How could I prevent NetExtender Cli to asking certificate confirmation?

Question

Our company is using self-signed SonicWall for firewall facility. And remote clients needs to be connect to internal network through VPN via NetExtender client.

Some of the clients are using Linux OS without Desktop Environment on purpose.

There is an issue occurring with NetExtender Client at those no Desktop Environment computers on each connection attempt.

On each connection attempt NetExtender client need to be approved for this question:

Warning: self signed certificate

Do you want to proceed? (Y:Yes, N:No, V:View Certificate)

I read about self-signed certificates from this link

Than I try to install /home/$USER/.netExtenderCerts/PUB_CERT/ca-bundle.crt file by copying to /usr/local/share/ca-certificates and using update-ca-certificiates command.

# cp /home/$USER/.netExtenderCerts/PUB_CERT/ca-bundle.crt /usr/local/share/ca-certificates
# update-ca-certificates 
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.

After applying this method and rebooted the OS, NetExtender Client still hanging at same question. This were preventing to build automated connection.

How could I prevent netExtender client to asking this question?

Does `/home/$USER/.netExtenderCerts/PUB_CERT/ca-bundle.crt` contain the correct certificate? — Håkan Lindqvist, Jan 15 '17 at 23:48

score 3 · Answer 1 · answered Sep 17 '20 at 11:49

3

To prevent NetExtender's certificate verification dialogue, you can use the undocumented switch "--always-trust"

For example:

netExtender -u user -p password -d 'domain' --always-trust host

Tested on Linux, but I'm not sure about NetExtender Windows CLI.

Note: as commented by Håkan Lindqvist, take into consideration that this will open up for MITM attacks.

answered Sep 17 '20 at 11:49

Alfredo Prada Giorgi

41
2

Do you happen to have a link to where you found this flag? Is there additional documentation aside from what is listed on NetExtender's documentation site? – Xenology May 04 '21 at 00:10
@Xenology No, I don't know where you can find this flag elsewhere, neither extra documentation, unfortunately. – Alfredo Prada Giorgi Jul 07 '21 at 06:49
This does work, I can confirm – ExploWare Feb 03 '22 at 08:38

score 2 · Answer 2 · answered Apr 23 '19 at 18:45

Håkan Lindqvists comment is on the money.

Only the certificates contained in ~/.netExtenderCerts/PUB_CERT/ca-bundle.crt seem to be evalutated by netExtender. The good news is this is a text file containing Base64 encoded certificates, so it's quite straightforward to add yours to the file.

First you need to get a copy of the certificate. You can do this by opening the vpn server address in a browser, (right-)clicking on the padlock icon next to the url, inspect the certificate and then exporting it. Save the certificate as Base64-encoded ASCII, single certificate or something equivalent.

I recommend backing up the original ca-bundle.crt file, just in case the next step fails or you wish to revert your certificates.

Finally, combine the exported certificate and backup into a single file and save as ca-bundle.crt

Disclaimer: I found no documentation for this, so my solution is based on experimentation

score 1 · Answer 3 · edited Jan 16 '17 at 01:20

1

#! /bin/bash
echo Y | netExtender -u user -p password -d 'domain' host

edited Jan 16 '17 at 01:20

Michael Hampton

244,070
43
506
972

answered Jan 15 '17 at 23:31

Vlad

21
1

While that may get rid of the question, it would also open up for MITM attacks. – Håkan Lindqvist Jan 15 '17 at 23:45
I tried this method. The other problem is if you lose connection and try to re-connect, it doesn't work. – Mark J. Bobak Nov 03 '19 at 20:55

score 0 · Answer 4 · answered Mar 20 '23 at 18:18

The netExtender GUI creates /home/$USER/.netextender with contents in the following format:

[trustedcerts]
<ip>:<port>=<fingerprint>

Create this file manually and replace the ip, port, and fingerprint with your values. (To get the fingerprint, type V to view the certificate, then copy all of SHA1[...].)

How could I prevent NetExtender Cli to asking certificate confirmation?

4 Answers4

Linked