26

I am trying to use Cisco anyconnect 3.1 from Linux command line to connect to a server. I can connect, but I have to submit one parameter at a time. I would like to connect from a script that will run in another server. Can I do that? Something like 

vpn connect server_add group_name user_name passwd
|improve this question
  • Please show us the command you want to use. Have you tried using delimiters? – Tog Sep 24 '13 at 12:00
  • The command was /opt/cisco/anyconnect/bin/vpn connect 10.1.1.1 But after that it connects and asks for username, password and group. What I want is to pass all this in one line. But I cannot find any docs on this. Just on using the graphical interface client. – Kelly Goedert Sep 24 '13 at 16:59
25

Assuming /opt/cisco/anyconnect/bin/vpnagentd is running as it automatically should be:

To connect:

printf 'USERNAME\nPASSWORD\ny' | /opt/cisco/anyconnect/bin/vpn -s connect HOST

Replace USERNAME, PASSWORD, and HOST. The \ny at the end is to accept the login banner - this is specific to my host.

Note the single quotes ' instead of double quotes " - this is because double quotes tell Bash to interpret certain characters within strings, such as exclamation marks, as Bash history commands. Double quotes will make this command fail with an "event not found" error if the password contains an exclamation mark. Single-quoted strings pass exclamation marks along without interpreting them.

To disconnect:

/opt/cisco/anyconnect/bin/vpn disconnect

This was tested with AnyConnect v3.1.05160.

|improve this answer
  • 5
    In case your client does not connect due to certificate validation error Certificate is from an untrusted source, and you still want to connect then pass a y parameter in the above method so that the command to connect becomes: printf "y\nUSERNAME\nPASSWORD\ny" | /opt/cisco/anyconnect/bin/vpn -s connect HOST. Note that do this only in the case that you absolutely trust your connection; otherwise there might be a middleman sitting in and snooping onto you. – shivams Apr 22 '15 at 11:38
4

I ran into the same difficulty try to use Cisco AnyConnect from Mac OS X Terminal. To get the Cisco vpn command to take its input from standard input, you have to specify the -s option, which puts the Cisco vpn command into interactive mode. Then you can provide the responses that you give in interactive mode.

The responses that you need to give depend upon how the VPN server administrator has configured the server. For me, the vpn interactive prompts are 

Group: 
Username: 
Password: 

Blah, blah, blah, ...
accept? :

So the command that I run is 

$ /opt/cisco/anyconnect/bin/vpn -s connect vpn.example.com <<"EOF"
0
username
password
y
exit
EOF

(The quotes around EOF are to prevent command/parameter expansion/substitution in the following input.)

The exit at the end is to exit the Cisco vpn interactive mode.

|improve this answer
2

I like to simplify the command line, so I use the above approach in a shell script named gotowork. As above, I need to provide the group, my user name, and a passkey composed of a private PIN plus a RSA SecurID passcode. I don't have to answer the above "accept?" question. Everything but the RSA passcode is in the script, so the command line is

$ gotowork <RSA passcode>

I have to run it as root. Assume the PIN is 1234. The script essentials: 

# put the interactive answers into a text file
echo -e "0\nusername\n1234$1\n" > /tmp/answers.txt
# find the path to the anyconnect executables
ciscopath="$(dirname $(find /opt/cisco -depth -name vpnagentd))"
# make sure the anyconnect daemon is running
[ $(pidof vpnagentd) ] || $ciscopath/vpnagentd
# connect
$ciscopath/vpn -s < /tmp/answers.txt connect remote.mycompany.com

Using anyconnect 3.1.05170. Tested on Debian 6, LinuxMint 17

|improve this answer
  • Why is 0\n necessary? Or is it specific to your company? – Acumenus Nov 9 '14 at 5:10
  • @A-B-B That's just saying output a zero 0, followed by a newline \n followed by username, followed by a newline \n etc... – Matt Friedman Jan 22 '15 at 21:39
  • @MattFriedman, I know what it's saying, but I don't know why it's necessary at all. – Acumenus Jan 22 '15 at 23:02
  • 1
    @A-B-B When running interactively and your connection uses groups, the possible groups will be enumerated. 0 then means "use the first group". – jmd_dk Mar 6 '18 at 5:24
2

This is what worked for me on OSX El Capitan. Placeholders are surrounded by [square braces].

To Enable

/opt/cisco/anyconnect/bin/vpn -s connect [HOST_ADDRESS] <<"EOF"
[VPN_USERNAME]
[VPN_PASSWORD] 
y
EOF

To Disable

/opt/cisco/anyconnect/bin/vpn disconnect

*I know this is similar to Peter S.'s answer above.

|improve this answer
  • 1
    This worked for me in one command for El Capitan, printf "y\n[GROUP]\n\n[PASSWORD]\ny\n" | /opt/cisco/anyconnect/bin/vpn -s connect HOST – Rabea Nov 23 '16 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.