Arch Linux User Repository

If you want to use old pulse-secure client 9.1r9, please download the following package.

https://drive.google.com/file/d/1_8tRA-T9vV08n_TpHqdcG5IvalxBuZ7_/view?usp=sharing

The rewritten pulse-secure client requires a service called 'pulsesecure'. Please enable and start the service before running the client.

Hi,

New build 22.8-R1 is out, could you update the package?

Thanks!

While waiting for version 22.7r4, we can apply this patch to versión 22.7r3

diff --git a/PKGBUILD b/PKGBUILD
index 12b3ef3..0e5149f 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,8 +1,7 @@
 # Maintainer: Chiwan Park <chiwanpark@hotmail.com>
 DLAGENTS=("https::/usr/bin/curl -k -o %o %u")
-
 pkgname=pulse-secure
-pkgver=22.7r3.0_b30227
+pkgver=22.7r4_b30859
 pkgrel=1
 pkgdesc='Ivanti Secure Access Client'
 arch=(x86_64)
@@ -11,9 +10,9 @@ url='https://www.pulsesecure.net/'
 depends=(gcc-libs libgnome-keyring openssl curl dbus libbsd dmidecode patch)
 install=${pkgname}.install
 source=("EULA.txt" "setup_cef.sh.patch")
-source_x86_64=("https://ccnet.ntu.edu.tw/vpn/Download/ps-pulse-linux-22.7r3-b30227-installer.rpm")
+source_x86_64=("https://ccnet.ntu.edu.tw/vpn/Download/ps-pulse-linux-22.7r4-b30859-installer.rpm")
 md5sums=('261848a28201e5386ec4bf587473a48b' '31c0e4d462053b189274b8f6df340525')
-md5sums_x86_64=('174a7d91502389ec88aab3fe2ddbc410')
+md5sums_x86_64=('6afaba7b32a172a6073d5505ad3f2de0')
 optdepends=('psmisc: for pulsesvc -K', 'gtkmm3: for pulseUi', 'webkit2gtk: for pulseUi')
 conflicts=(pulse-connect-secure)

Hope it helps

Hi,

New build version 22.7R4 Build 30859[1] is available.

Will it possible to update the package ?

Thank you.

[1] https://help.ivanti.com/ps/help/en_US/ISAC/22.X/22.X-Client-RelNotes.pdf

ps-pulse-linux-22.7r3-b30227-installer.rpm is out, can you please update the build.

@Marduk, webkit2gtk and gtkmm3 are already listed in the optional dependencies. Note that there is another method (pulsesvc) to connect VPN without the GUI; thus, they are optional.

Under Plasma 6 (Endeavouros Neo)

for the GUI to launch , I needed to do :

sudo pacman -S webkit2gtk && sudo pacman -S gtkmm3

EDIT: Problem after I reboot(I enable pulsesecure.service at boot

After one successful try with pulse-secure(ui can be opened, VPN is connected), it stopped working today.

I made sure the pulsesecure.service is enabled

systemctl status pulsesecure
● pulsesecure.service - pulsesecure service Daemon
     Loaded: loaded (/usr/lib/systemd/s
ystem/pulsesecure.service; enabled; preset: disabled)
     Active: active (running) since Tue 2024-09-03 10:29:24 EDT; 7min ago
 Invocation: 245b4c266d844afca87afdaf899ac4b3
   Main PID: 18231 (pulsesecure)
      Tasks: 1 (limit: 18714)
     Memory: 1.9M (peak: 3.4M)
        CPU: 1.765s
     CGroup: /system.slice/pulsesecure.service
             └─18231 /opt/pulsesecure/bin/pulsesecure

However, when I tried to open pulseUI, it won't start. Then I abort the current task with ctrl+c, it gave the following error:

DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable 

webkit2gtk and gtkmm3 are all installed

@Suma67 @chiwanpark I can both build the package manually with makepkg and download the source file directly via browser. Maybe the yay helper is part of the problem or your specific location / region gets blocked. Maybe try building the package without yay.

@Chiwanpark I sent you an email with a screen capture from the yay helper installation command to failure, specifically, the RPM file not being able to be downloaded. I went to the testing site and the https://descargas.grancanaria.com/Sistemas/PulseSecureClients test good. The only thing after this is the name of the file. So, has the file name changed? The script is pointing to ps-pulse-linux-22.7r2-b29103-installer.rpm Is this still correct? I truly appreciate your quick response to the previous comment. Thank you and kind regards, Suma67

@Suma67 I've unflagged this package because I can access the RPM package through the current URL. I confirmed the current package source is accessible from various regions. See https://semonto.com/tools/website-reachability-check?test=cca738bb42f09956 for details.

For the systemctl issue, you have to update the installed service via sudo systemctl daemon-reload or reboot to start the service. I'll add this description to script in next release.

Hmmm… can't reach this page descargas.grancanaria.com took too long to respond

nslookup descargas.grancanaria.com Server: ns0.local.university Address: xxx.yyy.0.66

Non-authoritative answer: Name: descargas.grancanaria.com Address: 212.64.180.75

I have flagged this package as out of date with additional information from the YAY output failing to retrieve the rpm package.

Although I can get the rpm package from the local university software downloads, after editing, the script failed the first attempt, then when it went through, failed to set up the service so that systemctl enable works but systemctl start does not.

Adding this lengthy comment, hoping Chiwanpark will see this, as it has been a few days since I flagged the package. Kind regards, Suma67

@archer97 Thanks for notification. I've updated the package to 22.7R2.

A new package is out, please update

https://descargas.grancanaria.com/Sistemas/PulseSecureClients/ps-pulse-linux-22.7r2-b29103-installer.rpm

Are instructions available on how to transfer the Windows Ivanti VPN connection to Arch Linux using this port?

@j0hannes Thanks for reporting. I've added patch to the dependency list.

Please make "patch" a dependency.

@iyanmv Sorry for late response. I've updated the package to patch setup_cef.sh. Now the script uses the system-installed shasum using which command. Thanks for reporting.

Can you patch /opt/pulsesecure/bin/setup_cef.sh so that is uses /usr/bin/core_perl/shasum instead of /usr/bin/shasum.

At the moment, sudo /opt/pulsesecure/bin/setup_cef.sh install (mentioned in the wiki entry) fails because of that.

Version 22.6 is available via

https://wiki.univ-nantes.fr/lib/exe/fetch.php?media=nomade:pulse_clients:ps-pulse-linux-22.6r1.0-b26825-64bit-installer.rpm

Version 22.6 adds dmidecode dependency

@incomingstick At present, Pulse Secure Linux Client version 22.3R1 is the latest release. Newer clients (22.6 series) are available for Windows and OS X, but not yet for Linux.

If a new version of the client is released, please flag the package as outdated.

@gonciarz extra/webkit2gtk is already in the optional dependencies list. Note that it is not required dependency if you connect to VPN without pulseUi.

Missing a runtime dependency on libwebkit2gtk-4.0.so.37. After installing extra/webkit2gtk (currently in 2.42.1-2 version) pulseUI works.

@Beinje Thanks for the reporting. Enabling the pulsesecure service in the package installation steps is discouraged due to permission issue. I'll change the after-installation message in future release to ensure that the service should be enabled.

I am running this package on EndeavourOS, with Gnome and X11. I have the same issue as @AshEnke, @amwalters, @xxmlud and others related to the message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files error message when running the program.

I found that the pulsesecure service was started but not enabled. See below:

systemctl status pulsesecure
● pulsesecure.service - pulsesecure service Daemon
     Loaded: loaded (/usr/lib/systemd/system/pulsesecure.service; disabled; preset: disabled)
     Active: active (running) since Fri 2023-08-25 15:02:03 CEST; 4s ago
    Process: 3478 ExecStart=/opt/pulsesecure/bin/startup.sh start (code=exited, status=0/SUCCESS)
   Main PID: 3481 (pulsesecure)
      Tasks: 5 (limit: 38105)
     Memory: 20.8M
        CPU: 4.119s
     CGroup: /system.slice/pulsesecure.service
             └─3481 /opt/pulsesecure/bin/pulsesecure

août 25 15:02:03 911-R-2XH0LS3 systemd[1]: Starting pulsesecure service Daemon...
août 25 15:02:03 911-R-2XH0LS3 systemd[1]: Started pulsesecure service Daemon.

Though it should only prevent the service from running on startup, it looks like enabling the service solves this issue. Maybe this is due to some missing symlink ? Hope this can help other to fix the problem in further versions.

systemctl enable pulsecure created symlink /etc/systemd/system/multi-user.target.wants/pulsesecure.service → /usr/lib/systemd/system/pulsesecure.service and solved the problem.

@erkexzcx I've checked the availability of RPM file, and the path to file works correctly. Maybe It is an temporary issue or network issue.

Looks like https://gml.noaa.gov/aftp/pub/cornwall/VPN%20Client/old/ps-pulse-linux-22.3r1.0-b18209-64bit-installer.rpm is unavailable and never loads to me, but I managed to find alternative download link:

https://wiki.univ-nantes.fr/lib/exe/fetch.php?media=nomade:pulse_clients:ps-pulse-linux-22.3r1.0-b18209-64bit-installer.rpm

In case it breaks - use below alternative links below to download using your browser. IDK, having a hard time using web archive today, so I just uploaded whenever I can:

https://anonymfile.com/AkJOV/ps-pulse-linux-223r10-b18209-64bit-installer.rpm
https://file.io/XsVxm1FwiHRk
https://safenote.co/r/64b7c2ef44c562@24587201

PKGBUILD have hardcoded checksum, so it automatically checks if the file is original/expected one or if it's not.

Having a problem with this - everything works up to the pop up asking me to enter my secondary password. I enter the password, hit connect but it doesn't seem to register that I've hit connect, then after 2 mins gives an error ('User input timeout. (Error:1382)'). I'm using v. 22.3.1.18209. Any ideas?

The authentication window (after clicking connect) is no longer being displayed after update.

@erkexzcx To run pulseUi, you need to web2kitgtk package. It is optional dependency because some users do not need to pulseUi.

Getting this:

$ grep Exec /opt/pulsesecure/resource/pulse.desktop
Exec=/opt/pulsesecure/bin/pulseUI
$ /opt/pulsesecure/bin/pulseUI                 
/opt/pulsesecure/bin/pulseUI: error while loading shared libraries: libwebkit2gtk-4.0.so.37: cannot open shared object file: No such file or directory

Removing the symlink "/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt" before updating the package fixed the problem.

But this should be handled by the package, I think. ;)

I got this error on 22.3r1.0_b18209-1

error: failed to commit transaction (conflicting files)
pulse-secure: /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt exists in filesystem
Errors occurred, no packages were upgraded.

Should ca-bundle.trust.crt remove automatically?

random quit of the program

I get following error during installation: error: could not set install reason for package pulse-secure (could not find or read package)

edit: I think it's because of yay. Switched to paru and installed package without any problem.

@TrevorBramble you can fix the stuck Chromium Embedded Framework installation in the GUI client, by installing it manually with the provided script:

sudo /opt/pulsesecure/bin/setup_cef.sh install

I'm having the same issue as:

AshEnke - https://aur.archlinux.org/packages/pulse-secure?O=10#comment-870010

alex19damian - https://aur.archlinux.org/packages/pulse-secure?O=20#comment-852563

nunopinheiro - https://aur.archlinux.org/packages/pulse-secure?O=30#comment-828915

UI will only load if the service is not running, or manually disconnected by pressing ctrl+c after trying to launc the UI. I can't find an error in any logs. Has anyone figured this out?

Edit: found a workaround. It works on Plasma Wayland, not on Plasma X11

@chiwanpark, I'm having the same problem described with an unknown "net.psecure.pulse" service. The actual "pulsesecure" service is enabled and active.

When attempting, on a fresh install, to connect to a VPN I am prompted to download the Chromium Embedded Framework and the progress bar never moves. Only when launching pulseUI from a terminal do I get the deluge of error messages.

Hi, @chiwanpark, the latest version still enabling the service does not work.

Edit: Whenever I connect I get this message:

"The certificate name does not match the server you are trying to connect to".

Is there any way to remove this message?

@xxmlud You have to start and enable service named 'pulsesecure.service' as I mentioned in the post-installation message.

Hi!

I am in the process of migrating from Ubuntu to Arch, I have installed the latest version and I have the same sharing as @AshEnke.

The binary is reporting these messages.

DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 

Do you know if downgrading version works?

This VPN client is my only requirement to be able to work. Without it I will not be able to migrate to Arch. Any help?

Edit: I have managed to get the client working with version: 9.1r11.0_b6725

Regards,

There is a weird bug with Pulse Secure: current installation seems not trust the system CA store.

In fact, the client try to load the CA store at path /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt but, on Arch, the file is located at /etc/ca-certificates/extracted/ca-bundle.trust.crt.

It could be interesting to add, in the installation process, the creation of a link from existing file to required file...

Or, at least, a message at the end of the installation to indicate that the user need to create the link to allow the certificate validation.

@chiwanpark I'm afraid the new UI should be only on the Windows client. I don't see that there are changes at the moment in the linux client

@thecrow I've packaged and installed 22.2.R1 build 1295, but UI seems not be changed (see https://imgur.com/a/GcjmbLl). Could you find the package (in RPM format) with new UI?

It hangs on

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA

Press Ctrl+c to Stop VPN Connection....

Status: Connect requested

Any ideas how to debug this?

Pulse Secure Client is re-branded as Ivanti Secure Access Client. The release numbering is updated to 22.RX. Complete UX rebranding and the UI upgrade is implemented. There is also an option to switch between the Classic UI and New-UI to maintain user experience. The Pulse Secure client icon is replaced by Ivanti Secure Access Client icon

For saved connections in pulseUI to not disappear when the pulsesecure service restarts, mkdir -p /var/lib/pulsesecure/pulse seems to work.

I have a problem on the latest (9.1r15.0_b15819-2) and older versions : I start the pulsesecure service, and try to run the /opt/pulsesecure/bin/pulseUI command, and it's stuck at

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA

and it hangs there. If I try to press Ctrl + C to cancel it, the UI launches, but it looks like it doesn't detect the running service (lots of DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files error messages, and I can't connect.

What's weird is that if I stop the service and try to run the pulseUI program, it goes straight to the "missing service" error :

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 

journalctl -u pulsesecure.service -f doesn't show anything wrong, and the pulselauncher command behaves the same...

Any idea ?

It doesn't save my connections. Every time I restart it I have to create my connections again. Is there anything that I am missing?