill -SIGINT gpclient; sleep 2; echo '$_GPCOOKIE' | sudo -Eb gpclient connect --cookie-on-stdin $_GPPORTAL >/dev/null 2>&1 &"
}