On 06/27/2016 02:38 PM, Matthieu Stigler wrote:
Hi
UC Davis does not offer anymore the browser-based vpn entry, so need to
use the "Pulse client" they provide:
https://www.lib.ucdavis.edu/ul/services/connect/faq.php
Sort of. They provide a Juniper based VPN solution that multiple
clients work with. Normally linux software is quite secure because it's:
* Compiled with current libraries and compilers
* Is 64 bit (for added page protection)
* In delivered with a package manager (so you get updates)
* Is included via a secure infrastructure
* Uses shared libraries, so you can fix any insecure dependencies
* is open source, follows best practices, etc.
Security critical things running as root and handling security related
duties should be held to the highest possible standards.
Unfortunately the pulse client is the exact opposite. Probably one of
the least secure binaries on your system. The linux pulse client:
* is just a random .deb download
* doesn't include a manifest with checksums
* isn't signed
* is 32 bit
* has known broken/insecure ssl libraries statically compiled in
* doesn't include any way to automatically get/detect available upgrades
* Seems unclear if it's getting any love at all, 32 bit is pretty old,
ancient openssl bindings, and (AFAICT) they are no longer affiliated
with Juniper.
So generally I recommend avoiding pulse if at all possible. The good
news is that OpenConnect:
* Is compatible
* is 64 bit
* is open source
* is delivered by your package manager via secure/signed packages
* will automatically get updates (if turned on), or just apt update;
apt-upgrade
* uses current openssl libraries
* seems to work quite well
Unfortunately it's a bit tricky on older linux boxes, the main problem
is that you need a fairly new openssl to get a library that A) doesn't
have the security hole and B) emulates (securely) the old behavior to be
compatible, but still avoids the security hole.
It pretty much "just works" with ubuntu-16.04. Just run this:
sudo apt install openconnect
sudo /usr/sbin/openconnect --juniper vpn.library.ucdavis.edu
I brought this up with the library and they seem not to care about
security and just want to support the pulse client. They did fix their
SSL cert so you no longer have to blindly trust a random cert you download.
This could be this bug:
https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40157/?q=KB40157
But what is strange is that it did work at some point...
I got it to work to verify things, but it was an ugly fragile hack. Try
openconnect, on 12.04 you will likely have to install the newest version
from source and possibly openssl as well.
Might be worth spinning up a ubuntu-16.04 vps/virtualbox/whatever just
to tinker with how it works. Pretty sure the current fedora should work
fine as well. Pretty sure someone mentioned it working on OSX as well.
_______________________________________________
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech
