initial version of the CDSC version of scripts
This commit is contained in:
Benjamin Mako Hill
parent
47b2c41af7
commit
7e13b54cde
64
README-CDSC
Normal file
64
README-CDSC
Normal file
@ -0,0 +1,64 @@
|
||||
===========================
|
||||
== INSTALLATION ===========
|
||||
===========================
|
||||
|
||||
1.
|
||||
|
||||
Install prerequisites. This will include:
|
||||
|
||||
sudo apt install python3-gi gir1.2-gtk-3.0 gir1.2-webkit2-4.0
|
||||
|
||||
2.
|
||||
|
||||
Install this directory into: ~/bin/nu-vpn-proxy
|
||||
|
||||
3.
|
||||
|
||||
Change your System UUID. You can get this with command:
|
||||
|
||||
sudo dmidecode|grep UUID
|
||||
|
||||
You should see a line like:
|
||||
|
||||
UUID: deadbeef-dead-beef-dead-beefdeadbeef
|
||||
|
||||
Edit the file hipreport-modified.sh to change the variable HOSTID so that it is
|
||||
equal to this number. Change the line that says
|
||||
"deadbeef-dead-beef-dead-beefdeadbeaf" so that it lists your UUID.
|
||||
|
||||
4. [optional]
|
||||
|
||||
Change bmh1867 to your username and add the following stanza text to your
|
||||
~/.ssh/config:
|
||||
|
||||
Host kibo kibo.soc.northwestern.edu
|
||||
Hostname kibo.soc.northwestern.edu
|
||||
User bmh1867
|
||||
ProxyCommand ~/bin/nu-vpn-proxy/ssh-vpn-proxy %h %p
|
||||
ForwardAgent yes
|
||||
ServerAliveInterval 120
|
||||
|
||||
===========================
|
||||
== USAGE ==================
|
||||
===========================
|
||||
|
||||
There are two ways to use this.
|
||||
|
||||
1. *Only* for SSH connections to kibo.
|
||||
|
||||
This should be just as simple as running:
|
||||
|
||||
ssh-kibo
|
||||
|
||||
You can run the command mulptiple time and it should work. When you close the
|
||||
first connection though, it will disconnect all of your connections.
|
||||
|
||||
2. Your entire connection.
|
||||
|
||||
Run the following command:
|
||||
|
||||
~/bin/openconnect_command-general.sh
|
||||
|
||||
While this command is running, you should be connected through the VPN. Run
|
||||
Ctrl-C to disconnect.
|
||||
|
||||
150
hipreport-modified.sh
Executable file
150
hipreport-modified.sh
Executable file
@ -0,0 +1,150 @@
|
||||
#!/bin/sh
|
||||
|
||||
# openconnect will call this script with the follow command-line
|
||||
# arguments, which are needed to populate the contents of the
|
||||
# HIP report:
|
||||
#
|
||||
# --cookie: a URL-encoded string, as output by openconnect
|
||||
# --authenticate --protocol=gp, which includes parameters
|
||||
# from the /ssl-vpn/login.esp response
|
||||
#
|
||||
# --client-ip{,v6}: IPv4/6 addresses allocated by the GlobalProtect
|
||||
# VPN for this client (included in
|
||||
# /ssl-vpn/getconfig.esp response)
|
||||
#
|
||||
# --md5: The md5 digest to encode into this HIP report. I'm not sure
|
||||
# exactly what this is the md5 digest *of*, but all that
|
||||
# really matters is that the value in the HIP report
|
||||
# submission should match the value in the HIP report check.
|
||||
#
|
||||
# This hipreport.sh does not work as-is on Android. The large here-doc
|
||||
# (cat <<EOF) does not appear to work with Android's /system/bin/sh,
|
||||
# likely due to an insufficient read buffer size.
|
||||
# Try hipreport-android.sh instead.
|
||||
|
||||
# Read command line arguments into variables
|
||||
COOKIE=
|
||||
IP=
|
||||
IPv6=
|
||||
MD5=
|
||||
|
||||
while [ "$1" ]; do
|
||||
if [ "$1" = "--cookie" ]; then shift; COOKIE="$1"; fi
|
||||
if [ "$1" = "--client-ip" ]; then shift; IP="$1"; fi
|
||||
if [ "$1" = "--client-ipv6" ]; then shift; IPV6="$1"; fi
|
||||
if [ "$1" = "--md5" ]; then shift; MD5="$1"; fi
|
||||
shift
|
||||
done
|
||||
|
||||
if [ -z "$COOKIE" -o -z "$MD5" -o -z "$IP$IPV6" ]; then
|
||||
echo "Parameters --cookie, --md5, and --client-ip and/or --client-ipv6 are required" >&2
|
||||
exit 1;
|
||||
fi
|
||||
|
||||
# Extract username and domain and computer from cookie
|
||||
USER=$(echo "$COOKIE" | sed -rn 's/(.+&|^)user=([^&]+)(&.+|$)/\2/p')
|
||||
DOMAIN=$(echo "$COOKIE" | sed -rn 's/(.+&|^)domain=([^&]+)(&.+|$)/\2/p')
|
||||
COMPUTER=$(echo "$COOKIE" | sed -rn 's/(.+&|^)computer=([^&]+)(&.+|$)/\2/p')
|
||||
|
||||
# Timestamp in the format expected by GlobalProtect server
|
||||
NOW=$(date +'%m/%d/%Y %H:%M:%S')
|
||||
DAY=$(date +'%d')
|
||||
MONTH=$(date +'%m')
|
||||
YEAR=$(date +'%Y')
|
||||
|
||||
# This value may need to be extracted from the official HIP report, if a made-up value is not accepted.
|
||||
HOSTID="deadbeef-dead-beef-dead-beefdeadbeef"
|
||||
|
||||
cat <<EOF
|
||||
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<hip-report>
|
||||
<md5-sum>$MD5</md5-sum>
|
||||
<user-name>$USER</user-name>
|
||||
<domain>$USER</domain>
|
||||
<host-name>$COMPUTER</host-name>
|
||||
<host-id>$HOSTID</host-id>
|
||||
<ip-address>$IP</ip-address>
|
||||
<ipv6-address>$IPV6</ipv6-address>
|
||||
<generate-time>$NOW</generate-time>
|
||||
<categories>
|
||||
<entry name="host-info">
|
||||
<client-version>5.1.0-101</client-version>
|
||||
<os>Linux 4.19.0-6-amd64</os>
|
||||
<os-vendor>Linux</os-vendor>
|
||||
<domain>domain.com</domain>
|
||||
<host-name>spes</host-name>
|
||||
<host-id>d6f838cc-2b6f-11b2-a85c-d7bcda6b231e</host-id>
|
||||
<network-interface>
|
||||
<entry name="pan1">
|
||||
<description>pan1</description>
|
||||
<mac-address>42:4e:62:fe:ef:87</mac-address>
|
||||
<ip-address>
|
||||
<entry name="$IP"/>
|
||||
</ip-address>
|
||||
<ipv6-address>
|
||||
<entry name="$IPV6"/>
|
||||
</ipv6-address>
|
||||
</entry>
|
||||
</network-interface>
|
||||
</entry>
|
||||
</categories>
|
||||
</hip-report><?xml version="1.0" encoding="UTF-8"?>
|
||||
<hip-report>
|
||||
<md5-sum>$MD5</md5-sum>
|
||||
<user-name>$USER</user-name>
|
||||
<domain>$USER</domain>
|
||||
<host-name>$COMPUTER</host-name>
|
||||
<host-id>$HOSTID</host-id>
|
||||
<ip-address>$IP</ip-address>
|
||||
<ipv6-address>$IPV6</ipv6-address>
|
||||
<generate-time>$NOW</generate-time>
|
||||
<hip-report-version>4</hip-report-version>
|
||||
<categories>
|
||||
<entry name="host-info">
|
||||
<client-version>5.1.0-101</client-version>
|
||||
<os>Linux 4.19.0-6-amd64</os>
|
||||
<os-vendor>Linux</os-vendor>
|
||||
<domain>domain.com</domain>
|
||||
<host-name>spes</host-name>
|
||||
<host-id>d6f838cc-2b6f-11b2-a85c-d7bcda6b231e</host-id>
|
||||
<network-interface>
|
||||
<entry name="pan1">
|
||||
<description>pan1</description>
|
||||
<mac-address>42:4e:62:fe:ef:87</mac-address>
|
||||
<ip-address>
|
||||
<entry name="$IP"/>
|
||||
</ip-address>
|
||||
<ipv6-address>
|
||||
<entry name="$IPV6"/>
|
||||
</ipv6-address>
|
||||
</entry>
|
||||
</network-interface>
|
||||
</entry>
|
||||
<entry name="anti-malware">
|
||||
<list>
|
||||
</list>
|
||||
</entry>
|
||||
<entry name="disk-backup">
|
||||
<list>
|
||||
</list>
|
||||
</entry>
|
||||
<entry name="disk-encryption">
|
||||
<list>
|
||||
</list>
|
||||
</entry>
|
||||
<entry name="firewall">
|
||||
<list>
|
||||
</list>
|
||||
</entry>
|
||||
<entry name="patch-management">
|
||||
<list>
|
||||
</list>
|
||||
</entry>
|
||||
<entry name="data-loss-prevention">
|
||||
<list>
|
||||
</list>
|
||||
</entry>
|
||||
</categories>
|
||||
</hip-report>
|
||||
EOF
|
||||
10
openconnect_command-general.sh
Executable file
10
openconnect_command-general.sh
Executable file
@ -0,0 +1,10 @@
|
||||
#!/bin/bash
|
||||
|
||||
# change to the vpn file directory
|
||||
cd ~/bin/nu-vpn-proxy
|
||||
|
||||
## do the authentication
|
||||
eval $( ./gp-saml-gui.py -v --clientos=Linux vpn-connect2.northwestern.edu )
|
||||
|
||||
echo "$COOKIE" | sudo openconnect --useragent="PAN GlobalConnect" --version-string='5.1.0-101' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60
|
||||
|
||||
15
openconnect_command-ssh.sh
Executable file
15
openconnect_command-ssh.sh
Executable file
@ -0,0 +1,15 @@
|
||||
#!/bin/bash
|
||||
|
||||
LOG_FILE=/tmp/nu-globalprotect-saml.log
|
||||
PID_FILE=/tmp/nu-vpn-openconnect.pid
|
||||
|
||||
exec > $LOG_FILE
|
||||
|
||||
# change to the vpn file directory
|
||||
cd ~/bin/nu-vpn-proxy
|
||||
|
||||
## do the authentication
|
||||
eval $( ./gp-saml-gui.py -v --clientos=Linux vpn-connect2.northwestern.edu )
|
||||
|
||||
echo "$COOKIE" | openconnect --useragent="PAN GlobalConnect" --version-string='5.1.0-101' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60 --script-tun --script "ocproxy -D 9052" -b --pid-file "${PID_FILE}"
|
||||
|
||||
28
ssh-vpn-proxy
Executable file
28
ssh-vpn-proxy
Executable file
@ -0,0 +1,28 @@
|
||||
#!/bin/bash
|
||||
|
||||
SEARCH_PATTERN="ESP tunnel connected; exiting HTTPS mainloop."
|
||||
|
||||
# connects to SSH through openconnect and VPN
|
||||
# for use with ProxyCommand in SSH
|
||||
|
||||
|
||||
# first run openconnect
|
||||
/sbin/start-stop-daemon --pidfile /tmp/nu-vpn-openconnect.pid -S --startas "$HOME/bin/nu-vpn-proxy/openconnect_command-ssh.sh" &
|
||||
sleep 2
|
||||
|
||||
# kill connection on exit
|
||||
function cleanup {
|
||||
/sbin/start-stop-daemon --stop --pidfile /tmp/nu-vpn-openconnect.pid
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
tail -f /tmp/nu-globalprotect-saml.log | grep -qe "${SEARCH_PATTERN}"
|
||||
|
||||
if [ $? == 1 ]; then
|
||||
echo "Search terminated without finding the pattern"
|
||||
exit
|
||||
fi
|
||||
|
||||
# redirect traffic (standard input and output) through VPN
|
||||
/bin/nc.openbsd -X 5 -x 127.0.0.1:9052 $1 $2
|
||||
|
||||
Loading…
Reference in New Issue
Block a user