OpenConnect: Passing-over user password when executing authentication request?

Question

Currently I am using the following command for executing authentication request to obtain the server certificate (FINGERPRINT) and OpenConnect-Cookie:

openconnect --authenticate --user=<username> "VPN host"

---

Hereby I always have to enter my password in a later appearing user prompt.

Is there an option available to pass-over the password to OpenConnect already in the upper command?

For example, by extending the command like...

openconnect --authenticate --user=<username> password=<password> "VPN host"

... ?

---

The challenge is:

The user RuiFRibeiro had the idea just to echo the password within the command. Unfortunately this does not work in our case, because the server provides one more user prompt before reaching the second prompt (= password prompt).

It will happen like that:

1. First user prompt: Server saying

   • "Please choose if you want to tunnel all traffic or only specific one.
   • "Type in Tunnel all or Tunnel company".

2. Second user prompt: Server is saying

   • "Please enter your password."

As you can see, a simple echo would give the wrong answer to the wrong question. :-)

---

For a possible expect-script the real (exact) server request before inserting text is like followed:

1. First prompt: GROUP: [tunnel MyCompany|tunnel all]:, answer-insertion should be tunnel MyCompany

2. Second prompt: Password:, answer-insertion should be 123456789

Answer 1

Usually, VPN software does not allow as input the password for a user, because it is considered a security risk.

A possible solution is feeding the password via a pipe as in:

echo -e "Tunnel all\nYourPassword" | openconnect --authenticate --user=<username> "VPN host"

If we are talking about you being interested in this method to write a script:

• be sure to understand the security implications of having your password in a file, and restrict the read rights of that file only to the user running the openconnect command.

PS Replace YourPassword with your real password

Answer 2

This works for me:

echo 'your password' > passwd.auth
sudo openconnect <SERVER IP> --user=USERNAME --servercert sha256:<SHA256> --passwd-on-stdin < passwd.auth