Arch Linux User Repository

If you want to use old pulse-secure client 9.1r9, please download the following package.

https://drive.google.com/file/d/1_8tRA-T9vV08n_TpHqdcG5IvalxBuZ7_/view?usp=sharing

The rewritten pulse-secure client requires a service called 'pulsesecure'. Please enable and start the service before running the client.

Hmmm… can't reach this page descargas.grancanaria.com took too long to respond

nslookup descargas.grancanaria.com Server: ns0.local.university Address: xxx.yyy.0.66

Non-authoritative answer: Name: descargas.grancanaria.com Address: 212.64.180.75

I have flagged this package as out of date with additional information from the YAY output failing to retrieve the rpm package.

Although I can get the rpm package from the local university software downloads, after editing, the script failed the first attempt, then when it went through, failed to set up the service so that systemctl enable works but systemctl start does not.

Adding this lengthy comment, hoping Chiwanpark will see this, as it has been a few days since I flagged the package. Kind regards, Suma67

@archer97 Thanks for notification. I've updated the package to 22.7R2.

A new package is out, please update

https://descargas.grancanaria.com/Sistemas/PulseSecureClients/ps-pulse-linux-22.7r2-b29103-installer.rpm

Are instructions available on how to transfer the Windows Ivanti VPN connection to Arch Linux using this port?

@j0hannes Thanks for reporting. I've added patch to the dependency list.

Please make "patch" a dependency.

@iyanmv Sorry for late response. I've updated the package to patch setup_cef.sh. Now the script uses the system-installed shasum using which command. Thanks for reporting.

Can you patch /opt/pulsesecure/bin/setup_cef.sh so that is uses /usr/bin/core_perl/shasum instead of /usr/bin/shasum.

At the moment, sudo /opt/pulsesecure/bin/setup_cef.sh install (mentioned in the wiki entry) fails because of that.

Version 22.6 is available via

https://wiki.univ-nantes.fr/lib/exe/fetch.php?media=nomade:pulse_clients:ps-pulse-linux-22.6r1.0-b26825-64bit-installer.rpm

Version 22.6 adds dmidecode dependency

@incomingstick At present, Pulse Secure Linux Client version 22.3R1 is the latest release. Newer clients (22.6 series) are available for Windows and OS X, but not yet for Linux.

If a new version of the client is released, please flag the package as outdated.

@gonciarz extra/webkit2gtk is already in the optional dependencies list. Note that it is not required dependency if you connect to VPN without pulseUi.

Missing a runtime dependency on libwebkit2gtk-4.0.so.37. After installing extra/webkit2gtk (currently in 2.42.1-2 version) pulseUI works.

@Beinje Thanks for the reporting. Enabling the pulsesecure service in the package installation steps is discouraged due to permission issue. I'll change the after-installation message in future release to ensure that the service should be enabled.

I am running this package on EndeavourOS, with Gnome and X11. I have the same issue as @AshEnke, @amwalters, @xxmlud and others related to the message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files error message when running the program.

I found that the pulsesecure service was started but not enabled. See below:

systemctl status pulsesecure
● pulsesecure.service - pulsesecure service Daemon
     Loaded: loaded (/usr/lib/systemd/system/pulsesecure.service; disabled; preset: disabled)
     Active: active (running) since Fri 2023-08-25 15:02:03 CEST; 4s ago
    Process: 3478 ExecStart=/opt/pulsesecure/bin/startup.sh start (code=exited, status=0/SUCCESS)
   Main PID: 3481 (pulsesecure)
      Tasks: 5 (limit: 38105)
     Memory: 20.8M
        CPU: 4.119s
     CGroup: /system.slice/pulsesecure.service
             └─3481 /opt/pulsesecure/bin/pulsesecure

août 25 15:02:03 911-R-2XH0LS3 systemd[1]: Starting pulsesecure service Daemon...
août 25 15:02:03 911-R-2XH0LS3 systemd[1]: Started pulsesecure service Daemon.

Though it should only prevent the service from running on startup, it looks like enabling the service solves this issue. Maybe this is due to some missing symlink ? Hope this can help other to fix the problem in further versions.

systemctl enable pulsecure created symlink /etc/systemd/system/multi-user.target.wants/pulsesecure.service → /usr/lib/systemd/system/pulsesecure.service and solved the problem.

@erkexzcx I've checked the availability of RPM file, and the path to file works correctly. Maybe It is an temporary issue or network issue.

Looks like https://gml.noaa.gov/aftp/pub/cornwall/VPN%20Client/old/ps-pulse-linux-22.3r1.0-b18209-64bit-installer.rpm is unavailable and never loads to me, but I managed to find alternative download link:

https://wiki.univ-nantes.fr/lib/exe/fetch.php?media=nomade:pulse_clients:ps-pulse-linux-22.3r1.0-b18209-64bit-installer.rpm

In case it breaks - use below alternative links below to download using your browser. IDK, having a hard time using web archive today, so I just uploaded whenever I can:

https://anonymfile.com/AkJOV/ps-pulse-linux-223r10-b18209-64bit-installer.rpm
https://file.io/XsVxm1FwiHRk
https://safenote.co/r/64b7c2ef44c562@24587201

PKGBUILD have hardcoded checksum, so it automatically checks if the file is original/expected one or if it's not.

Having a problem with this - everything works up to the pop up asking me to enter my secondary password. I enter the password, hit connect but it doesn't seem to register that I've hit connect, then after 2 mins gives an error ('User input timeout. (Error:1382)'). I'm using v. 22.3.1.18209. Any ideas?

The authentication window (after clicking connect) is no longer being displayed after update.

@erkexzcx To run pulseUi, you need to web2kitgtk package. It is optional dependency because some users do not need to pulseUi.

Getting this:

$ grep Exec /opt/pulsesecure/resource/pulse.desktop
Exec=/opt/pulsesecure/bin/pulseUI
$ /opt/pulsesecure/bin/pulseUI                 
/opt/pulsesecure/bin/pulseUI: error while loading shared libraries: libwebkit2gtk-4.0.so.37: cannot open shared object file: No such file or directory

Removing the symlink "/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt" before updating the package fixed the problem.

But this should be handled by the package, I think. ;)

I got this error on 22.3r1.0_b18209-1

error: failed to commit transaction (conflicting files)
pulse-secure: /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt exists in filesystem
Errors occurred, no packages were upgraded.

Should ca-bundle.trust.crt remove automatically?

random quit of the program

I get following error during installation: error: could not set install reason for package pulse-secure (could not find or read package)

edit: I think it's because of yay. Switched to paru and installed package without any problem.

@TrevorBramble you can fix the stuck Chromium Embedded Framework installation in the GUI client, by installing it manually with the provided script:

sudo /opt/pulsesecure/bin/setup_cef.sh install

I'm having the same issue as:

AshEnke - https://aur.archlinux.org/packages/pulse-secure?O=10#comment-870010

alex19damian - https://aur.archlinux.org/packages/pulse-secure?O=20#comment-852563

nunopinheiro - https://aur.archlinux.org/packages/pulse-secure?O=30#comment-828915

UI will only load if the service is not running, or manually disconnected by pressing ctrl+c after trying to launc the UI. I can't find an error in any logs. Has anyone figured this out?

Edit: found a workaround. It works on Plasma Wayland, not on Plasma X11

@chiwanpark, I'm having the same problem described with an unknown "net.psecure.pulse" service. The actual "pulsesecure" service is enabled and active.

When attempting, on a fresh install, to connect to a VPN I am prompted to download the Chromium Embedded Framework and the progress bar never moves. Only when launching pulseUI from a terminal do I get the deluge of error messages.

Hi, @chiwanpark, the latest version still enabling the service does not work.

Edit: Whenever I connect I get this message:

"The certificate name does not match the server you are trying to connect to".

Is there any way to remove this message?

@xxmlud You have to start and enable service named 'pulsesecure.service' as I mentioned in the post-installation message.

Hi!

I am in the process of migrating from Ubuntu to Arch, I have installed the latest version and I have the same sharing as @AshEnke.

The binary is reporting these messages.

DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 

Do you know if downgrading version works?

This VPN client is my only requirement to be able to work. Without it I will not be able to migrate to Arch. Any help?

Edit: I have managed to get the client working with version: 9.1r11.0_b6725

Regards,

There is a weird bug with Pulse Secure: current installation seems not trust the system CA store.

In fact, the client try to load the CA store at path /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt but, on Arch, the file is located at /etc/ca-certificates/extracted/ca-bundle.trust.crt.

It could be interesting to add, in the installation process, the creation of a link from existing file to required file...

Or, at least, a message at the end of the installation to indicate that the user need to create the link to allow the certificate validation.

@chiwanpark I'm afraid the new UI should be only on the Windows client. I don't see that there are changes at the moment in the linux client

@thecrow I've packaged and installed 22.2.R1 build 1295, but UI seems not be changed (see https://imgur.com/a/GcjmbLl). Could you find the package (in RPM format) with new UI?

It hangs on

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA

Press Ctrl+c to Stop VPN Connection....

Status: Connect requested

Any ideas how to debug this?

Pulse Secure Client is re-branded as Ivanti Secure Access Client. The release numbering is updated to 22.RX. Complete UX rebranding and the UI upgrade is implemented. There is also an option to switch between the Classic UI and New-UI to maintain user experience. The Pulse Secure client icon is replaced by Ivanti Secure Access Client icon

For saved connections in pulseUI to not disappear when the pulsesecure service restarts, mkdir -p /var/lib/pulsesecure/pulse seems to work.

I have a problem on the latest (9.1r15.0_b15819-2) and older versions : I start the pulsesecure service, and try to run the /opt/pulsesecure/bin/pulseUI command, and it's stuck at

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA

and it hangs there. If I try to press Ctrl + C to cancel it, the UI launches, but it looks like it doesn't detect the running service (lots of DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files error messages, and I can't connect.

What's weird is that if I stop the service and try to run the pulseUI program, it goes straight to the "missing service" error :

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 

journalctl -u pulsesecure.service -f doesn't show anything wrong, and the pulselauncher command behaves the same...

Any idea ?

It doesn't save my connections. Every time I restart it I have to create my connections again. Is there anything that I am missing?

Thanks, it works now.

@mso I've updated the package to ignore SSL certificate validation. Sorry for the inconvenience.

Note that skipping SSL validation is insecure. If you don't want skip the validation, remove the second line of PKGBUILD file.

DLAGENTS=("https::/usr/bin/curl -k -o %o %u")

Under Manjaro cannot update to 9.1r15 since curl complains about invalid SSL ceritificate when donwloading the following file: https://webdev.web3.technion.ac.il/docs/cis/public/ssl-vpn/v.9.1R15.0/ps-pulse-linux-9.1r15.0-b15819-64bit-installer.rpm

Error output: curl: (60) SSL certificate problem: unable to get local issuer certificate

Does this work for you?

Note in case it may help someone: I managed to skip the error by manually downloading the rpm file to my local file system and editing the build file pointing the download destination to my local file: source_x86_64=("file://<MY_LOCAL_PATH>") (Replace <MY_LOCAL_PATH> with the path you downloaded the file to)

There is also another problem since last few updates. In case the connection gets stuck or is cancelled, the /etc/resolv.conf is not reset to previous contents.

In my specific case this makes pulse-secure unable to re-connect because the VPN-provided DNS servers cannot resolve the connection endpoint. This could be fixed on my VPN, but the resolv.conf should be reset to previous contents anyway.

The new version 9.1r14.0-b13525 does not work for me. When trying to connect it says, that the embedded chromium is not installed. Then it downloads and extracts the browser, but cannot use it afterwards. No error is logged.

Noticed a new release today but there is a later release actually (which was released in January):

https://webdev.web3.technion.ac.il/docs/cis/public/ssl-vpn/v.9.1R14.0/ps-pulse-linux-9.1r14.0-b13525-64bit-installer.rpm

I have tried version r12, r13, and r14 and all fail for me on an up-to-date system. I can see these errors on the logs:

failed with error /opt/pulsesecure//lib/iveConnectionMethod/samAccessMethod.so: cannot open shared object file
'ConnectionManager' failed to start connection method integrationAccessMethod, error 1000
'AccessServiceProxy' createInstance of plugin integrationAccessMethod failed with error 0xe00103e8

Any ideas?

New URL to use for the binary:

https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/old/ps-pulse-linux-9.1r12.0-b10247-64-bit-installer.rpm

I have installed, enabled service and started. Still not working, freezing if i start from commandline and no written nothing on logs.

  ~/Downloads ❯ pulseUI dsOpenSSL Start - dsENGINE_register_ECDSA dsOpenSSL End - dsENGINE_register_ECDSA

If i interrupt with Ctrl + c, then start but dont save connections and no connect.

^C (pulseUI:19056): Gtk-WARNING **: 12:14:33.740: Theme parsing error: gtk.css:68:35: The style property GtkButton:child-displacement-x is deprecated and shouldn't be used anymore. It will be removed in a future version

DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files

Updated using https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r13.1-b12971-64bit-installer.rpm

Temporary workaround until this get updated: 1. Download built zst from here https://mega.nz/file/XwwQ2Y6C#mKqm9v9RUWt6EjoNGQq-VGTVG7FcnxkeJT9s3oFbIN8 1b. Or you can build your own by modifying the code with the file URL and its md5sum hash. 2. Offline install using "sudo pacman -U *.zst"