/
openconnect.8.in
351 lines (341 loc) · 9.67 KB
/
openconnect.8.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
.TH OPENCONNECT 8
.SH NAME
openconnect \- Connect to Cisco AnyConnect VPN
.SH SYNOPSIS
.SY openconnect
.OP \-\-config configfile
.OP \-b,\-\-background
.OP \-\-pid\-file pidfile
.OP \-c,\-\-certificate cert
.OP \-e,\-\-cert\-expire\-warning days
.OP \-k,\-\-sslkey key
.OP \-C,\-\-cookie cookie
.OP \-\-cookie\-on\-stdin
.OP \-d,\-\-deflate
.OP \-D,\-\-no\-deflate
.OP \-\-force\-dpd interval
.OP \-g,\-\-usergroup group
.OP \-h,\-\-help
.OP \-i,\-\-interface ifname
.OP \-l,\-\-syslog
.OP \-U,\-\-setuid user
.OP \-\-csd\-user user
.OP \-m,\-\-mtu mtu
.OP \-\-basemtu mtu
.OP \-p,\-\-key\-password pass
.OP \-P,\-\-proxy proxyurl
.OP \-\-no\-proxy
.OP \-\-libproxy
.OP \-\-key\-password\-from\-fsid
.OP \-q,\-\-quiet
.OP \-Q,\-\-queue\-len len
.OP \-s,\-\-script vpnc\-script
.OP \-S,\-\-script\-tun
.OP \-u,\-\-user name
.OP \-V,\-\-version
.OP \-v,\-\-verbose
.OP \-x,\-\-xmlconfig config
.OP \-\-authgroup group
.OP \-\-authenticate
.OP \-\-cookieonly
.OP \-\-printcookie
.OP \-\-cafile file
.OP \-\-disable\-ipv6
.OP \-\-dtls\-ciphers list
.OP \-\-no\-cert\-check
.OP \-\-no\-dtls
.OP \-\-no\-http\-keepalive
.OP \-\-no\-passwd
.OP \-\-non\-inter
.OP \-\-passwd\-on\-stdin
.OP \-\-reconnect\-timeout
.OP \-\-servercert sha1
.OP \-\-useragent string
.B [https://]\fIserver\fB[:\fIport\fB][/\fIgroup\fB]
.YS
.SH DESCRIPTION
The program
.B openconnect
connects to Cisco "AnyConnect" VPN servers, which use standard TLS
and DTLS protocols for data transport.
The connection happens in two phases. First there is a simple HTTPS
connection over which the user authenticates somehow \- by using a
certificate, or password or SecurID, etc. Having authenticated, the
user is rewarded with an HTTP cookie which can be used to make the
real VPN connection.
The second phase uses that cookie in an HTTPS
.I CONNECT
request, and data packets can be passed over the resulting
connection. In auxiliary headers exchanged with the
.I CONNECT
request, a Session\-ID and Master Secret for a DTLS connection are also
exchanged, which allows data transport over UDP to occur.
.SH OPTIONS
.TP
.B \-\-config=CONFIGFILE
Read further options from
.I CONFIGFILE
before continuing to process options from the command line. The file
should contain long-format options as would be accepted on the command line,
but without the two leading \-\- dashes. Empty lines, or lines where the
first non-space character is a # character, are ignored.
Any option except the
.B config
option may be specified in the file.
.TP
.B \-b,\-\-background
Continue in background after startup
.TP
.B \-\-pid\-file=PIDFILE
Save the pid to
.I PIDFILE
when backgrounding
.TP
.B \-c,\-\-certificate=CERT
Use SSL client certificate
.I CERT
which may be either a file name or, if OpenConnect has been built with an appropriate
version of GnuTLS, a PKCS#11 URL.
.TP
.B \-e,\-\-cert\-expire\-warning=DAYS
Give a warning when SSL client certificate has
.I DAYS
left before expiry
.TP
.B \-k,\-\-sslkey=KEY
Use SSL private key
.I KEY
which may be either a file name or, if OpenConnect has been built with an appropriate
version of GnuTLS, a PKCS#11 URL.
.TP
.B \-C,\-\-cookie=COOKIE
Use WebVPN cookie
.I COOKIE
.TP
.B \-\-cookie\-on\-stdin
Read cookie from standard input
.TP
.B \-d,\-\-deflate
Enable compression (default)
.TP
.B \-D,\-\-no\-deflate
Disable compression
.TP
.B \-\-force\-dpd=INTERVAL
Use
.I INTERVAL
as minimum Dead Peer Detection interval for CSTP and DTLS, forcing use of DPD even when the server doesn't request it.
.TP
.B \-g,\-\-usergroup=GROUP
Use
.I GROUP
as login UserGroup
.TP
.B \-h,\-\-help
Display help text
.TP
.B \-i,\-\-interface=IFNAME
Use
.I IFNAME
for tunnel interface
.TP
.B \-l,\-\-syslog
Use syslog for progress messages
.TP
.B \-U,\-\-setuid=USER
Drop privileges after connecting, to become user
.I USER
.TP
.B \-\-csd\-user=USER
Drop privileges during CSD (Cisco Secure Desktop) script execution.
.TP
.B \-\-csd\-wrapper=SCRIPT
Run
.I SCRIPT
instead of the CSD (Cisco Secure Desktop) script.
.TP
.B \-m,\-\-mtu=MTU
Request
.I MTU
from server as the MTU of the tunnel.
.TP
.B \-\-basemtu=MTU
Indicate
.I MTU
as the path MTU between client and server on the unencrypted network. Newer
servers will automatically calculate the MTU to be used on the tunnel from
this value.
.TP
.B \-p,\-\-key\-password=PASS
Provide passphrase for certificate file, or SRK (System Root Key) PIN for TPM
.TP
.B \-P,\-\-proxy=PROXYURL
Use HTTP or SOCKS proxy for connection
.TP
.B \-\-no\-proxy
Disable use of proxy
.TP
.B \-\-libproxy
Use libproxy to configure proxy automatically (when built with libproxy support)
.TP
.B \-\-key\-password\-from\-fsid
Passphrase for certificate file is automatically generated from the
.I fsid
of the file system on which it is stored. The
.I fsid
is obtained from the
.BR statvfs (2)
or
.BR statfs (2)
system call, depending on the operating system. On a Linux or similar system
with GNU coreutils, the
.I fsid
used by this option should be equal to the output of the command:
.EX
stat \-\-file\-system \-\-printf=%i\e\en $CERTIFICATE
.EE
It is not the same as the 128\-bit UUID of the file system.
.TP
.B \-q,\-\-quiet
Less output
.TP
.B \-Q,\-\-queue\-len=LEN
Set packet queue limit to
.I LEN
pkts
.TP
.B \-s,\-\-script=SCRIPT
Invoke
.I SCRIPT
to configure the network after connection. Without this, routing and name
service are unlikely to work correctly. The script is expected to be
compatible with the
.B vpnc\-script
which is shipped with the "vpnc" VPN client. See
.I http://www.infradead.org/openconnect/vpnc-script.html
for more information. This version of OpenConnect is configured to use
.B @DEFAULT_VPNCSCRIPT@
by default.
.TP
.B \-S,\-\-script\-tun
Pass traffic to 'script' program over a UNIX socket, instead of to a kernel
tun/tap device. This allows the VPN IP traffic to be handled entirely in
userspace, for example by a program which uses lwIP to provide SOCKS access
into the VPN.
.TP
.B \-u,\-\-user=NAME
Set login username to
.I NAME
.TP
.B \-V,\-\-version
Report version number
.TP
.B \-v,\-\-verbose
More output
.TP
.B \-x,\-\-xmlconfig=CONFIG
XML config file
.TP
.B \-\-authgroup=GROUP
Choose authentication login selection
.TP
.B \-\-authentiate
Authenticate only, and output the information needed to make the connection
a form which can be used to set shell environment variables. When invoked with
this option, openconnect will not make the connection, but if successful will
output something like the following to stdout:
.nf
.B COOKIE=3311180634@13561856@1339425499@B315A0E29D16C6FD92EE...
.B HOST=10.0.0.1
.B FINGERPRINT=469bb424ec8835944d30bc77c77e8fc1d8e23a42
.fi
Thus, you can invoke openconnect as a non-privileged user
.I (with access to the user's PKCS#11 tokens, etc.)
for authentication, and then invoke openconnect separately to make the actual
connection as root:
.nf
.B eval `openconnect --authenticate https://vpnserver.example.com`;
.B [ -n "$COOKIE" ] && echo "$COOKIE" |
.B \ \ sudo openconnect --cookie-on-stdin $HOST --servercert $FINGERPRINT
.fi
.TP
.B \-\-cookieonly
Fetch webvpn cookie only; don't connect
.TP
.B \-\-printcookie
Print webvpn cookie before connecting
.TP
.B \-\-cafile=FILE
Cert file for server verification
.TP
.B \-\-disable\-ipv6
Do not advertise IPv6 capability to server
.TP
.B \-\-dtls\-ciphers=LIST
Set OpenSSL ciphers to support for DTLS
.TP
.B \-\-no\-cert\-check
Do not require server SSL certificate to be valid. Checks will still happen
and failures will cause a warning message, but the connection will continue
anyway. You should not need to use this option \- if your servers have SSL
certificates which are not signed by a trusted Certificate Authority, you can
still add them (or your private CA) to a local file and use that file with the
.B \-\-cafile
option.
.TP
.B \-\-no\-dtls
Disable DTLS
.TP
.B \-\-no\-http\-keepalive
Version 8.2.2.5 of the Cisco ASA software has a bug where it will forget
the client's SSL certificate when HTTP connections are being re\-used for
multiple requests. So far, this has only been seen on the initial connection,
where the server gives an HTTP/1.0 redirect response with an explicit
.B Connection: Keep\-Alive
directive. OpenConnect as of v2.22 has an unconditional workaround for this,
which is never to obey that directive after an HTTP/1.0 response.
However, Cisco's support team has failed to give any competent
response to the bug report and we don't know under what other
circumstances their bug might manifest itself. So this option exists
to disable ALL re\-use of HTTP sessions and cause a new connection to be
made for each request. If your server seems not to be recognising your
certificate, try this option. If it makes a difference, please report
this information to the
.B openconnect\-devel@lists.infradead.org
mailing list.
.TP
.B \-\-no\-passwd
Never attempt password (or SecurID) authentication.
.TP
.B \-\-non\-inter
Do not expect user input; exit if it is required.
.TP
.B \-\-passwd\-on\-stdin
Read password from standard input
.TP
.B \-\-reconnect\-timeout
Keep reconnect attempts until so much seconds are elapsed. The default
timeout is 300 seconds, which means that openconnect can recover
VPN connection after a temporary network down time of 300 seconds.
.TP
.B \-\-servercert=SHA1
Accept server's SSL certificate only if its fingerprint matches
.IR SHA1 .
.TP
.B \-\-useragent=STRING
Use
.I STRING
as 'User\-Agent:' field value in HTTP header.
(e.g. \-\-useragent 'Cisco AnyConnect VPN Agent for Windows 2.2.0133')
.SH LIMITATIONS
Note that although IPv6 has been tested on all platforms on which
.B openconnect
is known to run, it depends on a suitable
.B vpnc\-script
to configure the network. The standard
.B vpnc\-script
shipped with vpnc 0.5.3 is not capable of setting up IPv6 routes; the one from
.B git://git.infradead.org/users/dwmw2/vpnc\-scripts.git
will be required.
.SH AUTHORS
David Woodhouse <dwmw2@infradead.org>