Checkpoint VPN – Getting Checkpoint VPN SSL Network Extender Working in the Command Line

checkpointdebianvpn

The official Checkpoint out command line tool from CheckPoint, for setting up a SSL Network Extender VPN is not longer working from the Linux command line. It is also no longer actively supported by CheckPoint.

However, there is a promising project, that tries to replicate the Java applet for authentication, that talks with the snx command line utility, called snxconnect.

I was trying to put snxconnect text utility to work in Debian Buster, doing:

sudo pip install snxvpn

and

export PYTHONHTTPSVERIFY=0
snxconnect -H checkpoint.hostname -U USER

However, it was mostly dying either with an HTTP error of: 

HTTP/1.1 301 Moved Permanently:

or:

Got HTTP response: HTTP/1.1 302 Found

or:

Unexpected response, try again.

What to do about it?

PS. The EndPoint Security VPN official client is working well both in a Mac High Sierra and Windows 10 Pro.

Best Answer

SNX build 800007075 from 2012, used to support the CheckPoint VPN from the Linux command line. So I tested it, and lo and behold, it still works with the latest distributions and kernel(s) 4.x/5.x.

So ultimately, my other answer in this thread holds true, if you cannot get hold of SNX build 800007075 or if that specific version of SNX stops working with the current Linux versions (it might happen in a near future) or if you need OTP support.

Presently, the solution is then installing this specific last version of SNX that still supports doing the VPN from the command line.

  1. To install snx build 800007075, get it from:
wget https://starkers.keybase.pub/snx_install_linux30.sh?dl=1 -O snx_install.sh

For Debian and Debian-based 64-bit systems like Ubuntu and Linux Mint, you might need to add the 32-bit architecture:

sudo dpkg --add-architecture i386
sudo apt-get update

I had to install the following 32-bit packages:

sudo apt-get install libstdc++5:i386 libx11-6:i386 libpam0g:i386

Run then the snx installation script:

chmod a+rx snx_install.sh
sudo ./snx_install.sh`

You will have now a /usr/bin/snx 32-bit client binary executable. Check if any dynamic libraries are missing with:

sudo ldd /usr/bin/snx

You can only proceed to the following points when all the dependencies are satisfied.

You might need to run manually first snx -s CheckpointURLFQDN -u USER, before scripting any automatic use, for the signature VPN be saved at /etc/snx/USER.db.

  1. Before using it, you create a ~/.snxrc file, using your regular user (not root) with the following contents:

    server IP_address_of_your_VPN
username YOUR_USER
reauth yes

  2. For connecting, type snx

    $ snx Check Point's Linux SNX build 800007075 Please enter your password:

    SNX - connected.

    Session parameters:

    Office Mode IP : 10.x.x.x DNS Server : 10.x.x.x Secondary DNS Server: 10.x.x.x DNS Suffix : xxx.xx, xxx.xx Timeout : 24 hours

If you understand the security risks of hard coding a VPN password in a script, you also can use it as:

echo 'Password' | snx

  1. For closing/disconnecting the VPN, while you may stop/kill snx, the better and official way is issuing the command:

    $snx -d SNX - Disconnecting... done.

see also Linux Checkpoint SNX tool configuration issues for some clarifications about which snx version to use.

  1. If automating the login and accepting a new signature (and understanding the security implications), I wrote an expect script, which I called the script snx_login.exp ; not very secure, however you can automate your login, calling it with the password as an argument:

    #!/usr/bin/expect spawn /usr/bin/snx

    set password [lindex $argv 0]

    expect "?assword:" send -- "$password\r"

    expect { "o:" { send "y\r" exp_continue } eof }

PS. Beware snx does not support OTP alone, you will have to use the snxconnect script present on the other answer if using it.

PPS @gibies called to my attention that using an etoken, the password field gets the password plus the appended etoken and not a fixed password.

Related Question