Thanks to a comment from GAD3R and the Connman developer mailing list, a friend figured out on how to set up the VPN connection. Although there is still a small error existent we got it work mostly.
1. Initial situation
The following packages have to be installed on your client machine from where you want to access the host server:
connmanconnman-vpncmstopenconnect
Furthermore the script csd-wrapper.sh was run in your clients /home-directory and has created the directory /home/.cisco with several authentication files of your machine.
2. Generating the necessary VPN authentication information by engaging OpenConnect
In a second step you have to execute the OpenConnect authentication request to obtain the server certificate (FINGERPRINT) and a COOKIE that Connman will use to connect to the VPN. This information will be created by utilizing OpenConnect package which is later displaying a server certificate and a cookie in terminal. We generate this information in terminal by running
$ sudo openconnect --csd-wrapper=/home/user/.cisco/csd-wrapper.sh --authenticate --user <username> <hostname>
Afterwards this command will display four variables: POST, COOKIE, HOST and FINGERPRINT. Hereby the fingerprint (starting with sha256:...) acts as a server certificate while the COOKIE is what it sounds like.
3. Creating the VPN provisioning file for Connman
In contrast to NetworkManager the Connman is using so called VPN provisioning files for each VPN connection from where it takes the information on how to connect to the VPN host. Therefore in a third step the previously generated authentication data has to be pasted into this VPN provisioning file that Connman will utilize to connect to the server. To do so we create the file /var/lib/connman-vpn/<connection-name>.config based on the following structure:
[global]
Name = VPN name, for example "My Company VPN" (without quotes)
[provider_openconnect]
Type = OpenConnect
Name = VPN Provider name, for example "My Company Cisco VPN" (without quotes)
Host = <VPN host IP address>
Domain = <VPN host domain>
OpenConnect.ServerCert = <paste the output of FINGERPRINT from the previous openconnect command>
OpenConnect.Cookie = <paste the output of COOKIE from the previous openconnect command>
Afterwards save and close the file.
4. Reboot your machine and check VPN connection
Reboot your system and you will find your now created VPN connection listed in the rider VPN of Connman System Tray (CMST) GUI. Mark it, click on "connect" and after a few seconds the VPN-connection to your VPN-host will be established. Now you can easily access the VPN-host within the file manager of your choice.
5. Eyesore: Generated cookie is only valid for a few hours
After a few hours your previously successfully working VPN-connection won't work anymore. When checking /var/log/syslog the connection approach will complain about failed verification of server certificate:
Aug 24 00:14:51 <hostname> connmand[444]: ipconfig state 2 ipconfig method 1
Aug 24 00:14:51 <hostname> connmand[444]: vpn0 {create} index 23 type 65534 <NONE>
Aug 24 00:14:51 <hostname> connmand[444]: vpn0 {update} flags 4240 <DOWN>
Aug 24 00:14:51 <hostname> connmand[444]: vpn0 {newlink} index 23 address 00:00:00:00:00:00 mtu 1500
Aug 24 00:14:51 <hostname> connmand[444]: vpn0 {newlink} index 23 operstate 2 <DOWN>
Aug 24 00:14:51 <hostname> connman-vpnd[365]: vpn0 {create} index 23 type 65534 <NONE>
Aug 24 00:14:51 <hostname> connman-vpnd[365]: vpn0 {update} flags 4240 <DOWN>
Aug 24 00:14:51 <hostname> connman-vpnd[365]: vpn0 {newlink} index 23 operstate 2 <DOWN>
Aug 24 00:14:51 <hostname> connmand[444]: ipconfig state 2 ipconfig method 1
Aug 24 00:14:51 <hostname> openconnect[4476]: Connected to <VPN server IP>:443
Aug 24 00:14:51 <hostname> openconnect[4476]: SSL negotiation with <VPN server IP>
Aug 24 00:14:51 <hostname> openconnect[4476]: Server certificate verify failed: signer not found
Aug 24 00:14:51 <hostname> openconnect[4476]: Connected to HTTPS on <VPN server IP>
Aug 24 00:14:51 <hostname> openconnect[4476]: Got inappropriate HTTP CONNECT response: HTTP/1.1 401 Unauthorized
Aug 24 00:14:51 <hostname> connmand[444]: vpn0 {dellink} index 23 operstate 2 <DOWN>
Aug 24 00:14:51 <hostname> connmand[444]: (null) {remove} index 23
Aug 24 00:14:51 <hostname> connman-vpnd[365]: vpn0 {dellink} index 23 operstate 2 <DOWN>
Aug 24 00:14:51 <hostname> connman-vpnd[365]: vpn0 {remove} index 23
Aug 24 00:14:51 <hostname> connmand[444]: ipconfig state 7 ipconfig method 1
Aug 24 00:14:51 <hostname> connmand[444]: ipconfig state 6 ipconfig method 1
Hereby the initial authentication-COOKIE has changed, so the previously generated cookie is not valid anymore. Therefore you have to repeat the upper procedure all few hours to create a new COOKIE and paste this new one into your VPN provisioning file (/var/lib/connman-vpn/<yourvpnname>.config) while overwriting the old cookie. Afterwards restart Connman and your VPN will work great again for the next few hours.
Important:
It seems that NetworkManager can nudge the recreation of the new COOKIE by himself, while Connman needs to get feeded with the new cookie into its VPN provisioning file. Probably Connman is missing some kind of interface to launch the OpenConnect-command by himself.
6. Workaround to make recreation of the new cookie a bit more comfortable
You can use a bash-script to generate the new cookie and overwrite the old one. Just copy the following text into a *.sh-file, make it executable and run it. The new cookie will be placed into /var/lib/connman-vpn/vpnname.config at the right position automatically. Afterwards restart Connman and the VPN will work fine again.
#!/bin/bash
sed -i "s/^OpenConnect.Cookie =.*$/$( echo '<YOUR-VPN-PASSWORD>' | openconnect --csd-wrapper=/home/user/.cisco/csd-wrapper.sh --authenticate --user=<USERNAME> --authgroup="<YOURGROUP>" --passwd-on-stdin <VPN-HOST-DOMAIN> | grep 'COOKIE=' | sed "s/COOKIE='//; s/'//g; s/^/OpenConnect.Cookie = /")/" <EXTERNAL-FILENAME>
This script will:
- Start OpenConnect and execute the
OpenConnect authentication request to obtain the server certificate (FINGERPRINT) and a COOKIE
- Insert your
username into the user prompt
- Insert your
password into the user prompt
- Insert your desired
group into the user prompt
- Generate a new
cookie
- Overwrite the old
cookie in /var/lib/connman-vpn/vpnname.config with the new cookie
Afterwards you can reconnect to your VPN-host without any problems. Thanks to this script it is more comfortable and way faster to recreate new cookies when necessary.
