OPENCONNECT(8)

📦
version 9.21 · 9 versions
, in ubuntu stonking

💖 OPENCONNECT(8) — the openconnect girlies' guide 💖

okay so bestie, you know that manual page called OPENCONNECT in the System Manager's Manual? Yeah. That one. I'm about to make it make sense for you. Sit down, grab a strawberry 🍓, and let's go.

✨ NAME ✨

openconnect — multi-protocol VPN client, for Cisco AnyConnect VPNs and others 🦋

✨ SYNOPSIS ✨

openconnect [--config configfile] [-b,--background] [--pid-file pidfile]
            [-c,--certificate cert] [-e,--cert-expire-warning days]
            [-k,--sslkey key] [-C,--cookie cookie] [--cookie-on-stdin]
            [--compression MODE] [-d,--deflate] [-D,--no-deflate]
            [--force-dpd interval] [--force-trojan interval]
            [-F,--form-entry form:opt=value] [-g,--usergroup group]
            [-h,--help] [--http-auth methods]
            [--external-browser browser] [-i,--interface ifname]
            [-l,--syslog] [--timestamp] [--passtos] [-U,--setuid user]
            [--csd-user user] [-m,--mtu mtu] [--base-mtu mtu]
            [-p,--key-password pass] [-P,--proxy proxyurl]
            [--proxy-auth methods] [--no-proxy] [--libproxy]
            [--key-password-from-fsid] [-q,--quiet] [-Q,--queue-len len]
            [-s,--script vpnc-script] [-S,--script-tun] [-u,--user name]
            [-V,--version] [-v,--verbose] [-x,--xmlconfig config]
            [--authgroup group] [--authenticate] [--cookieonly]
            [--printcookie] [--cafile file] [--disable-ipv6]
            [--dtls-ciphers list] [--dtls12-ciphers list]
            [--dtls-local-port port] [--dump-http-traffic]
            [--no-system-trust] [--pfs] [--no-dtls]
            [--no-http-keepalive] [--tcp-keepalive interval]
            [--no-passwd] [--no-xmlpost] [--non-inter]
            [--passwd-on-stdin] [--protocol proto] [--token-mode mode]
            [--token-secret {secret[,counter]|@file}]
            [--reconnect-timeout seconds] [--resolve host:ip]
            [--sni host] [--servercert sha1] [--useragent string]
            [--version-string string] [--local-hostname string]
            [--os string] [--server] [https://]host[:port][/group]

like, that's a LOT of options and we haven't even gotten to the good part yet. stay with me 💅

🌈 DESCRIPTION 🌈

So, <hotpink>openconnect</hotpink> connects you to VPN servers that use the standard TLS/SSL, DTLS, and ESP protocols to move your data around. That's the whole glow-up, bestie. ✨

Originally it was written to support Cisco "AnyConnect" VPN servers — and then it got extended, because the girls that get it, get it:

  • Juniper Network Connect — experimental support via --protocol=nc
  • Pulse/Ivanti Connect Secure VPN servers — via --protocol=pulse
  • Palo Alto Networks GlobalProtect VPN servers — via --protocol=gp
  • F5 Big-IP VPN servers — via --protocol=f5
  • Fortinet Fortigate VPN servers — via --protocol=fortinet
  • Array Networks SSL VPN servers — via --protocol=array

Not a girlboss moment for the VPN industry, honestly, that they all had to be different. But we move. 💀

The way the connection goes is in two phases, and this is important:

  1. Phase one — a simple <mint>HTTPS</mint> connection where you authenticate somehow. Certificate, password, SecurID, whatever the vibe is. Once you've authenticated, you get rewarded with an authentication cookie which you then use for the real VPN connection. So the cookie is like... your VIP wristband. 🎀
  2. Phase two — that cookie gets used to connect to a tunnel over HTTPS, and data packets pass over the resulting connection. When it's possible, a <cyan>UDP</cyan> tunnel gets configured too: AnyConnect uses DTLS, while Juniper and GlobalProtect use UDP-encapsulated ESP.

You can turn the UDP tunnel off with --no-dtls, but lowkey don't — it's preferred when the server and network correctly support it, purely for performance reasons.

⚠️ REAL TALK: TCP performs poorly and unreliably over TCP-based tunnels. See tcp-tcp.html. It's giving "why are you like this". 😭

✨ OPTIONS ✨

The part you actually opened this page for. Buckle up, there are so many. 💅

  • --config=CONFIGFILE — Read further options from CONFIGFILE before continuing to process options from the command line. The file should contain long-format options as would be accepted on the command line, but without the two leading -- dashes. Empty lines, or lines where the first non-space character is a # character, are ignored.

Any option except the config option may be specified in the file.

iykyk: that's your config-inception-proof rule. config can't eat itself. 🍓
  • -b, --background — Continue in background after startup.
  • --pid-file=PIDFILE — Save the pid to PIDFILE when backgrounding.
  • -c, --certificate=CERT [,--mca-certificate=CERT] — Use SSL client certificate CERT, which may be either a file name or, if OpenConnect has been built with an appropriate version of GnuTLS, a PKCS#11 URL.

The --mca-certificate option sets the secondary certificate for multi-certificate authentication. According to Cisco's terminology, the SSL client certificate is called the "machine" certificate, and the second certificate is called the "user" certificate.

  • -e, --cert-expire-warning=DAYS — Give a warning when the SSL client certificate has DAYS left before expiry. bestie, pay attention to this one, expired certs are a whole mood ruiner.
  • -k, --sslkey=KEY [,--mca-key=KEY] — Use SSL private key KEY, which may be either a file name or, if OpenConnect has been built with an appropriate version of GnuTLS, a PKCS#11 URL.

The --mca-key option sets the private key for the secondary certificate (see --mca-certificate). 🔑

  • -C, --cookie=COOKIE — Use authentication cookie COOKIE.
  • --cookie-on-stdin — Read cookie from standard input.
  • -d, --deflate — Enable all compression, including stateful modes. By default, only stateless compression algorithms are enabled.
  • -D, --no-deflate — Disable all compression. Not me saying goodbye to compression entirely 😭
  • --compression=MODE — Set compression mode, where MODE is one of stateless, none, or all.

By default, only stateless compression algorithms — which do not maintain state from one packet to the next, and which can be used on UDP transports — are enabled. By setting the mode to all, stateful algorithms (currently only zlib deflate) can be enabled. Or all compression can be disabled by setting the mode to none.

  • --force-dpd=INTERVAL — Use INTERVAL as the Dead Peer Detection interval (in seconds). This will cause the client to use DPD at the specified interval even if the server hasn't requested it, or at a different interval from the one requested by the server.

DPD mechanisms vary by protocol and by transport (TLS or DTLS/ESP), but they're all functionally similar: they enable either the VPN client or the VPN server to transmit a signal to the peer, requesting an immediate reply which can be used to confirm that the link between the two peers is still working. Basically a "you up?" text but for network links. 🫶

  • -g, --usergroup=GROUP — Set the URL path of the initial HTTPS connection to the server.

With some protocols, this path may function as a login group or realm, hence the naming of this option. For example, the following invocations of OpenConnect are equivalent:

openconnect --usergroup=loginPath vpn.server.com
openconnect https://vpn.server.com/loginPath
  • -F, --form-entry=FORM:OPTION[=VALUE] — Provide authentication form input, where FORM and OPTION are the identifiers from the form and the specific input field, and VALUE is the string to be filled in automatically. For example, the standard username field (also handled by the --user option) could also be provided with this option thus: --form-entry main:username=joebloggs.

If VALUE is not specified, this option will cause a hidden form field to be treated as a standard text-input field.

⚠️ do NOT use this one to enter passwords. --passwd-on-stdin should be used for that purpose. Not only will this option expose the password value via the OpenConnect process's command line, but unlike --passwd-on-stdin this option will not recognize the case of an incorrect password, and will keep trying to re-enter it repeatedly. Not the flop era loop 💀
  • -h, --help — Display help text.
  • --http-auth=METHODS — Use only the specified methods for HTTP authentication to a server. By default, only Negotiate, NTLM and Digest authentication are enabled. Basic authentication is also supported, but because it is insecure it must be explicitly enabled. The argument is a comma-separated list of methods to be enabled.

Note that the order does not matter: OpenConnect will use Negotiate, NTLM, Digest and Basic authentication in that order, if each is enabled, regardless of the order specified in the METHODS string. she has her own priority list, okay? periodt.

  • --external-browser=BROWSER — Set BROWSER as the executable used by OpenConnect to handle the authentication process with gateways that support the single-sign-on-external-browser authentication method. 🌐
  • -i, --interface=IFNAME — Use IFNAME for tunnel interface.
  • -l, --syslog — After tunnel is brought up, use syslog for further progress messages.
  • --timestamp — Prepend a timestamp to each progress message. ⏰
  • --passtos — Copy TOS / TCLASS of payload packet into DTLS and ESP packets.
This is not set by default because it may leak information about the payload — for example, by differentiating voice/video traffic. Privacy girlies, beware. 🙈
  • -U, --setuid=USER — Drop privileges after connecting, to become user USER.
  • --csd-user=USER — Drop privileges during execution of trojan binary or script (CSD, TNCC, or HIP).
  • --csd-wrapper=SCRIPT — Run SCRIPT instead of the trojan binary or script.
  • --force-trojan=INTERVAL — Use INTERVAL as interval (in seconds) for repeat execution of the Trojan binary or script, overriding default and/or server-set interval.
  • -m, --mtu=MTU — Request MTU from server as the MTU of the tunnel.
  • --base-mtu=MTU — Indicate MTU as the path MTU between client and server on the unencrypted network. Newer servers will automatically calculate the MTU to be used on the tunnel from this value.
  • -p, --key-password=PASS [,--mca-key-password=PASS] — Provide passphrase for certificate file, or SRK (System Root Key) PIN for TPM.

--mca-key-password provides the passphrase for the secondary certificate (see --mca-certificate).

  • -P, --proxy=PROXYURL — Use HTTP or SOCKS proxy for connection. A username and password can be provided in the given URL, and will be used for authentication. If authentication is required but no credentials are given, GSSAPI and automatic NTLM authentication using Samba's ntlm_auth helper tool may be attempted. 🧚

okay don't go anywhere — there's more, and the rest is just as iconic. 💖

  • --proxy-auth=METHODS — okay so this is the VIP list for HTTP auth when you're going through a proxy. You hand over a comma-separated list of the methods to enable, and it'll only use those. Default energy: only Negotiate, NTLM and Digest are switched on. Basic auth is supported too, but it's insecure so it must be explicitly enabled — it is NOT coming in uninvited. And here's the gag: the order does not matter. No matter how you order the METHODS string, OpenConnect uses Negotiate, NTLM, Digest and Basic authentication in that order, if each is enabled. 💅
  • --no-proxy — disable use of proxy. that's the whole thing. proxy-free lifestyle. 🦋
  • --libproxy — use libproxy to configure the proxy automatically (when built with libproxy support). ✨
  • --key-password-from-fsid — the passphrase for the certificate file is automatically generated from the fsid of the filesystem it's stored on. That fsid comes from the statvfs(2) or statfs(2) system call, depending on the operating system. On a Linux or similar system with GNU coreutils, the fsid this option uses should be equal to the output of:
stat --file-system --printf=%i\n $CERTIFICATE

And it is not the same as the 128-bit UUID of the filesystem, bestie. do not mix those up. 😭

  • -q, --quiet — less output. shhh. 🤫
  • -Q, --queue-len=LEN — set the packet queue limit to LEN packets. Default is 32. A high value might get you better overall bandwidth, but at the cost of latency. If you run Voice over IP or other interactive traffic over the VPN, you do not want those packets queued up behind thousands of other large packets that are part of a bulk transfer. 😭

This option sets the max inbound and outbound packet queue sizes inside OpenConnect itself, which controls how many packets get sent and received in a single batch, and it also affects other buffering like the socket send buffer (SO_SNDBUF) for network connections and the OS tunnel device.

Ultimately the right size for a queue is "just enough packets that it never quite gets empty before more are pushed to it." Anything higher is simply introducing bufferbloat and additional latency with no benefit. With the default of 32, we're able to saturate a single Gigabit Ethernet from modest hardware, which is more than enough for most VPN users. 🔥

If OpenConnect is built with vhost-net support, it will only be used if the queue length is set to 16 or more. Why? Because vhost-net introduces a small amount of additional latency, but improves total bandwidth quite considerably for those operating at high traffic rates. So it makes sense to use it when the user has indicated a preference for bandwidth over latency by increasing the queue size. periodt.

  • -s, --script=SCRIPT — invoke SCRIPT to configure the network after connection. Without this, routing and name service are unlikely to work correctly, no cap. The script is expected to be compatible with the vpnc-script shipped with the "vpnc" VPN client — see https://www.infradead.org/openconnect/vpnc-script.html for more info. This version of OpenConnect is configured to use /usr/share/vpnc-scripts/vpnc-script by default.

On Windows, a relative directory for the default script is handled as starting from the directory that the openconnect executable is running from, rather than the current directory. And the script is invoked with the command-based script host cscript.exe.

  • -S, --script-tun — pass traffic to the 'script' program over a UNIX socket instead of to a kernel tun/tap device. This lets the VPN IP traffic be handled entirely in userspace — like, say, by a program that uses lwIP to provide SOCKS access into the VPN. 🧚
  • --server=[https://]HOST[:PORT][/PATH] — define the VPN server either as a simple HOST or as a URL containing the HOST and optionally the PORT number and the PATH. With some protocols the path may function as a login group or realm, and it may equivalently be specified with --usergroup. ✨

As an alternative, define the VPN server as a non-option command line argument. Either way works, bestie.

  • -u, --user=NAME — set login username to NAME.
  • -V, --version — report version number. iconic.
  • -v, --verbose — more output (and yes, it may be specified multiple times for additional output). 👑
  • -x, --xmlconfig=CONFIG — XML config file.
  • --authgroup=GROUP — select GROUP from the authentication dropdown or list entry.

So many VPNs require a selection from a dropdown or list during the authentication process. Depending on the vibe, this selection may be known as authgroup (on Cisco VPNs), realm (Juniper, Pulse, Fortinet), domain (F5), and gateway (GlobalProtect). This option attempts to automatically fill the appropriate protocol-specific field with the desired value. 🎀

  • --authenticate — authenticate to the VPN, output the information needed to make the connection in a form which can be used to set shell environment variables, and then exit. ✌️

When invoked with this option, OpenConnect will not actually create the VPN connection or configure a tunnel interface, but if successful it will print something like the following to stdout:

COOKIE='3311180634@13561856@1339425499@B315A0E29D16C6FD92EE...'
HOST='10.0.0.1'
CONNECT_URL='https://vpnserver.example.com'
FINGERPRINT='469bb424ec8835944d30bc77c77e8fc1d8e23a42'
RESOLVE='vpnserver.example.com:10.0.0.1'

Thus, you can invoke openconnect as a non-privileged user (with access to the user's PKCS#11 tokens, etc.) for authentication, and then invoke openconnect separately to make the actual connection as root:

eval `openconnect --authenticate https://vpnserver.example.com`;
[ -n "$COOKIE" ] && echo "$COOKIE" |
  sudo openconnect --cookie-on-stdin $CONNECT_URL --servercert $FINGERPRINT --resolve $RESOLVE

Earlier versions of OpenConnect produced only the HOST variable (containing the numeric server address), and not the CONNECT_URL or RESOLVE variables. Subsequently, we discovered that servers behind proxies may not respond correctly unless the correct DNS name is present in the connection phase, and we added support for VPN protocols where the server URL's path component may be significant in the connection phase — which prompted the addition of CONNECT_URL and RESOLVE, and the recommendation to use them as described above. If you are not certain that you are invoking a newer version of OpenConnect which outputs these variables, use the following command-line (compatible with most Bourne shell derivatives) which will work with either a newer or older version:

sudo openconnect --cookie-on-stdin ${CONNECT_URL:-$HOST} --servercert $FINGERPRINT ${RESOLVE:+--resolve=$RESOLVE}
  • --cookieonly — fetch and print the cookie only; don't connect. This is essentially a subset of --authenticate. 🍪
  • --printcookie — print the cookie to stdout before connecting (see --authenticate for the meaning of this cookie).
  • --cafile=FILE — additional CA file for server verification. By default, this simply causes OpenConnect to trust additional root CA certificate(s) on top of those trusted by the system. Use --no-system-trust to prevent OpenConnect from trusting the system default certificate authorities.
  • --no-system-trust — do not trust the system default certificate authorities. If this option is given, only certificate authorities given with the --cafile option, if any, will be trusted automatically. 💀
  • --disable-ipv6 — do not advertise IPv6 capability to server.
  • --dtls-ciphers=LIST — set the OpenSSL ciphers to support for DTLS.
  • --dtls12-ciphers=LIST — set the OpenSSL ciphers for Cisco's DTLS v1.2.
  • --dtls-local-port=PORT — use PORT as the local port for DTLS and UDP datagrams.
  • --dump-http-traffic — enable verbose output of all HTTP requests and the bodies of all responses received from the server. 👀
  • --pfs — enforces Perfect Forward Secrecy (PFS). That ensures that if the server's long-term key is compromised, any session keys established before the compromise will be unaffected. If this option is provided and the server does not support PFS in the TLS channel, the connection will fail. 😭

PFS is available in Cisco ASA releases 9.1(2) and higher; a suitable cipher suite may need to be manually enabled by the administrator using the ssl encryption setting.

  • --no-dtls — disable DTLS and ESP.
  • --tcp-keepalive[=INTERVAL] — enable TCP keepalive on the TLS connection. This prevents stateful firewalls from dropping the idle TCP session when traffic is being carried over DTLS/ESP. If INTERVAL is specified, it sets the keepalive idle time in seconds; otherwise the system default is used. 🫶
  • --no-http-keepalive — story time, bestie. Version 8.2.2.5 of the Cisco ASA software has a bug where it will forget the client's SSL certificate when HTTP connections are being re-used for multiple requests. So far, this has only been seen on the initial connection, where the server gives an HTTP/1.0 redirect response with an explicit Connection: Keep-Alive directive. OpenConnect as of v2.22 has an unconditional workaround for this, which is never to obey that directive after an HTTP/1.0 response.

However, Cisco's support team has failed to give any competent response to the bug report, and we don't know under what other circumstances their bug might manifest itself. So this option exists to disable ALL re-use of HTTP sessions and cause a new connection to be made for each request. If your server seems not to be recognizing your certificate, try this option. If it makes a difference, please report this information to the openconnect-devel@lists.infradead.org mailing list. 🙏

  • --no-passwd — never attempt password (or SecurID) authentication.
  • --no-external-auth — prevents OpenConnect from advertising to the server that it supports any kind of authentication mode that requires an external browser.

Some servers will straight up force the client into that auth mode if the client advertises that it speaks it — but bestie, they'll fall back to a more "scriptable" authentication mode if the client doesn't look like it supports it. Rude, but okay.

  • --no-xmlpost — don't even try to post an XML authentication/configuration request to the server; use the old-school style GET method that the ancient clients and servers used instead. ✨

This one is a temporary safety net, fr — it exists to work around potential compatibility issues with the code that falls back to the old method automatically. It makes OpenConnect behave more like versions 4.08 and below did. So like… if you find yourself needing this option, congrats, you found a bug in OpenConnect. 🐛 Please peep https://www.infradead.org/openconnect/mail.html and report it to the developers.

  • --allow-insecure-crypto — okay so the ancient, broken 3DES and RC4 ciphers are insecure, no cap, and we explicitly disable them by default. But some still-in-use VPN servers literally can't do any better. 😭

This option turns the use of those insecure ciphers back on, plus it enables the use of SHA1 for server certificate validation.

  • --non-inter — don't expect user input; just exit if it's required. Not me, not answering. 💅
  • --passwd-on-stdin — read password from standard input.
  • --protocol=_PROTO_ — pick the VPN protocol _PROTO_ to be used for the connection. Supported protocols:
    • anyconnect — for Cisco AnyConnect (the default, slay)
    • nc — for experimental support for Juniper Network Connect (also supported by most Ivanti/Pulse Connect Secure servers)
    • pulse — for experimental support for Ivanti/Pulse Connect Secure
    • gp — for experimental support for Palo Alto Networks GlobalProtect
    • f5 — for experimental support for F5 Big-IP
    • fortinet — for experimental support for Fortinet Fortigate
    • array — for experimental support for Array Networks SSL VPN

Peep https://www.infradead.org/openconnect/protocols.html for the details on features and deficiencies of the individual protocols. 🌈

OpenConnect does not yet support all of the authentication options used by Pulse, and it also doesn't support Host Checker/TNCC with Pulse. So if your Junos/Ivanti Pulse VPN isn't supported yet with --protocol=pulse, then --protocol=nc might be a useful fallback option. 🫶

  • --token-mode=_MODE_ — turn on one-time password generation using the _MODE_ algorithm. Let's break it down:
    • --token-mode=rsa will call libstoken to generate an RSA SecurID tokencode
    • --token-mode=totp will generate an RFC 6238 time-based password
    • --token-mode=hotp will generate an RFC 4226 HMAC-based password
    • Yubikey tokens that generate OATH codes in hardware are supported with --token-mode=yubioath
    • --token-mode=oidc will use the provided OpenIDConnect token as an RFC 6750 bearer token
  • --token-secret={ SECRET[,COUNTER] | @FILENAME } — the secret to use when generating one-time passwords/verification codes. Base 32-encoded TOTP/HOTP secrets can be used by specifying base32: at the beginning of the secret, and for HOTP secrets the token counter can be specified following a comma.

RSA SecurID secrets can be specified as an Android/iPhone URI or a raw numeric CTF string (with or without dashes).

For Yubikey OATH, the token secret specifies the name of the credential to be used. If it's not provided, the first OATH credential found on the device will be used.

For OIDC, the secret is the bearer token to be used.

_FILENAME_, if specified, can contain any of the above strings. Or, it can contain a SecurID XML (SDTID) seed.

If this option is omitted, and --token-mode is rsa, libstoken will try to use the software token seed saved in ~/.stokenrc by the stoken import command. 🎀

  • --reconnect-timeout=_SECONDS_ — after disconnection or Dead Peer Detection, keep trying to reconnect for _SECONDS_. The default is 300 seconds, which means openconnect can recover a VPN connection after a temporary network outage lasting up to 300 seconds. She's persistent, she's resilient, she's iconic. 💖
  • --resolve=_HOST:IP_ — automatically resolve the hostname _HOST_ to _IP_ instead of using the normal resolver to look it up.
  • --sni=_HOST_ — when creating new TLS connections, always present the hostname _HOST_ as the SNI (Server Name Indication) in place of the correct hostname, which will still be sent in the HTTP 'Host:' header, and expect the peer's certificate to match the SNI rather than the correct hostname. This may be useful for Domain Fronting, by which some filtered or censored Internet connections can be bypassed. 🦋
Note that sending different values for the SNI and 'Host:' header violates HTTP standards and is prevented by many cloud hosting providers. So like, iykyk.
  • --servercert=_HASH_ — accept the server's SSL certificate only if it matches the provided fingerprint. This option implies --no-system-trust, and may be specified multiple times in order to accept multiple possible fingerprints.

The allowed fingerprint types are SHA1, SHA256, and PIN-SHA256. They are distinguished by the 'sha1:', 'sha256:' and 'pin-sha256:' prefixes to the encoded hash. The first two are custom identifiers providing hex encoding of the peer's public key, while 'pin-sha256:' is the RFC7469 key PIN, which utilizes base64 encoding. To ease certain testing use-cases, a partial match of the hash will also be accepted, if it is at least 4 characters past the prefix. 🔥

  • --useragent=_STRING_ — use _STRING_ as the 'User-Agent:' field value in the HTTP header.

Some VPN servers may require specific values matching those sent by proprietary VPN clients in order to successfully authenticate or connect. For example, when connecting to a Cisco VPN server: --useragent 'AnyConnect Windows 4.10.06079' or --useragent 'Cisco AnyConnect VPN Agent for Windows 2.2.0133', or when connecting to a Pulse server, --useragent 'Pulse-Secure/9.1.11.6725'. 💅

  • --version-string=_STRING_ — use _STRING_ as the software version reported to the head end. (e.g. --version-string '2.2.0133')
  • --local-hostname=_STRING_ — use _STRING_ as the 'X-CSTP-Hostname:' field value in the HTTP header. For example --local-hostname 'mypc', will advertise the value 'mypc' as the suggested hostname to point to the provided IP address.
  • --os=_STRING_ — OS type to report to the gateway. Recognized values are: linux, linux-64, win, mac-intel, android, apple-ios. Reporting a different OS type may affect the dynamic access policy (DAP) applied to the VPN session. If the gateway requires CSD, it will also cause the corresponding CSD trojan binary to be downloaded, so you may need to use --csd-wrapper if this code is not executable on the local machine. 👑

🚨 SIGNALS 🚨

In the data phase of the connection, the following signals are handled:

  • SIGINT / SIGTERM — performs a clean shutdown by logging the session off, disconnecting from the gateway, and running the vpnc-script to restore the network configuration. Very demure, very mindful. ✨
  • SIGHUP — disconnects from the gateway and runs the vpnc-script, but does not log the session off; this allows for reconnection later using --cookie.
  • SIGUSR1 — writes a progress message with detailed connection information and statistics. She's a yapper, but make it diagnostics. 📊
  • SIGUSR2 — forces an immediate disconnection and reconnection; this can be used to quickly recover from LAN IP address changes. The glow-up-and-restart button. 🔄

😔 LIMITATIONS 😔

Peep https://www.infradead.org/openconnect/contribute.html for the various features that we wish OpenConnect had, and https://www.infradead.org/openconnect/protocols.html for the info on the quirks and limitations of the individual VPN protocols. Yes, we're being honest about it. Growth. 🌱

👀 SEE ALSO 👀

💜 AUTHORS 💜

David Woodhouse <dwmw2@infradead.org> — thank you for your service, king. 👑

okay bestie that's the whole page 🫶 this was <rainbow>OpenConnect manual page 8</rainbow>, served up from the OpenConnect source/version line right down to the footer, and yes, the footer really does just say OPENCONNECT(8) — no date, so don't @ me. go connect to something, securely, and slay 💖✨🎀

📦 where this page comes from