UCI VPN Guide

The UCI VPN is necessary to access Openlab and some library databases from off-campus. It uses Cisco's AnyConnect protocol. Although Cisco has a version of AnyConnect for Linux, users have reported some issues with it. This guide explains how to use OpenConnect, which is an open source alternative.

Prerequisites

Install OpenConnect.

AnyConnect expects you to run a trojan on your computer during the authentication process. OpenConnect does not allow you to connect to the UCI VPN without addressing this issue. You need either a csd-post.sh which fakes the trojan or a csd-wrapper.sh which runs the trojan. You can find these on OpenConnect's GitLab, or in /usr/libexec/openconnect on an FHS compliant system. If you have OpenConnect installed through Nix, the scripts are in $(nix eval --raw nixpkgs#openconnect.out)/libexec/openconnect.

csd-post.sh requires the hostname and curl commands to be available in your PATH. Keep this in mind if you run it inside of a systemd service.

Connection Methods

Command Line

1. Run sudo openconnect --protocol=anyconnect --csd-wrapper=<path to csd-post.sh> --authgroup UCI-classic vpn.uci.edu or sudo openconnect --protocol=anyconnect --csd-wrapper=<path to csd-post.sh> --authgroup UCIFull-classic vpn.uci.edu
2. Enter your UCI net ID
3. Enter your UCI password
4. Enter push
5. Accept the Duo request

The non-classic authgroups do not allow stdin authentication. OpenConnect has a --external-browser flag for this, but this causes a No SSO handler error to be output. openconnect-sso may be able to fix this, but the repo has been abandoned so using it is not advised.

Frontends

You will likely need to install the networkmanager-openconnect plugin to get the option to add an AnyConnect VPN. On NixOS, you can do this by adding pkgs.networkmanager-openconnect to networking.networkmanager.plugins.

Warning

There is a known bug in Openconnect frontends where your GROUP selection is ignored. Use the command-line guide if you need UCIFull for library databases.

nm-applet

Warning

If you're using an NVIDIA GPU, run nm-applet with the environment variable WEBKIT_DISABLE_DMABUF_RENDERER=1 or else you may see intense flickering on the login webpage.

1. Run nm-applet or WEBKIT_DISABLE_DMABUF_RENDERER=1 nm-applet
2. Under VPN Connections, select Configure VPN...
3. Create a Cisco AnyConnect or OpenConnect (OpenConnect) VPN with the following settings:
   1. General:
      1. All users may connect to this network: True
   2. VPN:
      1. Gateway: vpn.uci.edu
      2. User Agent: AnyConnect
      3. Allow security scanner trojan (CSD): True
      4. Trojan (CSD) Wrapper Script: See Prerequisites
4. In the applet, select the VPN you just created
5. Select any GROUP
6. Log in using the webpage

GNOME

1. Open Network
2. Select Add VPN
3. Select Multi-protocol VPN client (openconnect)
4. Configure the VPN with the following settings:
5. Details:
   1. Make available to other users: True
6. Identity:
   1. Gateway: vpn.uci.edu
   2. User Agent: AnyConnect
   3. Allow security scanner trojan (CSD): True
   4. Trojan (CSD) Wrapper Script: See Prerequisites
7. Enable the VPN
8. In the VPN dialog, select Connect
9. Select any GROUP
10. Select Login
11. Log in using the webpage

plasma-nm (KDE)

1. Open Wi-Fi & Networking settings
2. Select Add new connection
3. Select Cisco AnyConnect Compatible VPN (openconnect)
4. Configure the VPN with the following settings:
5. General:
   1. All users may connect to this network: True
6. VPN (openconnect):
   1. Gateway: vpn.uci.edu
   2. User Agent: AnyConnect
   3. Allow security scanner trojan (CSD): True
   4. Trojan (CSD) Wrapper Script: See Prerequisites
7. Connect to the VPN you just created. KDE Wallet might open up, but using it is optional.
8. In the VPN secrets dialog, select Connect
9. Select any GROUP
10. Select Login
11. Log in using the webpage

NixOS Configuration

This repository has a flake with a NixOS module that configures the UCI VPN for you. All you need to do is pick a front-end and UCI will be in your VPN list.