$ curl -O https://raw.githubusercontent.com/HenrikBengtsson/ucsf-vpn/master/bin/ucsf-vpn
$ chmod ugo+x ucsf-vpn

Connect to and Disconnect from the UCSF VPN

Usage:
 ucsf-vpn <command> [flags] [options]

Commands:
 start            Connect to VPN
 stop             Disconnect from VPN
 restart          Disconnect and reconnect to VPN
 toggle           Connect to or disconnect from VPN
 status           Display VPN connection status
 details          Display connection details in JSON format
 log              Display log file
 troubleshoot     Scan log file for errors (only for '--method=pulse')

Options:
 --token=<token>  One-time two-factor authentication (2FA) token or method:
                   - 'prompt' (user is prompted to enter the token),
                   - 'push' ("approve and confirm" in Duo app; default),
                   - 'phone' (receive phone call and "press any key"),
                   - 'sms' (receive code via text message),
                   -  6 or 7 digit token (from Duo app), or
                   -  44-letter YubiKey token ("press YubiKey")
 --user=<user>    UCSF Active Directory ID (username)
 --pwd=<pwd>      UCSF Active Directory ID password

 --server=<host>  VPN server (default is 'remote.ucsf.edu')
 --realm=<realm>  VPN realm (default is 'Dual-Factor Pulse Clients')
 --url=<url>      VPN URL (default is https://{{server}}/pulse)
 --method=<mth>   Either 'openconnect' (default) or 'pulse'
 --protocol=<ptl> VPN protocol, e.g. 'nc' (default) and 'pulse'
 --validate=<how> Either 'ipinfo', 'pid', or 'pid,ipinfo'
 --theme=<theme>  Either 'cli' (default) or 'none'

Flags:
 --verbose        More verbose output
 --help           Display full help
 --version        Display version
 --full           Display more version information
 --force          Force command

Examples:
 ucsf-vpn --version --full
 ucsf-vpn start --user=alice --token=push
 ucsf-vpn stop
 UCSF_VPN_TOKEN=prompt ucsf-vpn start --user=alice --pwd=secrets
 ucsf-vpn start


Environment variables:
 UCSF_VPN_METHOD       Default value for --method
 UCSF_VPN_PROTOCOL     Default value for --protocol
 UCSF_VPN_SERVER       Default value for --server
 UCSF_VPN_TOKEN        Default value for --token
 UCSF_VPN_THEME        Default value for --theme
 UCSF_VPN_VALIDATE     Default value for --validate
 UCSF_VPN_PING_SERVER  Ping server to validate internet (default: 9.9.9.9)
 UCSF_VPN_EXTRAS       Additional arguments passed to OpenConnect

Commands and Options for Pulse Security Client only (--method=pulse):
 open-gui         Open the Pulse Secure GUI
 close-gui        Close the Pulse Secure GUI (and any VPN connections)

 --gui            Connect to VPN via Pulse Secure GUI
 --no-gui         Connect to VPN via Pulse Secure CLI (default)
 --speed=<factor> Control speed of --gui interactions (default is 1.0)

Any other options are passed to Pulse Secure CLI as is (only --no-gui).

User credentials:
If user credentials (--user and --pwd) are neither specified nor given
in ~/.netrc, then you will be prompted to enter them. To specify them
in ~/.netrc file, use the following format:

  machine remote.ucsf.edu
      login alice
      password secrets

For security, the ~/.netrc file should be readable only by
the user / owner of the file. If not, then 'ucsf-vpn start' will
set its permission accordingly (by calling chmod go-rwx ~/.netrc).

Requirements:
* Requirements when using OpenConnect (CLI):
  - OpenConnect (>= 7.08) (installed: 8.05-1)
  - sudo
* Requirements when using Junos Pulse Secure Client (GUI):
  - Junos Pulse Secure client (>= 5.3) (installed: 5.3-3-Build553)
  - Ports 4242 (UDP) and 443 (TCP)
  - `curl`
  - `xdotool` (when using 'ucsf-vpn start --method=pulse --gui')
  - No need for sudo rights

VPN Protocol:
Different versions of OpenConnect support different VPN protocols.
Using '--protocol=nc' (default) has been confirmed to work when using
OpenConnect 7.08, and '--protocol=pulse' for OpenConnect 8.10.
The 'nc' protocol specifies the old "Juniper Network Connect" protocol,
and 'pulse' the newer "Pulse Secure" protocol.  For older version of
OpenConnect that recognizes neither, specify '--protocol=juniper',
which will results in using 'openconnect' legacy option '--juniper'.

Pulse Secure GUI configuration:
Calling 'ucsf-vpn start --method=pulse --gui' will, if missing,
automatically add a valid VPN connection to the Pulse Secure GUI
with the following details:
 - Name: UCSF
 - URL: https://remote.ucsf.edu/pulse
You may change the name to you own liking.

Troubleshooting:
* Verify your username and password at https://remote.ucsf.edu/.
  This should be your UCSF Active Directory ID (username); neither
  MyAccess SFID (e.g. 'sf*****') nor UCSF email address will work.
* If you are using the Pulse Secure client (`ucsf-vpn --method=pulse`),
  - Make sure ports 4242 & 443 are not used by other processes
  - Make sure 'https://remote.ucsf.edu/pulse' is used as the URL
  - Run 'ucsf-vpn troubleshoot' to inspect the Pulse Secure logs

Useful resources:
* UCSF VPN information:
  - https://software.ucsf.edu/content/vpn-virtual-private-network
* UCSF Web-based VPN Interface:
  - https://remote-vpn01.ucsf.edu/ (preferred)
  - https://remote.ucsf.edu/
* UCSF Two-Factory Authentication (2FA):
  - https://it.ucsf.edu/services/duo-two-factor-authentication
* UCSF Managing Your Passwords:
  - https://it.ucsf.edu/services/managing-your-passwords

Version: 5.5.1
Copyright: Henrik Bengtsson (2016-2022)
License: GPL (>= 2.1) [https://www.gnu.org/licenses/gpl.html]
Source: https://github.com/HenrikBengtsson/ucsf-vpn