Anyconnect的VPN环境部署(2)-在Linux客户机上连接Anyconnect

由于之前已经在机房IDC安装了Anyconnect的VPN服务环境（参考：Anyconnect的VPN环境部署(1)-OpenConnect server(ocserv)服务安装）
今天介绍下在linux客户机上连接Anyconnect服务：

1）yum安装openconnect
[root@FangFull-backup ~]# wget http://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
[root@FangFull-backup ~]# rpm -ivh epel-release-latest-6.noarch.rpm
[root@FangFull-backup ~]# yum install -y openconnect

2）配置
下载openconnect.zip包（下载地址:https://pan.baidu.com/s/1c2ssqyc    提取密码:qihm）
将openconnect.zip解压到/usr/local目录下
[root@test-huanqiu src]# unzip openconnect.zip
[root@test-huanqiu src]# mv openconnect /usr/local/
[root@test-huanqiu src]# chmod -R 777 /usr/local/openconnect/
[root@test-huanqiu src]# cd /usr/local/openconnect/
[root@test-huanqiu openconnect]# ls
conf COPYING dist helpers install NEWS README scripts
[root@test-huanqiu openconnect]# cd conf/
[root@test-huanqiu conf]# ls
config example.conf
[root@test-huanqiu conf]# cat config
# VPN server to connect to. This is a mandatory option
VPN_SERVER="any.wangshiboholdings.com"                                       //这个是Anyconnect的vpn地址
#server="116.137.17.11"
# vpnc script program to use. You can either use the one from vpnc, or use the
# ones from http://git.infradead.org/users/dwmw2/vpnc-scripts.git
SCRIPT_PROGRAM="/etc/vpnc/vpnc-script"                                        //openconnect安装成功后，就会有这个脚本
# Username to use when connecting. Leave blank if you want to input it
# interactively everytime or if it isn't relevant
USERNAME="wangshibo"                                                                //这个是连接VPN的用户名
# If you do not want to type in your password everytime, this gives a file where
# your password is stored.
#PASSWORD_FILE="/etc/epfl-vpn.pass"
PASSWORD_FILE="/etc/vpnc/passwd"                                           //这个是连接VPN的密码文件，里面是密码
# SHA1 SSL fingerprint of the your vpn server
SERVER_SHA1=""
# Path to SSL certificate of server (or CA having signed the server's
# certificate)
# SERVER_CERT="/etc/ssl/certs/QuoVadis_Root_CA.pem"
# Additional options that are directly passed to openconnect
ADDITIONAL_OPTS=""
3）创建密码文件/etc/vpnc/passwd，输入用户的密码
[root@test-huanqiu conf]# touch /etc/vpnc/passwd
[root@test-huanqiu conf]# echo "PASSWORD" > /etc/vpnc/passwd
[root@test-huanqiu conf]# cat /etc/vpnc/passwd
PASSWORD

4）创建anyconnect脚本日志文件，不然连接anyconnect会失败
[root@test-huanqiu conf]# touch /var/log/openconnect-script.log

5）创建启动脚本脚本
[root@test-huanqiu conf]# vim /bin/vpn_start
#!/bin/sh
/usr/local/openconnect/scripts/vpn-connect /usr/local/openconnect/conf/config

[root@test-huanqiu conf]# chmod 755 /bin/vpn_start

6）执行启动脚本，进行vpn连接
[root@test-huanqiu conf]# /bin/sh /bin/vpn_start
Openconnect successfully started. Use vpn-disconnect to stop.

[root@test-huanqiu conf]# ps -ef|grep vpn
root 894 1 0 09:26 pts/0 00:00:00 /usr/sbin/openconnect --background --no-cert-check --script=/etc/vpnc/vpnc-script --user=wangshibo --passwd-on-stdin any.wangshiboholdings.com
root 898 808 0 09:26 pts/0 00:00:00 grep --color=auto vpn
----------------------------------------------------------------------------------------------------------------------------------
上面使用脚本连接的Anyconnect，也可以用命令直接连接（即上面启动后查看的vpn状态中去掉--passwd-on-stdin部分后的命令）
[root@test-huanqiu conf]# /usr/sbin/openconnect --background --no-cert-check --script=/etc/vpnc/vpnc-script --user=wangshibo any.wamgshiboholdings.com
POST https://any.wangshiboholdings.com/
Attempting to connect to server 13.25.24.115:443
SSL negotiation with any.wangshiboholdings.com
Server certificate verify failed: unable to get local issuer certificate
Connected to HTTPS on any.wangshiboholdings.com
XML POST enabled
Please enter your username and password.
Password:                                                           //输入密码即可
POST https://any.wangshiboholdings.com/
Got CONNECT response: HTTP/1.1 200 OK
CSTP connected. DPD 30, Keepalive 20
RTNETLINK answers: File exists
/etc/vpnc/vpnc-script: line 228: /var/run/vpnc/resolv.conf-backup: No such file or directory
Script '/etc/vpnc/vpnc-script' returned error 1
Connected tun0 as 10.4.9.145, using SSL
Continuing in background; pid 6078

查看已经成功连接
[root@test-huanqiu conf]# ps -ef|grep vpn
root 894 1 0 09:26 pts/0 00:00:00 /usr/sbin/openconnect --background --no-cert-check --script=/etc/vpnc/vpnc-script --user=wangshibo any.wangshiboholdings.com
root 898 808 0 09:26 pts/0 00:00:00 grep --color=auto vpn
----------------------------------------------------------------------------------------------------------------------------------

7）创建监控脚本（直接执行这个脚本，也可以连接Anyconnect）
[root@test-huanqiu conf]# vim /root/vpn_monit.sh
#!/bin/bash
NUM=`ps -ef|grep openconnect|grep -v "grep"|wc -l`
if [ $NUM -eq 0 ];then
     /bin/bash /bin/vpn_start >/dev/null 2>&1
else
    echo "It is ok"
fi

8）结合crontab，实现定期检查
[root@test-huanqiu conf]# crontab -l
*/30 * * * * /bin/sh /bin/vpn_start >/dev/null 2>&2
* * * * * /bin/bash /root/vpn_monit.sh > /dev/null 2>&1