OPENCONNECT(8) System Manager's Manual OPENCONNECT(8) (NAME) openconnect - VPN VPN AnyConnect (SYNOPSIS) openconnect [--config configfile] [-b,--background] [--pid-file pidfile] [-c,--certificate cert] [-e,--cert-expire-warning days] [-k,--sslkey key] [-C,--cookie cookie] [--cookie-on-stdin] [--compression MODE] [-d,--deflate] [-D,--no-deflate] [--force-dpd interval] [--force-trojan interval] [-F,--form-entry form:opt=value] [-g,--usergroup group] [-h,--help] [--http-auth methods] [--external-browser browser] [-i,--interface ifname] [-l,--syslog] [--timestamp] [--passtos] [-U,--setuid user] [--csd-user user] [-m,--mtu mtu] [--base-mtu mtu] [-p,--key-password pass] [-P,--proxy proxyurl] [--proxy-auth methods] [--no-proxy] [--libproxy] [--key-password-from-fsid] [-q,--quiet] [-Q,--queue-len len] [-s,--script vpnc-script] [-S,--script-tun] [-u,--user name] [-V,--version] [-v,--verbose] [-x,--xmlconfig config] [--authgroup group] [--authenticate] [--cookieonly] [--printcookie] [--cafile file] [--disable-ipv6] [--dtls-ciphers list] [--dtls12-ciphers list] [--dtls-local-port port] [--dump-http-traffic] [--no-system-trust] [--pfs] [--no-dtls] [--no-http-keepalive] [--no-passwd] [--no-xmlpost] [--non-inter] [--passwd-on-stdin] [--protocol proto] [--token-mode mode] [--token-secret {secret[,counter]|@file}] [--reconnect-timeout seconds] [--resolve host:ip] [--sni host] [--servercert sha1] [--useragent string] [--version-string string] [--local-hostname string] [--os string] [--server] [https://]host[:port][/group] (DESCRIPTION) openconnect VPN TLS/SSL DTLS ESP . VPN "AnyConnect" VPN Network Connect (--protocol=nc) VPN / Connect Secure (--protocol=pulse) VPN GlobalProtect (--protocol=gp) VPN Big-IP (--protocol=f5) VPN Fortigate (--protocol=fortinet) SSL VPN (Array Networks) (--protocol=array) . . HTTPS - SecurID . VPN . HTTPS . UDP : AnyConnect DTLS Juniper GlobalProtect ESP UDP . UDP --no-dtls . ( TCP TCP https://web.archive.org/web/20230228035749/https://sites.inka.de/~W1011/devel/tcp-tcp.html .) (OPTIONS) --config=CONFIGFILE CONFIGFILE . -- . # . config . -b,--background --pid-file=PIDFILE pid PIDFILE -c,--certificate=CERT [,--mca-certificate=CERT] SSL CERT OpenConnect GnuTLS URL PKCS#11 . --mca-certificate ( SSL "" "" ). -e,--cert-expire-warning=DAYS DAYS SSL -k,--sslkey=KEY [,--mca-key=KEY] SSL KEY OpenConnect GnuTLS URL PKCS#11 . --mca-key ( --mca-certificate ). -C,--cookie=COOKIE COOKIE. --cookie-on-stdin . -d,--deflate (stateful). . -D,--no-deflate . --compression=MODE MODE stateless none all . ( UDP ) . all ( zlib deflate) . none . --force-dpd=INTERVAL INTERVAL (Dead Peer Detection - DPD) ( ). DPD . DPD (TLS DTLS/ESP) : VPN VPN . -g,--usergroup=GROUP URL HTTPS . (realm) . OpenConnect : openconnect --usergroup=loginPath vpn.server.com openconnect https://vpn.server.com/loginPath -F,--form-entry=FORM:OPTION[=VALUE] FORM OPTION VALUE . ( --user ) : --form-entry main:username=joebloggs. VALUE . . --passwd-on-stdin . OpenConnect --passwd-on-stdin . -h,--help --http-auth=METHODS HTTP . Negotiate NTLM Digest . Basic . . : OpenConnect Negotiate NTLM Digest Basic METHODS . --external-browser=BROWSER BROWSER OpenConnect single-sign-on-external-browser . -i,--interface=IFNAME IFNAME -l,--syslog syslog --timestamp --passtos TOS / TCLASS DTLS ESP. ( /). -U,--setuid=USER USER --csd-user=USER (CSD TNCC HIP). --csd-wrapper=SCRIPT SCRIPT . --force-trojan=INTERVAL INTERVAL ( ) / . -m,--mtu=MTU MTU MTU . --base-mtu=MTU MTU MTU . MTU . -p,--key-password=PASS [,--mca-key-password=PASS] SRK ( ) TPM --mca-key-password ( --mca-certificate ). -P,--proxy=PROXYURL HTTP SOCKS . URL . NTLM ntlm_auth GSSAPI . --proxy-auth=METHODS HTTP . Negotiate NTLM Digest . Basic . . : OpenConnect Negotiate NTLM Digest Basic METHODS . --no-proxy --libproxy libproxy ( libproxy) --key-password-from-fsid fsid . fsid statvfs(2) statfs(2) . GNU coreutils fsid : stat --file-system --printf=%i\\n $CERTIFICATE UUID . -q,--quiet -Q,--queue-len=LEN LEN . . (latency) . Voice over IP VPN . OpenConnect (SO_SNDBUF) . " ". (bufferbloat) . VPN . OpenConnect vhost-net . vhost- net . . -s,--script=SCRIPT SCRIPT . . vpnc-script VPN "vpnc" . https://www.infradead.org/openconnect/vpnc-script.html . OpenConnect /etc/vpnc/vpnc-script . openconnect . cscript.exe . -S,--script-tun 'script' UNIX tun/tap . IP VPN lwIP SOCKS VPN . --server=[https://]HOST[:PORT][/PATH] VPN HOST URL HOST PORT PATH realm --usergroup . VPN . -u,--user=NAME NAME -V,--version -v,--verbose ( ) -x,--xmlconfig=CONFIG XML --authgroup=GROUP GROUP . VPN . authgroup ( VPN ) realm ( ) domain () gateway () . . --authenticate VPN . OpenConnect VPN stdout : COOKIE='3311180634@13561856@1339425499@B315A0E29D16C6FD92EE...' HOST='10.0.0.1' CONNECT_URL='https://vpnserver.example.com' FINGERPRINT='469bb424ec8835944d30bc77c77e8fc1d8e23a42' RESOLVE='vpnserver.example.com:10.0.0.1' openconnect ( PKCS#11 ) openconnect (root) : eval `openconnect --authenticate https://vpnserver.example.com`; [ -n ["$COOKIE"] ] && echo ["$COOKIE"] | sudo openconnect --cookie-on-stdin $CONNECT_URL --servercert $FINGERPRINT --resolve $RESOLVE OpenConnect HOST ( ) CONNECT_URL RESOLVE. DNS VPN path URL CONNECT_URL RESOLVE . OpenConnect ( Bourne) : sudo openconnect --cookie-on-stdin ${CONNECT_URL:-$HOST} --servercert $FINGERPRINT ${RESOLVE:+--resolve=$RESOLVE} --cookieonly ( --authenticate ). --printcookie stdout ( --authenticate ) --cafile=FILE CA . OpenConnect () CA . --no-system-trust OpenConnect . --no-system-trust . --cafile ( ) . --disable-ipv6 IPv6 --dtls-ciphers=LIST OpenSSL DTLS --dtls12-ciphers=LIST OpenSSL DTLS 1.2 --dtls-local-port=PORT PORT DTLS UDP --dump-http-traffic HTTP . --pfs (PFS). . PFS TLS . PFS ASA 9.1(2) ssl encryption . --no-dtls DTLS ESP --no-http-keepalive 8.2.2.5 Cisco ASA HTTP SSL . HTTP/1.0 Connection: Keep-Alive . OpenConnect 2.22 HTTP/1.0 . . HTTP . . openconnect-devel@lists.infradead.org . --no-passwd ( SecurID) . --no-external-auth OpenConnect . "" . --no-xmlpost / POST XML GET . . OpenConnect (4.08 ) . OpenConnect . https://www.infradead.org/openconnect/mail.html . --allow-insecure-crypto 3DES RC4 . VPN . SHA1 . --non-inter . --passwd-on-stdin --protocol=PROTO VPN PROTO . : anyconnect AnyConnect () nc Network Connect ( Ivanti/Pulse Connect Secure ) pulse Ivanti/Pulse Connect Secure gp GlobalProtect f5 Big-IP fortinet Fortigate array SSL VPN (Array Networks). https://www.infradead.org/openconnect/protocols.html . OpenConnect Pulse Host Checker/TNCC Pulse . VPN Junos/Ivanti Pulse --protocol=pulse --protocol=nc . --token-mode=MODE MODE. --token-mode=rsa libstoken RSA SecurID --token-mode=totp RFC 6238 --token-mode=hotp HMAC RFC 4226 . Yubikey OATH --token-mode=yubioath . --token-mode=oidc OpenIDConnect (bearer token) RFC 6750 . --token-secret={ SECRET[,COUNTER] | @FILENAME } / . TOTP/HOTP Base 32 "base32:" HOTP . RSA SecurID URI / CTF ( ) . Yubikey OATH . OATH . OIDC (bearer token) . FILENAME . XML SecurID (SDTID) . --token-mode "rsa" libstoken ~/.stokenrc "stoken import" . --reconnect-timeout=SECONDS (Dead Peer Detection) SECONDS . openconnect VPN . --resolve=HOST:IP HOST IP . --sni=HOST TLS HOST SNI ( ) 'Host:' HTTP SNI . Domain Fronting . SNI 'Host:' HTTP . --servercert=HASH SSL (fingerprint) . --no-system-trust . SHA1 SHA256 PIN-SHA256. 'sha1:' 'sha256:' 'pin-sha256:' . 'pin- sha256:' PIN RFC7469 base64 . . --useragent=STRING STRING 'User-Agent:' HTTP. VPN VPN . VPN --useragent 'AnyConnect Windows 4.10.06079' --useragent 'Cisco AnyConnect VPN Agent for Windows 2.2.0133' Pulse --useragent 'Pulse-Secure/9.1.11.6725'. --version-string=STRING STRING (head end). ( --version-string '2.2.0133') --local-hostname=STRING STRING 'X-CSTP-Hostname:' HTTP. --local-hostname 'mypc' 'mypc' IP . --os=STRING . : linux linux-64 win mac-intel android apple-ios. (DAP) VPN . CSD CSD --csd-wrapper . (SIGNALS) : SIGINT / SIGTERM (logout) vpnc-script . SIGHUP vpnc-script --cookie . SIGUSR1 . SIGUSR2 IP (LAN) . (LIMITATIONS) OpenConnect https://www.infradead.org/openconnect/contribute.html VPN https://www.infradead.org/openconnect/protocols.html . (SEE ALSO) ocserv(8) (AUTHORS) David Woodhouse OPENCONNECT(8)