15

The Problem

I've got a Cisco IPSEC VPN connection in my network settings on a Yosemite machine. It works fine, aside from prompting for a password on every single connection. The saved password is ignored entirely.

Background

If I enter the password under the network settings and click connect, the saved password vanishes, and the dialog prompting for a password appears. I've verified that the password is correct (it's copy-pasted from a document).

Things that didn't work

  • A suggested solution to this for Snow Leopard was to save the password, open Keychain Access, locate the "Xauth" key in the system keychain, and grant /usr/libexec/configd access to the key. This had no effect.

  • Usual permissions repair/disk check stuff

Weird stuff

If I watch keychain access while hitting the connect button, the saved password vanishes outright from the keychain right when the dialog appears.

Overall Question

How do I get the password correctly saved so I don't have to rekey it on every connection?

  • hmm. I also get weird authentication issues on Yosemite especially in the Network dialogue. Wouldn't be surprised if there is a bug involved. – n1000 Aug 4 '15 at 19:15
  • Are you sure it doesn't depends on remote VPN policies (now allowing password saving)? – Matteo Guarnerio Aug 5 '15 at 20:47
  • That.. would explain why it straight-up disappears from the keychain if explicitly saved. Will have to have a chat with the network admins! – Mikey T.K. Oct 8 '15 at 3:09
10

I guess you are using anyconnect to connect to the Cisco VPN server. AnyConnect can also be used from Terminal. This works on macOS Sierra and AnyConnect 3.1.14018. Create a bash script with the following command:

/opt/cisco/anyconnect/bin/vpn connect your-vpn.server.here -s <.credentials

And put the login details in the file .credentials with the following three lines:

0
your-username
your-password

Don't forget to put reasonable permissions on the files.

  • User states "I've got a Cisco IPSEC VPN connection in my network settings on a Yosemite machine". This choice of words led me to conclude with rather high certainty that they are using the build-in VPN solution inside System Preferences/Network/+ – GhostLyrics Dec 2 '16 at 12:13
  • can you pass that file through somehow with the usernames &/or passwords encrypted? like with the passwords file on linux – forgotstackxpassword Dec 2 '16 at 23:42
8

From reading your question I get the impression that you're doing everything correctly and the Cisco VPN Server has the option to allow saving of passwords client-side set to disallow.

I know for certain that such a setting exists.

  • 6
    It's still annoying that the OS X client allows this disallow setting. Much like compiling okular without DRM support in order to copy a sentence from a peer-reviewed journal, it seems that this is a fundamentally user unfriendly setting. – Landak Jul 23 '16 at 12:28
2

Both answers here as I write this have the right of it, but the existence of the vpn command line means that we can get around this user-hostile design with expect. Thanks go to the previous answerers, GhostLyrics for revealing the existence of the server side option that turns off password saving, and Hans for revealing the vpn command line client.

Create a file that looks like this:

#!/usr/bin/expect --
set timeout 10
set addr ""  # VPN Host
set user ""  # Username
set pass ""  # Password (ensure that special characters are escaped)
set group "" # Group NUMBER shown in connect prompt


spawn /opt/cisco/anyconnect/bin/vpn connect $addr
expect "\r\nGroup:*"
send -- "$group\r"
expect "\r\nUsername:*"
send -- "$user\r"
expect "Password: "
send -- "$pass\r"
expect eof

Fill out the set fields as normal. If your VPN is like mine, you're given a list of "groups" when you run the vpn connect. Run this once by hand, and note which number corresponds to the group you want to connect with. It won't change between runs unless the admins add/remove groups. You can't use the name here, the program expects a number.

Once everything is filled in, chmod +x this script and run it. I am now able to connect to my VPN, hands free!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .