├── images ├── vpn-connected.png └── vpn-disconnected.png ├── README.md ├── openconnect.sh └── LICENSE /images/vpn-connected.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ventz/openconnect-gui-menu-bar/HEAD/images/vpn-connected.png -------------------------------------------------------------------------------- /images/vpn-disconnected.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ventz/openconnect-gui-menu-bar/HEAD/images/vpn-disconnected.png -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ### OpenConnect - OS X/Mac OS GUI Menu Bar for connecting/disconnecting 2 | 3 | # What is this? 4 | 5 | An easy way to get OpenConnect VPN to have an OS X/Mac OS Menu Bar GUI for: 6 | * quick connecting 7 | * quick disconnect 8 | * status changes (icon) 9 | 10 | Full support for multi-factor authentication (especially Duo)! 11 | 12 | ![OpenConnect Connected](https://github.com/ventz/openconnect-gui-menu-bar/blob/master/images/vpn-connected.png) 13 | 14 | ![OpenConnect Disconnected](https://github.com/ventz/openconnect-gui-menu-bar/blob/master/images/vpn-disconnected.png) 15 | 16 | # How to run it: 17 | 18 | ## 1. Get the latest BitBar release: 19 | https://github.com/matryer/bitbar/releases 20 | 21 | BitBar provides an easy way to put "things" (for output and input) in your OS X/Mac OS Menu Bar. 22 | 23 | Just unzip the release in your /Application folder and launch BitBar. 24 | It will ask you to create (or select) a folder to use for your scripts. 25 | 26 | Obviously make sure you have installed openconnect too :) 27 | `brew install openconnect` 28 | 29 | ## 2. Edit the "openconnect.sh" and follow the steps inside to customize: 30 | 31 | Start by just getting the file itself: 32 | https://raw.githubusercontent.com/ventz/openconnect-gui-menu-bar/master/openconnect.sh 33 | 34 | Make sure you make it executable: `chmod 755 openconnect.sh` once you download it. 35 | 36 | This file is the "script" that interacts with BitBar. Place 37 | it in your bitbar scripts folder (I have chosen: 38 | ~/Documents/bitbar-plugins/), and edit it/follow these steps: 39 | 40 | ### First - Update your sudoers file with: 41 | 42 | You can create a `/etc/sudoers.d/openconnect` file which contains: 43 | ``` 44 | mac-username ALL=(ALL) NOPASSWD: /usr/local/bin/openconnect 45 | mac-username ALL=(ALL) NOPASSWD: /usr/bin/killall -2 openconnect 46 | ``` 47 | 48 | Please note that `mac-username` is not a literal, but the actually the 'whoami' username for OS X/Mac OS. 49 | 50 | ### Second - Make sure your openconnect binary is here: 51 | ``` 52 | VPN_EXECUTABLE=/usr/local/bin/openconnect 53 | ``` 54 | 55 | ### Third - add your VPN domain and VPN username and set Auth for "push" or "pin" 56 | ``` 57 | VPN_HOST="vpn.domain.tld" 58 | # NOTE: If you are using a VPN_GROUP (ex: domain.tld/group) -- use this, instead of "#VPN_TUNNEL" within VPN_USERNAME 59 | VPN_GROUP="VPN_GROUP_TUNNEL" 60 | VPN_USERNAME="vpn_username@domain.tld#VPN_TUNNEL_OPTIONALLY" 61 | 62 | # Duo options include "push", "sms", or "phone" 63 | PUSH_OR_PIN="push" 64 | * or * 65 | # To be prompted for TOTP input, use product name: 66 | PUSH_OR_PIN="Yubikey" 67 | or 68 | PUSH_OR_PIN="Google Authenticator" 69 | or 70 | PUSH_OR_PIN="Duo" 71 | 72 | ``` 73 | 74 | ### Finally, create your KeyChain password (to store your VPN password securely): 75 | ``` 76 | a.) Open "Keychain Access" and 77 | b.) Click on "login" keychain (top left corner) 78 | c.) Click on "Passwords" category (bottom left corner) 79 | d.) From the "File" menu, select -> "New Password Item..." 80 | e.) For "Keychain Item Name" and "Account Name" use the "VPN_HOST" and "VPN_USERNAME" values respectively from the "Third" step above. 81 | f.) For "Password" enter your VPN AnyConnect password. 82 | ``` 83 | 84 | That's it! Now you can use the GUI to connect and disconnect! 85 | (and if you are using Duo - get the 2nd factor push to your phone) 86 | 87 | 88 | # Problems Connecting? 89 | 90 | If you have another VPN (ex: OpenVPN), you might already have an 91 | 'utun0' interface. Please check with '/sbin/ifconfig'. If that's the 92 | case, in step #2 above you need to add: 93 | 94 | ``` 95 | VPN_INTERFACE="utun1" 96 | ``` 97 | 98 | If you already have an utun0 and an utun1, then you need to 99 | change it to the next available, ex: utun2. 100 | 101 | In order to make sure this doesn't happen - I've chosen 'utun99' 102 | 103 | # Help/Questions/Comments: 104 | For help or more info, feel free to contact me or open an issue here! 105 | -------------------------------------------------------------------------------- /openconnect.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Credit for original concept and initial work to: Jesse Jarzynka 3 | # 4 | # Updated by: Ventz Petkov (11-08-23) 5 | # * Modified VPN_EXECUTABLE default path due to dir change within `brew` on M-series Macs (m1, m2, m3) to /opt/homebrew/ 6 | # * Modified sudoers to reflect new openconnect VPN_EXECUTABLE path 7 | # * Cleaned up KeyChain instructions around KeyChain Item name vs Account Name 8 | # 9 | # Updated by: Ventz Petkov (7-25-23) 10 | # * added useragent for AnyConnect (needed for recent deployments) 11 | # * added "VPN_GROUP" option, which is replacing the phased out "#VPN_TUNNEL_OPTIONALLY" within the "VPN_USERNAME" 12 | 13 | # Updated by: Ventz Petkov (8-31-18) 14 | # * merged feature for token/pin input (ex: Duo/Yubikey/Google Authenticator) contributed by Harry Hoffman 15 | # * added option to pick "push/sms/phone" (ex: Duo) vs token/pin (Yubikey/Google Authenticator/Duo) 16 | 17 | # Updated by: Ventz Petkov (11-15-17) 18 | # * cleared up documentation 19 | # * incremented 'VPN_INTERFACE' to 'utun99' to avoid collisions with other VPNs 20 | 21 | # Updated by: Ventz Petkov (9-28-17) 22 | # * fixed for Mac OS X High Sierra (10.13) 23 | 24 | # Updated by: Ventz Petkov (7-24-17) 25 | # * fixed openconnect (did not work with new 2nd password prompt) 26 | # * added ability to work with "Duo" 2-factor auth 27 | # * changed icons 28 | 29 | # VPN Status 30 | # v1.1 31 | # Ventz Petkov 32 | # ventz 33 | # Connect/Disconnect OpenConnect + show status 34 | # 35 | 36 | ######################################################### 37 | # USER CHANGES # 38 | ######################################################### 39 | 40 | # 1.) Updated your sudo config with (edit "mac-username" with your username): 41 | # (NOTE: You can obtain the "mac-username" with "whoami" in a terminal) 42 | #mac-username ALL=(ALL) NOPASSWD: /opt/homebrew/bin/openconnect 43 | #mac-username ALL=(ALL) NOPASSWD: /usr/bin/killall -2 openconnect 44 | 45 | 46 | # 2.) Make sure openconnect binary is located here: 47 | # (If you don't have it installed: "brew install openconnect") 48 | VPN_EXECUTABLE=/opt/homebrew/bin/openconnect 49 | 50 | 51 | # 3.) Update your AnyConnect VPN host 52 | VPN_HOST="vpn.domain.tld" 53 | # NOTE: If you are using a VPN_GROUP (ex: domain.tld/group) -- use this, instead of "#VPN_TUNNEL" within VPN_USERNAME 54 | VPN_GROUP="VPN_GROUP_TUNNEL_OPTIONALLY" 55 | 56 | # 4.) Update your AnyConnect username + tunnel 57 | # NOTE: If you are NOT using the VPN_GROUP, set it to empty, and use "#VPN_TUNNEL" within the VPN_USERNAME 58 | VPN_USERNAME="vpn_username@domain.tld#VPN_TUNNEL_OPTIONALLY" 59 | 60 | # 5.) Push 2FA (ex: Duo), or Pin/Token (ex: Yubikey, Google Authenticator, TOTP) 61 | PUSH_OR_PIN="push" 62 | #PUSH_OR_PIN="Yubikey" 63 | # --- 64 | # * For Push (and other Duo specifics), options include: 65 | # "push", "sms", or "phone" 66 | # --- 67 | # * For Yubikey/Google Authenticator/other TOTP, specify any name for prompt: 68 | # "any-name-of-product-to-be-prompted-about" 69 | # PUSH_OR_PIN="Yubikey" | PUSH_OR_PIN="Google Authenticator" | PUSH_OR_PIN="Duo" 70 | # (essentially, anything _other_ than the "push", "sms", or "phone" options) 71 | # --- 72 | 73 | # 6.) Create an encrypted password entry in your OS X Keychain: 74 | # a.) Open "Keychain Access" and 75 | # b.) Click on "login" keychain (top left corner) 76 | # c.) Click on "Passwords" category (bottom left corner) 77 | # d.) From the "File" menu, select -> "New Password Item..." 78 | # e.) For "Keychain Item Name" "VPN_HOST" (ex: vpn.domain.tld) 79 | # f.) For "Account Name" use the value for "VPN_USERNAME" (ex: email@domain.tld) 80 | # g.) For "Password" enter your VPN AnyConnect password. 81 | 82 | # This will retrieve that password securely at run time when you connect, and feed it to openconnect 83 | # No storing passwords unenin plain text files! :) 84 | GET_VPN_PASSWORD="security find-generic-password -wl $VPN_HOST" 85 | 86 | # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 87 | # END-OF-USER-SETTINGS # 88 | ######################################################### 89 | 90 | VPN_INTERFACE="utun99" 91 | 92 | # Command to determine if VPN is connected or disconnected 93 | VPN_CONNECTED="/sbin/ifconfig | grep -A3 $VPN_INTERFACE | grep inet" 94 | # Command to run to disconnect VPN 95 | VPN_DISCONNECT_CMD="sudo killall -2 openconnect" 96 | 97 | # GUI Prompt for your token/key (ex: Duo/Yubikey/Google Authenticator) 98 | function prompt_2fa_method() { 99 | if [ "$1" == "push" ]; then 100 | echo "push" 101 | elif [ "$1" == "sms" ]; then 102 | echo "sms" 103 | elif [ "$1" == "phone" ]; then 104 | echo "phone" 105 | else 106 | osascript <