{"id":18086218,"url":"https://github.com/s3rj1k/openconnect-systemd-credentials","last_synced_at":"2025-08-20T06:31:47.600Z","repository":{"id":246595884,"uuid":"821420968","full_name":"s3rj1k/openconnect-systemd-credentials","owner":"s3rj1k","description":"This is Systemd Credentials helper for OpenConnect VPN client","archived":false,"fork":false,"pushed_at":"2024-07-05T15:59:09.000Z","size":12,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-10-31T16:07:16.437Z","etag":null,"topics":["golang","ld-preload","ldpreload","openconnect","openconnect-vpn-client","otp","otpauth","systemd","systemd-credentials","vpn"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/s3rj1k.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-28T13:55:09.000Z","updated_at":"2024-07-05T15:59:12.000Z","dependencies_parsed_at":"2024-06-28T23:49:51.429Z","dependency_job_id":null,"html_url":"https://github.com/s3rj1k/openconnect-systemd-credentials","commit_stats":null,"previous_names":["s3rj1k/openconnect-systemd-credentials"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s3rj1k%2Fopenconnect-systemd-credentials","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s3rj1k%2Fopenconnect-systemd-credentials/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s3rj1k%2Fopenconnect-systemd-credentials/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s3rj1k%2Fopenconnect-systemd-credentials/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/s3rj1k","download_url":"https://codeload.github.com/s3rj1k/openconnect-systemd-credentials/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230400874,"owners_count":18219819,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","ld-preload","ldpreload","openconnect","openconnect-vpn-client","otp","otpauth","systemd","systemd-credentials","vpn"],"created_at":"2024-10-31T16:07:19.485Z","updated_at":"2024-12-19T07:43:13.077Z","avatar_url":"https://github.com/s3rj1k.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# openconnect-systemd-credentials\n\n`openconnect-systemd-credentials` is an LD_PRELOAD library designed to supply VPN password \nfrom systemd-credentials store in to the OpenConnect VPN client and also optional OTP code from\nGolang-based OTP helper that also uses systemd-credentials store as storage for OTPAuth URL.\n\n## Features of LD_PRELOAD library\n\n- Output (authentication data) of custom command in `AUTH_CMD` environment variable is fed directly into OpenConnect's stdin.\n\n## Features of OC-OTP, Golang-based OTP helper\n\n- CLI flag `--config` - OpenConnect VPN config file location.\n- CLI flag `--otp-auth-key` - Secret key name for OTP Authentication URL.\n- CLI flag `--form-entry` - OpenConnect VPN config \"form-entry\" key name.\n\n## Compiling LD_PRELOAD library from source\n\n```bash\ngit clone https://github.com/s3rj1k/openconnect-systemd-credentials.git\ncd openconnect-systemd-credentials\nmake build\n```\n\n## Compiling OTP helper from source\n\n```bash\ngit clone https://github.com/s3rj1k/openconnect-systemd-credentials.git\ncd openconnect-systemd-credentials/go-oc-otp\nmake build\n```\n\n## Usage\n\n### Systemd service without OTP\n\n```\n[Unit]\nDescription=OpenConnect VPN\nAfter=network-online.target\nWants=network-online.target\nConditionUser=user\n\n[Service]\nType=simple\nKillMode=process\nRestart=always\nNoNewPrivileges=true\n\n# echo \"PASSWORD\" | sudo systemd-creds --with-key=tpm2 encrypt --pretty --name=OC_PASSWORD - -\nSetCredentialEncrypted=OC_PASSWORD: \\\n        DHzAexF2RZGcSwvqCLwg/iAAAAABAAAADAAAABAAAADqnHcKWcEtC4FtZJEAAAAAgAAAA \\\n        AAAAAALACMA8AAAACAAAAAAngAgldNq2CiPI2eIy3OAjOZlr8YCMRSogofDbVYvyR0s7v \\\n        0AECcGKjw4kBmpVBTPleIZoj5C8xO1b+n4BKjnUhwoGmUgFbeuCNNeh6y5D65Sir5SgIY \\\n        jraaBP6mT4WtUnV/D7oCttz21xzCtmfLDyqEaubfn2hxdm2Rk5CHP3qTTQ+3jKsmxOZdY \\\n        a0DVwHU2yKcKc9fUAVm8Sawf3PfhAE4ACAALAAAEEgAgIzKGpj9Fg1oMKJxo68mDGilVf \\\n        aw/kHWM8tSQi+rVB6wAEAAgycDccKN01NLFIs/Shc1JKiZIyIgIdSQWTOEX+GArKvEjMo \\\n        amP0WDWgwonGjryYMaKVV9rD+QdYzy1JCL6tUHrAAAAADQBUETk4CIshkQpkHsP2p4lMf \\\n        jnKa4PcPasVt7KgaLAX8JmRE4TP0k7Di8+LFLFLFaH5w+X6TOLik=\n\nPrivateTmp=true\nPrivateMounts=true\nProtectHome=tmpfs\nProtectSystem=strict\n\nEnvironment=\"AUTH_CMD=/usr/bin/systemd-creds --with-key=tpm2 cat OC_PASSWORD\"\nEnvironment=\"LD_PRELOAD=/usr/lib/oc-password.so\"\n\nExecStart=/usr/bin/openconnect \\\n        --disable-ipv6 \\\n        --http-auth=Basic \\\n        --local-hostname=user.local \\\n        --no-deflate \\\n        --no-dtls \\\n        --no-external-auth \\\n        --no-proxy \\\n        --non-inter \\\n        --os=linux-64 \\\n        --passwd-on-stdin \\\n        --protocol=anyconnect \\\n        --script-tun \\\n        --script=\"/usr/bin/ocproxy --dynfw 1080 --keepalive 60 --verbose\" \\\n        --server=https://vpn.domain.net \\\n        --user=user \\\n        --verbose\n\n[Install]\nWantedBy=default.target\n```\n\n### Systemd service with OTP\n```\n[Unit]\nDescription=OpenConnect VPN\nAfter=network-online.target\nWants=network-online.target\nConditionUser=user\n\n[Service]\nType=simple\nKillMode=process\nRestart=always\nNoNewPrivileges=true\n\n# echo \"PASSWORD\" | sudo systemd-creds --with-key=tpm2 encrypt --pretty --name=OC_PASSWORD - -\nSetCredentialEncrypted=OC_PASSWORD: \\\n        DHzAexF2RZGcSwvqCLwg/iAAAAABAAAADAAAABAAAADqnHcKWcEtC4FtZJEAAAAAgAAAA \\\n        AAAAAALACMA8AAAACAAAAAAngAgldNq2CiPI2eIy3OAjOZlr8YCMRSogofDbVYvyR0s7v \\\n        0AECcGKjw4kBmpVBTPleIZoj5C8xO1b+n4BKjnUhwoGmUgFbeuCNNeh6y5D65Sir5SgIY \\\n        jraaBP6mT4WtUnV/D7oCttz21xzCtmfLDyqEaubfn2hxdm2Rk5CHP3qTTQ+3jKsmxOZdY \\\n        a0DVwHU2yKcKc9fUAVm8Sawf3PfhAE4ACAALAAAEEgAgIzKGpj9Fg1oMKJxo68mDGilVf \\\n        aw/kHWM8tSQi+rVB6wAEAAgycDccKN01NLFIs/Shc1JKiZIyIgIdSQWTOEX+GArKvEjMo \\\n        amP0WDWgwonGjryYMaKVV9rD+QdYzy1JCL6tUHrAAAAADQBUETk4CIshkQpkHsP2p4lMf \\\n        jnKa4PcPasVt7KgaLAX8JmRE4TP0k7Di8+LFLFLFaH5w+X6TOLik=\n\n# echo \"otpauth://...\" | sudo systemd-creds --with-key=tpm2 encrypt --pretty --name=OC_OTP_AUTH - -\nSetCredentialEncrypted=OC_OTP_AUTH: \\\n        DHzAexF2RZGcSwvqCLwg/iAAAAABAAAADAAAABAAAAAKaQ2ak0C2fvEzpVsAAAAAgAAAA \\\n        AAAAAALACMA8AAAACAAAAAAngAgdnVTFmRp8W3aynku4wPESiKRs0ItrhrmSg6HYIhHlm \\\n        wAECCJaAFwm4HC5YvIxZ5AFCuURwTXAn2IuwipLK1jDTG7QIPd0K+T1azCYcLn5tEEc/k \\\n        o+WLXLqUSKliYAi1Niwyey/JwTc2f8WZBXcA95x86DVCT87XbPfj+S/DPjzuYLZLdSDQ0 \\\n        Drlk/5oRbuzFBuSu0rRJ/6wf2qaQAE4ACAALAAAEEgAgIzKGpj9Fg1oMKJxo68mDGilVf \\\n        aw/kHWM8tSQi+rVB6wAEAAg0gjuzGk7ebfaIzUiOyWsV6wk9CrhN2kJJqHaFxhas1AjMo \\\n        amP0WDWgwonGjryYMaKVV9rD+QdYzy1JCL6tUHrAAAAADDf1/+3HOWUrgpyMkoOGhehDZ \\\n        pPoHCg785MHkD+Rxy57ksYbntRwG7mNtMHJaaTOd5MVlWbO6lR1QWx8wWqQ==\n\nBindPaths=/home/user/.vpn/openconnect/\n\nPrivateTmp=true\nPrivateMounts=true\nProtectHome=tmpfs\nProtectSystem=strict\n\nEnvironment=\"AUTH_CMD=/usr/bin/systemd-creds --with-key=tpm2 cat OC_PASSWORD\"\nEnvironment=\"LD_PRELOAD=/usr/lib/oc-password.so\"\n\nExecStartPre=/usr/bin/oc-otp \\\n        --config=/home/user/.vpn/openconnect/vpn.oc \\\n        --otp-auth=key:OC_OTP_AUTH \\\n        --form-entry=main:secondary_password\n\nExecStart=/usr/bin/openconnect \\\n        --config=/home/user/.vpn/openconnect/vpn.oc \\\n        --disable-ipv6 \\\n        --http-auth=Basic \\\n        --local-hostname=user.local \\\n        --no-deflate \\\n        --no-dtls \\\n        --no-external-auth \\\n        --no-proxy \\\n        --non-inter \\\n        --os=linux-64 \\\n        --passwd-on-stdin \\\n        --protocol=anyconnect \\\n        --script-tun \\\n        --script=\"/usr/bin/ocproxy --dynfw 1080 --keepalive 60 --verbose\" \\\n        --server=https://vpn.domain.net \\\n        --user=user \\\n        --verbose\n\n[Install]\nWantedBy=default.target\n```\n\n### Systemd service with OTP using encrypted files (needs [Polkit rule](polkit-1/rules.d/50-systemd-credentials.rules))\n```\n[Unit]\nDescription=OpenConnect VPN\nAfter=network-online.target\nWants=network-online.target\nConditionUser=user\n\n[Service]\nType=simple\nKillMode=process\nRestart=always\nNoNewPrivileges=true\n\nBindPaths=/home/user/.vpn/openconnect/\n\nPrivateTmp=true\nPrivateMounts=true\nProtectHome=tmpfs\nProtectSystem=strict\n\n# echo \"PASSWORD\" | systemd-creds --with-key=tpm2 encrypt - /home/user/.vpn/openconnect/OC_PASSWORD\nEnvironment=\"AUTH_CMD=/usr/bin/systemd-creds --with-key=tpm2 decrypt /home/user/.vpn/openconnect/OC_PASSWORD -\"\nEnvironment=\"LD_PRELOAD=/usr/lib/oc-password.so\"\n\n# echo \"otpauth://...\" | systemd-creds --with-key=tpm2 encrypt - /home/user/.vpn/openconnect/OC_OTP_AUTH\nExecStartPre=/usr/bin/oc-otp \\\n        --config=/home/user/.vpn/openconnect/vpn.oc \\\n        --otp-auth=key:OC_OTP_AUTH \\\n        --form-entry=main:secondary_password\n\nExecStart=/usr/bin/openconnect \\\n        --config=/home/user/.vpn/openconnect/vpn.oc \\\n        --disable-ipv6 \\\n        --http-auth=Basic \\\n        --local-hostname=user.local \\\n        --no-deflate \\\n        --no-dtls \\\n        --no-external-auth \\\n        --no-proxy \\\n        --non-inter \\\n        --os=linux-64 \\\n        --passwd-on-stdin \\\n        --protocol=anyconnect \\\n        --script-tun \\\n        --script=\"/usr/bin/ocproxy --dynfw 1080 --keepalive 60 --verbose\" \\\n        --server=https://vpn.domain.net \\\n        --user=user \\\n        --verbose\n\n[Install]\nWantedBy=default.target\n```\n\n## Contributing\n\nContributions are welcome! Please feel free to submit a pull request or open an issue to discuss potential improvements or features.\n\n## License\n\n`openconnect-systemd-credentials` is available under the MIT license. See the LICENSE file for more info.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fs3rj1k%2Fopenconnect-systemd-credentials","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fs3rj1k%2Fopenconnect-systemd-credentials","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fs3rj1k%2Fopenconnect-systemd-credentials/lists"}