Supplying password to openconnect started via start-stop-daemon

Question

I am attempting to start openconnect via a Debian init script that makes use of start-stop-daemon:

DAEMON=/usr/sbin/openconnect
DAEMON_ARGS="<endpoint> --script /etc/vpnc/vpnc-script --user <user> --pid-file $PIDFILE --passwd-on-stdin"
PASSWORD=`cat /etc/openconnect/<endpoint>.passwd`
start-stop-daemon --start --pidfile "$PIDFILE" --exec "$DAEMON" -- $DAEMON_ARGS <<< ${PASSWORD}

Unfortunately, openconnect still prompts for a password during startup as it does not seem to be able to read the password redirected to stdin.

Any ideas?

Answer 1

I ended up creating a wrapper script for the openconnect, which loads the password and pipes it to the stdin of the openconnect daemon, IOW:

#!/bin/bash

PASSWD=`/bin/cat /etc/openconnect/passwd`

/bin/echo $PASSWD | /usr/sbin/openconnect $@

And start-stop-daemon invokes this wrapper instead of the openconnect.

Answer 2

openconnect (at least in version 5.02) does allow you to provide the password on STDIN.

From the manual:

--passwd-on-stdin

    Read password from standard input

So you can use:

echo 'password1' | openconnect --passwd-on-stdin ...

Answer 3

My wrapper start/stop script. Probably a better way, but hey it's working great.

#!/bin/bash

username="myuser"
password="password"
url="https://url.tosomewhere.se"
pidfile="/tmp/openconnect-pid"

case "$1" in
start)
    #bad certs
    #echo "$password" | openconnect -b --pid-file=$pidfile --no-cert-check --user=$username $url
    echo "$password" | openconnect -b --pid-file=$pidfile --user=$username $url
    ;;
stop)
    cat $pidfile  | xargs kill -2
    ;;
*)
    echo "$0 <start|stop>"
    exit 1
esac

Answer 4

It is an old thread but I needed to solve it recently. I got the same problem in openconnect intit script in gentoo with currently stable openconnect-4.08. I got it working by modifyning start-stop-daemon start command to this:

start-stop-daemon --start --make-pidfile --pidfile "${VPNPID}" \
            --stderr "${VPNERRFILE}" --stdout "${VPNLOGFILE}" \
            --background --exec /bin/bash \
            -- -c "exec /usr/sbin/openconnect --pid-file=\"${VPNPID}\" ${!VPNOPTS} ${!SERVER} <<< \`echo \"${!PASSWORD}\"\`"

(--startas is deprecated in openconnect-4.08)

Answer 5

I created a password file, then run this command:

echo $(sudo cat /usr/local/etc/openconnect/password) | sudo /usr/local/sbin/openconnect --protocol=gp vpn.myconpany.br -u myusername --passwd-on-stdin