forked from bechampion/gohip
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1 from grumlimited/static
Static
- Loading branch information
Showing
24 changed files
with
306 additions
and
160 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1,40 @@ | ||
| # gohip | ||
| gohip | ||
| ===== | ||
|
|
||
| The HIP ( `Host Integrity Protection`) mechanism is a security scanner for the Palo Alto Networks GlobalProtect VPNs, in the same vein as Cisco's CSD and Juniper's Host Checker ([source](https://www.infradead.org/openconnect/hip.html)). | ||
|
|
||
| # Installation | ||
|
|
||
| Download and install `gohip` from the [releases page](https://github.com/bechampion/gohip/releases). | ||
|
|
||
| The packaged version will drop a file in `/etc/vpnc/post-connect.d/split.sh`. If you opted to install the binary manually, you can create this file manually should you want to use the _splitvpn_ feature. | ||
|
|
||
| # Usage | ||
|
|
||
| Create file `/etc/vpnc/splitvpn` with the following content: | ||
|
|
||
| MAIN_DEV="enp0s31f6" # Your main network interface | ||
| GW="192.168.1.254" # Your gateway | ||
|
|
||
| You can determine those values with | ||
|
|
||
| ip -json r get 1.1.1.1 | jq '.[]| "MAIN_DEV=\"\(.dev)\" \nGW=\"\(.gateway)\""' -r | ||
|
|
||
| Then start the vpn client with | ||
|
|
||
| sudo -E gpclient connect --hip --csd-wrapper /usr/bin/gohip vpn.endpoint.com | ||
|
|
||
| # Using your default browser (so creds are remembered , hsm etc) | ||
|
|
||
| You can pass `--default-browser` to `gpclient` if your in version `2.3.2` at least, and that should open on what `xdg-config` says | ||
|
|
||
| sudo -E gpclient connect --hip --csd-wrapper /path/to/gohip vpn.endpoint.com --default-browser | ||
|
|
||
|
|
||
| To set your default browser you can do | ||
|
|
||
| xdg-settings set default-web-browser firefox.desktop | ||
|
|
||
|
|
||
| ## Notes | ||
| If you use firefox/chrome from snaps this will not work, gpclient drops a file on `/tmp` that needs to be reachable by the browser and that doesn't work with snaps |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| # THIS SCRIPT IS PART OF gohip. DO NOT MODIFY IT UNLESS YOU KNOW WHAT YOU ARE DOING. | ||
|
|
||
| set -e | ||
|
|
||
| CONFIG_FILE=/etc/vpnc/splitvpn | ||
|
|
||
| if [[ ! -f $CONFIG_FILE ]]; then | ||
| echo "$CONFIG_FILE does not exist. Split tunneling will not be active. Please create it with the following content if you want to activate:" | ||
| cat << EOF | ||
| # beginning | ||
| MAIN_DEV="enp0s31f6" # Your main network interface | ||
| GW="192.168.1.254" # Your gateway | ||
| # end | ||
| You can determine those values with | ||
| ip -json r get 1.1.1.1 | jq '.[]| "MAIN_DEV=\"\(.dev)\" \nGW=\"\(.gateway)\""' -r | ||
| EOF | ||
| exit 0 | ||
| fi | ||
|
|
||
| VPN_NET="10/8" | ||
| VPN_DEV="tun0" | ||
|
|
||
| . $CONFIG_FILE | ||
|
|
||
| ip route del default | ||
| ip route add default via $GW dev $MAIN_DEV | ||
| ip route add $VPN_NET dev $VPN_DEV | ||
|
|
||
| exit 0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "errors" | ||
| systemd "github.com/bechampion/gohip/systemd" | ||
| ) | ||
|
|
||
| func RunPreflightChecks() error { | ||
| clamavError := systemd.DefaultDbAgeCheck() | ||
|
|
||
| return errors.Join(clamavError) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.