3

I'm running OpenConnect on my MacOS (10.11 El Capitan) box to access my university VPN servers which run Cisco AnyConnect. The Cisco AnyConnect app has a clunky GUI which doesn't store the password and requires you to enter it each time -- and it likes kicking you off the system with regularity. With a random long-length password, entering it each time is obviously a pain in the neck.

So right now, I start up my VPN session using the alternative, OpenConnect, by piping it the password through a shell script:

#!/bin/sh
echo 'mypassword' | sudo openconnect --config ~/.openconnect myuniversity.edu

But obviously I'd prefer not to have my password stored in cleartext. My harddrive is encrypted and I do suppose that any BadGuy® who is able to read a file in my home folder is capable of much more malicious things, but still...

Is there any to store the password? Ideally, I'd like the password to be stored in my MacOS Keychain and for the keychain to pass it to openconnect, but I'm unsure whether that's doable from the CLI.

p.s. Obviously if I could convince my university to either not use Cisco or to use a more secure cryptographic method than a password, I would.

Improve this question

1 Answer 1

Reset to default
1

RoboKaren,

There are many possible answers, but here are what I would consider the "top four".

(1) If you absolutely must use OpenConnect and CLI, then maybe the "best" solution would be for you to create a small encrypted disk image in your home folder. You would then manually mount that disk image whenever you needed a VPN session and refer to that in the CLI (the usual /Volume/... syntax). Keys for disk images can be stored in Keychain (although that would sort of remove the point of what you're trying to protect against !)

(2) If OpenConnect has a GUI, you could just use that in conjunction with a good password manager (assuming Openconnect has no storage mechanism)

(3) Switch to different VPN software, I don't want to make any recommendations but equniux VPNTracker is very popular, otherwise NCP is another well known name.

(4) If your VPN supports two-factor authentication, maybe look at that.

Improve this answer
2
  • I like #1! I never thought of that. #2 - AnyConnect (the Cisco version) has a GUI but cutting/pasting the password from my password manager each time I want a VPN session gets old. #3 - My choices unfortunately dictated by university. #4 - same as #3.
    – RoboKaren
    Jun 8, 2016 at 3:45
  • 1
    @RoboKaren Re: "but cutting/pasting the password from my password manager each time I want a VPN session gets old." ... I suggest you look at Zetetic Codebook. Not only is it a great password manager, but it comes with a second program called "Secret Agent" it acts as a virtual-keyboard and types your password in for you... really great, I use it the whole time. zetetic.net/codebook
    – Little Code
    Jun 8, 2016 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.