pan-globalprotect-okta - GitLite

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #typescript #machine-learning #deep-learning #linux #docker #kubernetes #vue #awesome-list #openai #open-source

pan-globalprotect-okta

(★ 102)

PaloAlto Networks GlobalProtect VPN (integrated with OKTA) command-line client

파일 탐색기

최종 버전 다운로드 (.zip)

- mypy.sh
.dockerignore
.gitignore
Dockerfile
gp-okta.conf
gp-okta.py
README.md
run-docker.sh
shell.nix
vpnc-script-wrapper.sh

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/arthepsy/pan-globalprotect-okta

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd pan-globalprotect-okta

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

docker build -t gp-okta .

Dockerfile을 기반으로 실행 가능한 이미지를 빌드합니다.

sh run-docker.sh

이 명령어를 터미널에 그대로 입력해 실행하세요.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# pan-globalprotect-okta

Command-line client for PaloAlto Networks' GlobalProtect VPN, integrated with OKTA.
This utility will do the _authentication dance_ with OKTA to retrieve cookie,
which will be passed to [OpenConnect](https://github.com/openconnect/openconnect)
for creating actual VPN connection. Compatible with Python 2 and 3. Tested on
FreeBSD, Linux and MacOS X. Tested with OpenConnect 8.00 - 8.10.

It also supports multiple second factor authentication implementations like Google, OKTA, YubiKey, SMS, etc.
TOPT authentication can work without user interaction, if initial secret is provided. 
Otherwise, it will ask for generated code.

To gather TOTP secret, there are two possibilities - either scan the provided QR
code with _normal_ QR code scanner and write down the secret. Or create backup
from current OTP application in phone. Some applications have this feature, but
some don't. For example, andOTP on Android do support this feature.

## usage
This utility depends on [requests](http://www.python-requests.org/) and [lxml](https://lxml.de/)
Python libraries. If TOTP secret is being used, then [pyotp](https://github.com/pyotp/pyotp)
is also required. For YubiKey, [fido2](https://github.com/Yubico/python-fido2) is required.

```
   ./gp-okta.py gp-okta.conf
```

## docker

Build Docker image before running container:
```
docker build -t gp-okta .
```

Edit gp-okta.conf and launch Docker container:
```
sh run-docker.sh
```

## configuration

Configuration file should be self-explanatory. Options can be overridden with
`GP_` prefixed respective environment variables, e.g., `GP_PASSWORD` will
override `password` option in configuration file.

## changelog
### v1.00 (2020-05-xx)
- new MFA: push, Symantec, WebAuthN/YubiKey
- GnuGP config encryption
- direct gateway authentication
- second authentication dance
- use client certificates
- verify server certificates
- type checking

### v0.99 (2019-02-14)
- supported MFA: OKTA, Google, SMS
- interactive and hard-coded MFA
- configurable gateway choice
- Python2 and Python3 support
- Dockerfile example
- workarounds for known issues

## known issues

If `openconnect` returns with `ioctl` or `fgets (stdin): Resource temporarily unavailable`
error, then this `openconnect` version requires different `openconnect_fmt` than detected
or manually specified. Run `openconnect` manually and paste line-by-line required options
to figure out required `openconnect_fmt`. Also, please, open an issue and report it.