UNC Linux Users Group

[Tom Roche <Tom_Roche AT unc.edu>]

Has anyone configured a VPN into UNC from a newish 64-bit ubuntu?
If so, how? e.g. with the Cisco client or vpnc? Why I ask (note
specific questions @ end of post, after gory details):

I'm trying to use topsail, one of the Research Computing clusters.
I previously had a topsail account, so when I did

me@it:~$ ssh -Y onyen AT topsail.unc.edu
> ssh: connect to host topsail.unc.edu port 22: Connection refused

I assumed I had lost my account. Then I got

UNC-CH PTR <mason AT email.unc.edu> Wed, 31 Mar 2010 11:17:40 -0400 (EDT)
> Your access to topsail has been approved and your userid has been
> created. Please login to topsail.unc.edu in the next day or so using
> a secure shell (ssh) client and your onyen credentials to confirm
> that you are able to login. Please note Topsail doesn't allow
> off-campus access without the VPN client.

The latter requirement is not included in the existing docs, e.g.

http://help.unc.edu/6214
> Getting Started on Topsail

and differs from other UNC clusters, e.g. emerald. Fortunately, UNC
provides

https://help.unc.edu/3081
> Installing the VPN on Linux
which points to
https://its.unc.edu/InfoSecurity/campussecurity/VPN_CLIENTS
> # Cisco VPN Client for Linux (Version x86_64-4.8.02.0030-k9)

Unfortunately, I can't get that to build on my

me@it:~$ cat /etc/lsb-release
> DISTRIB_ID=Ubuntu
> DISTRIB_RELEASE=9.10
> DISTRIB_CODENAME=karmic
me@it:~$ uname -rv
> 2.6.31-20-generic #58-Ubuntu SMP Fri Mar 12 04:38:19 UTC 2010 

After `tar xfz` I took the defaults per the instructions

`sudo ./vpn_install`
> * Binaries will be installed in "/usr/local/bin".
> * Modules will be installed in "/lib/modules/2.6.31-20-generic/CiscoVPN".
> * The VPN service will be started AUTOMATICALLY at boot time.
> * Kernel source from "/lib/modules/2.6.31-20-generic/build" will be used to 
> build the module.

after which `vpn_install` called `make`, which failed with

> Making module
> make -C /lib/modules/2.6.31-20-generic/build 
> SUBDIRS=/tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient modules
> make[1]: Entering directory `/usr/src/linux-headers-2.6.31-20-generic'
> scripts/Makefile.build:49: *** CFLAGS was changed in 
> "/tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/Makefile". Fix 
> it to use EXTRA_CFLAGS.  Stop.

I copy/mod

$ diff Makefile.0 Makefile
> 15c15,16
> < CFLAGS += -mcmodel=kernel -mno-red-zone
> ---
> > #CFLAGS += -mcmodel=kernel -mno-red-zone
> > EXTRA_CFLAGS += -mcmodel=kernel -mno-red-zone

and reran the installer, which ran longer before failing with

> Making module
> make -C /lib/modules/2.6.31-20-generic/build 
> SUBDIRS=/tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient modules
> make[1]: Entering directory `/usr/src/linux-headers-2.6.31-20-generic'
>   CC [M]  
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.o
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c: 
> In function ‘interceptor_init’:
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:132:
>  error: ‘struct net_device’ has no member named ‘hard_start_xmit’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:133:
>  error: ‘struct net_device’ has no member named ‘get_stats’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:134:
>  error: ‘struct net_device’ has no member named ‘do_ioctl’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c: 
> In function ‘add_netdev’:
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:271:
>  error: ‘struct net_device’ has no member named ‘hard_start_xmit’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:272:
>  error: ‘struct net_device’ has no member named ‘hard_start_xmit’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c: 
> In function ‘remove_netdev’:
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:294:
>  error: ‘struct net_device’ has no member named ‘hard_start_xmit’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c: 
> In function ‘recv_ip_packet_handler’:
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:646:
>  warning: assignment makes integer from pointer without a cast
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:667:
>  warning: passing argument 2 of ‘CniNewFragment’ makes pointer from integer 
> without a cast
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/Cniapi.h:383: 
> note: expected ‘CHAR *’ but argument is of type ‘sk_buff_data_t’
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c: 
> In function ‘do_cni_send’:
> /tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.c:785:
>  error: invalid operands to binary - (have ‘sk_buff_data_t’ and ‘unsigned 
> char *’)
> make[2]: *** 
> [/tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient/interceptor.o] 
> Error 1
> make[1]: *** 
> [_module_/tmp/CiscoVPNclientforLinux_x86_64-4.8.02.0030-k9/vpnclient] Error 
> 2
> make[1]: Leaving directory `/usr/src/linux-headers-2.6.31-20-generic'
> make: *** [default] Error 2
> Failed to make module "cisco_ipsec.ko".

I'm not seeing how to fix that, so am wondering:

0 regarding the Cisco VPN client:

* Does anyone know how to fix the error above?

* Does anyone know where to get a version of the Cisco VPN client that
  works on later kernels/distros? I notice

https://help.unc.edu/3081
> The following is provided for information only. UNC provides no
> support for the Cisco VPN client on any Linux system.

http://www.cisco.com/en/US/products/sw/secursw/ps2308/
> Here are instructions for downloading the Cisco VPN Client:

> 1. If you have a SMARTnet support contract and encryption
>    entitlement, download the free Cisco VPN Client.

> 2. If you do not have a SMARTnet support contract and encryption
>    entitlement, get the Cisco VPN Client on CD from your reseller.
>    Use the Partner Locator to find a reseller.

1 Has anyone configured another, more ubuntu-ish VPN client? e.g.

* network-manager-vpnc? I note UMinn's good-looking instructions @

http://www.cs.umn.edu/help/offsite/vpn.php#ubuntu

  but I'm not sure how the configuration details for the Cisco profile
  (from

https://help.unc.edu/3081

  omitted for security) map to the network-manager-vpnc configs.
  (Will take a whack @ it, though.)

TIA, Tom Roche <Tom_Roche AT pobox.com>