Tuesday, July 3, 2012

Cisco VPN on Linux on campus

Now that I'm at UH this is the second time I've had to do something like this, so I thought I'd throw together a post about it in case someone else is trying to do the same, or in case I set up a new machine and have to do it again...

Since I'm apparently unable to use my Linux Mint 12 system (64-bit, Ubuntu-based) with the secure wireless network here on campus, I decided to set up the VPN, at least for the time being. The problem is that the Linux VPN software that's available from the university's website won't install. It requires building a kernel module, but it seems to be assuming an older kernel, because I get a ton of messages about header files missing like linux/config.h. Some research shows that this file (and others) were deprecated and removed from the kernel source somewhere around 2.6, and I'm running 3.0.0-12 (64-bit).

I searched a bit online and found an article named "How To: Install Cisco VPN Client on Linux Mint 12 (64 bit)". I thought to myself "Hey, that's exactly what I'm trying to do!" so I followed the instructions. Make sure to read the output when the vpn_install script finishes, especially this one:

* You must run "/etc/init.d/vpnclient_init start" before using the client.

That must be done as root (or via sudo), otherwise you will find that the VPN interface isn't available when you try to connect. You should only need to do this once, provided that you chose the default option to automatically start the VPN service at boot time.

After the installation is done and you've started the service, in Linux Mint 12 you need to go to System Settings > Network and do the following:

1) Click the [+] button to add a new interface.
2) Choose VPN and click "Create..."
3) Choose "Cisco Compatible VPN (vpnc)" and click "Create..."
4) Set the connection details.

This step is where it can get tricky again, since the Cisco VPN setup requires both your individual username/password and a group username/password. Every place I've checked keeps this information secure, so you'll need to do a little work to get this information. I'm not going to post the actual group information here for obvious reasons, though I can certainly tell you how I found the info.

UH (like all other places I've dealt with) requires that you log in to access their VPN configuration information (the PCF files). UH actually goes so far as to not allow download of the VPN client at all without logging in. I was able to retrieve the remaining setting information by logging in, downloading the VPN software for Windows, extracting it, and opening up the PCF file in a text editor. This file contains a lot of configuration data, but most notably it includes the gateway, group name, and group password. The group password is encrypted, so it's necessary to decode the password so you can enter this into the settings. (It's easy enough to find a decrypting utility online, so I'm not going to link to one in particular.)

After you've gathered the information, you'll need to at least enter the following:
  • Connection Name: Whatever you'd like, but know that it will append "VPN", so entering just "UH" will give you an interface named "UH VPN".
  • Gateway: This is normally an IP address. Get it from your university's connection information page (e.g. UH's), if available, or get from the PCF file.
  • User name: Your campus-provided username.
  • Group name: Get this from the PCF file, if not otherwise provided.
Optionally, you can also enter:
  • User password: Your campus-provided password.
  • Group password: Get this from the PCF file, if not otherwise provided.
If you don't want to be prompted for the passwords every time make sure to change the options to save them. I entered the passwords in the config screen, however I was then prompted for them when I first connected to the VPN...

The last bit of configuration is that you may need to enter a domain, particularly if your university is really into Windows networking. This is necessary for UH. To enter this into the configuration click "Advanced", enter the domain (e.g. "cougarnet") into the appropriate box, and save.

With any luck you can now access the VPN!

Hopefully this will be helpful, and please feel free to leave any comments, questions, etc.


Also, I'd be interested in knowing if any fellow Cougars have managed to get their Linux system connected to the UHSecure network, since that's what I was trying to do in the first place!