mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
5 commits 5 branches 0 tags 172 MiB
CSS 33%
Nix 26.8%
Rust 19.3%
Haskell 5.8%
Emacs Lisp 4.5%
Other 10.1%
Find a file
Vincent Ambo 393cff4847 feat: Don't echo password while inputting
2017-02-11 16:30:23 +01:00
.gitignore chore: Don't print URLs 2017-02-11 16:19:24 +01:00
main.go feat: Don't echo password while inputting 2017-02-11 16:30:23 +01:00
main_test.go feat: Initial working implementation 2017-02-11 12:27:12 +01:00
README.md feat: Don't echo password while inputting 2017-02-11 16:30:23 +01:00
urls.go feat: Initial working implementation 2017-02-11 12:27:12 +01:00

README.md

Watchblob - WatchGuard VPN on Linux

This tiny helper tool makes it possible to use WatchGuard / Firebox / <> VPNs that use multi-factor authentication on Linux.

Rather than using OpenVPN's built-in dynamic challenge/response protocol, WatchGuard has opted for a separate implementation negotiating credentials outside of the OpenVPN protocol, which makes it impossible to start those connections solely by using the openvpn CLI and configuration files.

What this application does has been reverse-engineered from the "WatchGuard Mobile VPN with SSL" application on OS X. A writeup of the protocol and the security implications will be linked here in the future.

Installation

Make sure you have Go installed and GOPATH configured, then simply go get github.com/tazjin/watchblob/....

Usage

Right now the usage is very simple. Make sure you have the correct OpenVPN client config ready (this is normally supplied by the WatchGuard UI) simply run:

watchblob vpnserver.somedomain.org username p4ssw0rd

The server responds with a challenge which is displayed to the user, wait until you receive the SMS code or whatever and enter it. watchblob then completes the credential negotiation and you may proceed to log in with OpenVPN using your username and the OTP token (not your password) as credentials.