Cisco VPN Without A Cisco Client

A while ago I posted a blog outlining Cisco VPN Installation. This entry is how to get a VPN connection up and running without that software using vpnc instead.

Step one is to get vpnc. Most distributions seem to have a pre-built package so have a look around. For SuSE or RedHat it looks like this:

SuSE
# zypper install vpnc
RedHat
# yum install vpnc

Step two is to get a copy of your .pcf file. If you are using the Cisco VPN client, it is located under /etc/opt/cisco-vpnclient/Profiles/.pcf. This has three important pieces of information.

• The host you are connecting to (Host=)
• A group name (GroupName=)
• An encoded group password (enc_GroupPwd=)

Now, vpnc won't take an encoded password file so you will need to decrypt it first. There is a handy utility for this which should have come in your vpnc package, aptly named cisco-decrypt. If its not included you can download it from here. To run it you will need to either cut and paste the hideously long HEX string after enc_GroupPwd= or just run the command below.

# grep enc_GroupPwd name.pcf | awk -F= '{print $2}' | xargs cisco_decrypt

Once you have this you can create a vpnc.conf file like this one

# vi /etc/vpnc/vpnc.conf
IPSec gateway host_or_ip_from_Host=
IPSec ID group_from_GroupName=
IPSec secret output_from_cisco_decrypt

e.g.
IPSec gateway 44.24.21.2
IPSec ID IPSec-Grp
IPSec secret mysecret
Xauth username myID

If you don't have a group name you should be able to use 'General' instead. You can also add Xauth username your_ID and Xauth password your_password as shown in the example. However, this file is stored in clear text so it is probably best to leave the password option out. VPNC will prompt you for any values not present.

Once that is all done, you can connect and disconnect like this

# vpnc /etc/vpnc/vpnc.conf
  Enter username for _host_: _id_
  Enter password for _id_@_host_: 
  Connect Banner:
  | 
  | Secure VPN Server
  | Authorized Users Only
  | Successfully Authenticated
  | 

  VPNC started in background (pid: 7726)...

# ifconfig
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:ip  P-t-P:ip  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1412  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

When you're done
# vpnc-disconnect
Terminating vpnc daemon (pid: 7726)

Nice and simple. Since it uses built in kernel modules, no more messing about with compiling, kernel versions or outdated code from Cisco.

Cisco VPN chkconfig errors

There is (at least) one more error I have seen when running the Cisco VPN client under Linux. For those systems that use LSB or Linux Standard Base (you can see my blog entry on startup scripts here) you will get an error whenever running chkconfig like this:

insserv: warning: script 'K01vpnclient_init' missing LSB tags and overrides
insserv: warning: script 'vpnclient_init' missing LSB tags and overrides

To fix this message, edit the /etc/init.d/vpn_client_init script to bring it up to LSB standards. I put the following just above the Source function library and just after the chkconfig information included with the comments.

### BEGIN INIT INFO
# Provides: ciscovpn
# Required-Start: $network
# Required-Stop:
# Default-Start: 3 4 5
# Default-Stop: 0 1 2 3
# Short-Description: vpnclient
# Description: Cisco VPN Client
### END INIT INFO

Cisco VPN Scripts

I have found that the Cisco VPN client occasionally hangs up on its connection. The reason is because the client removes the local network route which works fine until the MAC address cache expires and needs to be refreshed. Linux can't find its local route and basically drops the vpn, at which time the Cisco client conveniently puts the route back making it extra hard to track.

The really nasty part is you can't add the route ahead of time as the client will just remove it no matter how many there are and you can't add it later from the same shell as any attempt to background the client will end badly. My solution is to capture the local route and background a sub-shell which will add the route 60 seconds after the vpn client starts. I thought this would give enough time for the user to establish the connection but not be too long as to expire the MAC address cache. Here it is:

#!/bin/bash
# look for the interface that is up with a gateway assigned (UG) and grab the last field
DEV=`netstat -rn | grep UG | awk '{print $NF}'`
# This should just grab the one local route for the default interface
NETSTAT=`netstat -rn | grep $DEV | grep -v "^127\|^0.0\|169.254"`
NETWORK=`echo $NETSTAT | awk '{print $1}'`
MASK=`echo $NETSTAT | awk '{print $3}'`

# This says after 60 seconds add the local route back in
# you can't do this after vpnclient as it can't be backgrounded without a username / password on the command line
(sleep 60 && sudo /sbin/route add -net $NETWORK netmask $MASK dev $DEV)&

# Finally run the vpnclient
vpnclient connect mypcf_file

In order to make this work, your user account has to be able to execute sudo for /sbin/route without a password. For me I added my group to /etc/sudoers with the following entry:

# visudo
%users  ALL=(ALL) NOPASSWD:  /sbin/route

Cisco VPN Installation

The Cisco VPN module has been a bit of a sore point to get compiled and running. Here are some instructions I used under OpenSuSE 11.3 with kernel 2.6.34-12-desktop but it should work on other distributions too.

You are going to need three pieces of code, the VPN client, a 64 bit patch, and a patch to work with a 2.6.31+ kernel. I have
To start you will need three pieces of code:

• The VPN client itself
• A 64 bit patch
• A 2.6.31+ patch or as a file from here (thanks Ngo)

So lets see what happens with just the base VPN client:

# tar -zxvf vpnclient-linux-x86_64-4.8.02.0030-k9.tar.gz
# cd vpnclient
# ./vpn_install
Making module
make -C /lib/modules/2.6.34-12-desktop/build SUBDIRS=/home/mike/cisco/vpnclient modules
make[1]: Entering directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make -C ../../../linux-2.6.34-12 O=/usr/src/linux-2.6.34-12-obj/x86_64/desktop/. modules
/usr/src/linux-2.6.34-12/scripts/Makefile.build:49: *** CFLAGS was changed in "/home/mike/cisco/vpnclient/Makefile". Fix it to use EXTRA_CFLAGS.  Stop.
make[3]: *** [_module_/home/mike/cisco/vpnclient] Error 2
make[2]: *** [sub-make] Error 2
make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make: *** [default] Error 2
Failed to make module "cisco_ipsec.ko".

Not so good, lets install the 64 bit patch and see what happens:

# patch < ../vpnclient-linux-4.8.02-64bit.patch
patching file Makefile
patching file frag.c
patching file interceptor.c
patching file linuxcniapi.c
patching file linuxkernelapi.c
# ./vpn_install
Making module
make -C /lib/modules/2.6.34-12-desktop/build SUBDIRS=/home/mike/cisco/vpnclient modules
make[1]: Entering directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make -C ../../../linux-2.6.34-12 O=/usr/src/linux-2.6.34-12-obj/x86_64/desktop/. modules
  CC [M]  /home/mike/cisco/vpnclient/linuxcniapi.o
/home/mike/cisco/vpnclient/linuxcniapi.c:14:28: fatal error: linux/autoconf.h: No such file or directory
compilation terminated.
make[4]: *** [/home/mike/cisco/vpnclient/linuxcniapi.o] Error 1
make[3]: *** [_module_/home/mike/cisco/vpnclient] Error 2
make[2]: *** [sub-make] Error 2
make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make: *** [default] Error 2
Failed to make module "cisco_ipsec.ko".

Now we have a strange error message about a missing autoconf.h file. To fix this we need to know what kernel we are running by using uname. In my case it is 2.6.34-12-desktop. It is the desktop portion that is important as under /usr/src/linux-2.6.34-12-obj/x86_64 there are a few directories, default, desktop, and xen. You need to make sure you are working with the correct one. To get around the error just touch an empty file:

# touch /usr/src/linux-2.6.34-12-obj/x86_64/desktop/include/linux/autoconf.h
# ./vpn_install
Making module
make -C /lib/modules/2.6.34-12-desktop/build SUBDIRS=/home/mike/cisco/vpnclient modules
make[1]: Entering directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make -C ../../../linux-2.6.34-12 O=/usr/src/linux-2.6.34-12-obj/x86_64/desktop/. modules
  CC [M]  /home/mike/cisco/vpnclient/linuxcniapi.o
  CC [M]  /home/mike/cisco/vpnclient/frag.o
  CC [M]  /home/mike/cisco/vpnclient/IPSecDrvOS_linux.o
  CC [M]  /home/mike/cisco/vpnclient/interceptor.o
/home/mike/cisco/vpnclient/interceptor.c: In function ‘interceptor_init’:
/home/mike/cisco/vpnclient/interceptor.c:132:8: error: ‘struct net_device’ has no member named ‘hard_start_xmit’
/home/mike/cisco/vpnclient/interceptor.c:133:8: error: ‘struct net_device’ has no member named ‘get_stats’
/home/mike/cisco/vpnclient/interceptor.c:134:8: error: ‘struct net_device’ has no member named ‘do_ioctl’
/home/mike/cisco/vpnclient/interceptor.c: In function ‘add_netdev’:
/home/mike/cisco/vpnclient/interceptor.c:271:33: error: ‘struct net_device’ has no member named ‘hard_start_xmit’
/home/mike/cisco/vpnclient/interceptor.c:272:8: error: ‘struct net_device’ has no member named ‘hard_start_xmit’
/home/mike/cisco/vpnclient/interceptor.c: In function ‘remove_netdev’:
/home/mike/cisco/vpnclient/interceptor.c:294:12: error: ‘struct net_device’ has no member named ‘hard_start_xmit’
make[4]: *** [/home/mike/cisco/vpnclient/interceptor.o] Error 1
make[3]: *** [_module_/home/mike/cisco/vpnclient] Error 2
make[2]: *** [sub-make] Error 2
make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make: *** [default] Error 2
Failed to make module "cisco_ipsec.ko".

Got rid of that autoconf.h message but now we have an interceptor problem. The 2.6.31 patch will take care of that for us.

# patch < ../vpnclient-linux-2.6.31-final.diff
# ./vpn_install
Making module
make -C /lib/modules/2.6.34-12-desktop/build SUBDIRS=/home/mike/cisco/vpnclient modules
make[1]: Entering directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make -C ../../../linux-2.6.34-12 O=/usr/src/linux-2.6.34-12-obj/x86_64/desktop/. modules
  CC [M]  /home/mike/cisco/vpnclient/interceptor.o
/home/mike/cisco/vpnclient/interceptor.c: In function ‘add_netdev’:
/home/mike/cisco/vpnclient/interceptor.c:284:5: error: assignment of read-only location ‘*dev->netdev_ops’
/home/mike/cisco/vpnclient/interceptor.c: In function ‘remove_netdev’:
/home/mike/cisco/vpnclient/interceptor.c:311:9: error: assignment of read-only location ‘*dev->netdev_ops’
make[4]: *** [/home/mike/cisco/vpnclient/interceptor.o] Error 1
make[3]: *** [_module_/home/mike/cisco/vpnclient] Error 2
make[2]: *** [sub-make] Error 2
make[1]: *** [all] Error 2
make[1]: Leaving directory `/usr/src/linux-2.6.34-12-obj/x86_64/desktop'
make: *** [default] Error 2
Failed to make module "cisco_ipsec.ko".

One more error to fix. This one involved changing netdevice.h in the kernel source tree from const struct net_device_ops *netdev_ops to just struct net_device_ops *net_device_ops. We can do that with one line as shown below

# sed -i 's/const\ struct\ net_device_ops\ \*netdev_ops;/struct\ net_device_ops\ \*netdev_ops;/' `find /usr/src -name netdevice.h`
# ./vpn_install

Success, the module compiles and installs. Now we just need to run it. To do this you will need a pcf file from your VPN administrator. For me, I took the files from a windows client and modified it slightly by removing the value for the ISPPhonebook entry. Place this in /etc/opt/cisco-vpnclient/Profiles and then connect with vpnclient connect PCF_FILE.