Arch Linux User Repository

If you want to use old pulse-secure client 9.1r9, please download the following package.

https://drive.google.com/file/d/1_8tRA-T9vV08n_TpHqdcG5IvalxBuZ7_/view?usp=sharing

The rewritten pulse-secure client requires a service called 'pulsesecure'. Please enable and start the service before running the client.

So I had two issues that prevented this from working today. The first is that icu (https://archlinux.org/packages/core/x86_64/icu/) has been upgraded, the second is the curl issues with 7.74, in previous comments.

icu and especially curl have lots of dependencies so it didn't seem smart to downgrade them. What I did was I found the previous archives, and unzipped them somewhere, then used LD_LIBRARY_PATH to use the old versions. You can get the old versions from the Arch Linux Archive, here are some examples.

mkdir -p ~/old_versions cd ~/old_versions wget https://archive.archlinux.org/packages/c/curl/curl-7.73.0-1-x86_64.pkg.tar.zst wget https://archive.archlinux.org/packages/i/icu/icu-67.1-1-x86_64.pkg.tar.zst

At this point you should validate the signatures for the packages.

Then unarchive them: tar -I zstd -xvf curl-7.73.0-1-x86_64.pkg.tar.zst tar -I zstd -xvf icu-67.1-1-x86_64.pkg.tar.zst

Then export LD_LIBRARY_PATH=/home/<username>/old_versions/usr/lib/:$LD_LIBRARY_PATH

then ran pulseUi and it worked.

CC @je-vv

@Hubro, I see your comment on https://aur.archlinux.org/packages/webkitgtk/#comment-784272, however, strangely enough, it built for me, with its latest change ~10 days ago... I do prefer building it, but have you tried using the binary AUR package (https://aur.archlinux.org/packages/webkitgtk-bin)? That might prevent building issues I'd guess..

I do have to use webkitgtk, since I have no clue how to use pulse-secure with MFA on the command line, and that's a must where I work unfortunately, :( However if you don't use the multi factor authentication, and use an OTP instead, or similar non multi factor auth, then you can get away with using the pulse-secure command line. I used it for several years, without even having webkitgtk installed... An usage example:

pulsesvc -h ${GATEWAY} -u ${USER} -p ${OATH_PIN_PASS} -r "OATH Passcode"

But it all depends on what the org needing you to use this privative SW requires...

I'm no longer able to use this package since AUR's webkitgtk package will no longer compile. Does anybody else have this issue? Is there a workaround that avoids using the AUR webkitgtk package? Or have any of you succeeded in building it?

@chiwanpark: There's a newer version, 9.1.R10. But it seems it hasn't been updated for the trial downloads.

@lindbergio yes, they rewrote the application and released it as 9.1r9.0_b4983. however, b4983 also crashes with curl 7.74.

Seems like Pulse Secure did a re-write of the pulse application. It seems that they changed the package name from "pulse" to "pulsesecure" as well.

I posted into their community support forums to hopefully bring some sort of awareness to this issue:

https://community.pulsesecure.net/t5/Pulse-Desktop-Clients/Linux-Pulse-Client-does-not-work-with-curl-7-74/td-p/44378/jump-to/first-unread-message

I don't see how to contact any one from https://www.pulsesecure.net to help solve the issue, anyone knows? Have anyone tried contacting pulsesecure guys?

You can also get old versions of packages from the archive, https://archive.archlinux.org/packages/c/curl.

BTW, the error I'm seeing although getting fixed by downgrading curl, is a bit different from the one posted in the curl issue. IT seems like having issues parsing some openssl confg file:

futex(0x7f7f7ed3e818, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e80c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e804, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e8f8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e7f0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e7e8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3bc5c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e6c4, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e65c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e650, FUTEX_WAKE_PRIVATE, 2147483647) = 0
brk(0x1d3c000)                          = 0x1d3c000
futex(0x7f7f7ed3e7fc, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e7b8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f7f7ed3e7b0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
openat(AT_FDCWD, "/etc/ssl/openssl.cnf", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=10909, ...}) = 0
read(3, "#\n# OpenSSL example configuratio"..., 4096) = 4096
read(3, "# WARNING: ancient versions of N"..., 4096) = 4096
read(3, "es of the usage of nsCertType. I"..., 4096) = 2717
read(3, "", 4096)                       = 0
close(3)                                = 0
futex(0x7f7f7ed3e7e0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV +++
Segmentation fault

That gotten from strace, bacause the only message gotten when running pulse is "Segmentation fault"

@anatolik I have the same issue you reported. I've temporarily downgraded curl to 7.73 via downgrade package. (https://aur.archlinux.org/packages/downgrade/)

I see following issue with this package https://github.com/curl/curl/issues/6306

Does anybody see it as well?

The patch needs to be updated for 9.1r9-0. Specifically the SUPPORTED_OSTYPES_LIST line:

--- usr/local/pulse/PulseClient_x86_64.sh   2020-04-03 15:17:07.000000000 +0900
+++ usr/local/pulse/PulseClient_x86_64.sh.new   2020-05-05 22:51:10.170118991 +0900
@@ -17,7 +17,7 @@

 SCRNAME=`basename $0`

-SUPPORTED_OSTYPES_LIST=( CENTOS_6 CENTOS_7 CENTOS_8 UBUNTU_14 UBUNTU_15 UBUNTU_16_17_18 UBUNTU_19 FEDORA FEDORA_30 FEDORA_31 FEDORA_32 RHEL_7 RHEL_8 DEBIAN_8_9 DEBIAN_10 THINPRO_7 UNSUPPORTED)
+SUPPORTED_OSTYPES_LIST=( ARCH CENTOS_6 CENTOS_7 CENTOS_8 UBUNTU_14 UBUNTU_15 UBUNTU_16_17_18 UBUNTU_19 FEDORA FEDORA_30 FEDORA_31 FEDORA_32 RHEL_7 RHEL_8 DEBIAN_8_9 DEBIAN_10 THINPRO_7 UNSUPPORTED)
 #RPM Based
 CENTOS_6_DEPENDENCIES=( glibc \
                         nss-softokn-freebl \
@@ -305,6 +305,8 @@
         else
             OS_TYPE=${SUPPORTED_OSTYPES_LIST[$UNSUPPORTED]}
         fi
+    elif [ -f /etc/arch-release ]; then
+        OS_TYPE=${SUPPORTED_OSTYPES_LIST[$ARCH]}
     else
         OSNAME=$(lsb_release -d | grep -o "Ubuntu")
         if [ "X$OSNAME" != "X" ]; then
@@ -355,7 +357,7 @@
         isRpmBased=1
     elif [[ ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_14]}) || \
         ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_15]}) || \
-        ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_16_17_18_19]}) || \
+        ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_16_17_18]}) || \
         ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_19]}) || \
         ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$DEBIAN_10]}) || \
         ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$DEBIAN_8_9]}) ]]; then
@@ -430,7 +432,8 @@
         RPM_DIST=1
     elif [[ ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_14]}) || \
         ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_15]}) || \
-        ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_16_17_18_19]}) || \
+        ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_16_17_18]}) || \
+        ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$UBUNTU_19]}) || \
         ($OS_TYPE = ${SUPPORTED_OSTYPES_LIST[$DEBIAN_8_9]}) ]]; then
         DPKG_DIST=1
     fi

@danilopiazza ps-pulse-linux-9.1r9.0-b4983-centos-rhel-64-bit-installer.rpm does not correspond to "right one" from PulseSecure.

ps-pulse-linux-9.1r9.0-b4983-centos-rhel-64-bit-installer.rpm:

size: 8100608
md5: a89f147d7c243800cb2211dbc15f662f
sha256: ca895bc714c12c02e28b463913995f3f4addfb659e4b4e8e3fa1ca0626e3353d

PulseSecure have this one ps-pulse-linux-9.1r9.0-b255-centos-rhel-64-bit-installer.rpm:

size: 49364144
md5: f727a1d286baba9311be2bc6a7e77293
sha256: af60e99946e16c55ae0e37759968a3b175aadcd3f2d3954e2c120403df65e3de

A new version is available: https://www.rz.uni-osnabrueck.de/fileadmin/user_upload/VPN/Software/ps-pulse-linux-9.1r9.0-b4983-centos-rhel-64-bit-installer.rpm

Company VPN requires login with eID through browser with extension, but the browser that opens when logging in doesn't allow that (afaik). Is it possible somehow to open the login screen with firefox instead?

FYI: namcap complains:

pulse-secure E: Dependency libsecret detected and not included (libraries ['usr/lib/libsecret-1.so.0'] needed in files ['usr/local/pulse/pulseutil'])

I have

pacman -Qo /usr/lib/libwebkitgtk-3.0.so.0
/usr/lib/libwebkitgtk-3.0.so.0 is owned by webkitgtk 3:2.4.11-19

Getting : /usr/local/pulse/pulseUi: error while loading shared libraries: libwebkitgtk-3.0.so.0: cannot open shared object file: No such file or directory

Reinstalling webkit doesn't change this, how do I fix this error?

@tryax Could you try again? The file is downloaded without any failure.

curl: (22) The requested URL returned error: 416 ==> ERROR: Failure while downloading http://ccnet.ntu.edu.tw/vpn/Download/ps-pulse-linux-9.1r8.0-b165-centos-rhel-64-bit-installer.rpm

curl: (22) The requested URL returned error: 404 Not Found ==> ERROR: Failure while downloading https://wiki.univ-nantes.fr/_media/nomade:pulse_clients:ps-pulse-linux-9.1r5.0-b151-centos-rhel-64-bit-installer.rpm I think maybe this package need to update the source of .rpm file

Getting

$ /usr/bin/pulseUi /usr/local/pulse/pulseUi: error while loading shared libraries: libwebkitgtk-3.0.so.0: cannot open shared object file: No such file or directory

I have modified the pulsesvc binary to:

• do not change /etc/hosts

• do not change /etc/resolv.conf

• do not add new routes

Instructions: https://gist.github.com/adrianlzt/dc932eee56d65132b303d7e81efb5fed

Does anyone know how to get the correct realm when using pulsesvc directly?

I can login using pulseUi, but now with pulsesvc. I've tried stracing pulsesvc, but I can't find any mention of the realm. Also tried greping the sources of welcome.cgi and login.cgi.

Even though I've tried to rebuild webkitgtk, I sill got the following issue when launching pulseUi :

/usr/local/pulse/pulseUi: error while loading shared libraries: libicui18n.so.65: cannot open shared object file: No such file or directory

I've also had to install the package locally with a manually downloaded rpm package in order to make it work (there are some issues with curl and redirects with the given server).

pulsesvc works as expected.

@alogim There was a bug in runner script. I've fixed and uploaded the updated package. Thanks for reporting! :)

I guess something got messed up, because when I try to use PulseClient it keeps telling me: Checking for missing dependency packages for command line client ... /usr/local/pulse/PulseClient_x86_64.sh: line 477: dpkg-query: command not found sudo password : sudo: apt-get: command not found Failed to install dependencies.Please execute following command manually. apt-get install libc6 executing command : /usr/local/pulse/pulsesvc -host <my host> -user <my user> -password <my password> -realm <my realm>

@chiwanpark Thanks to you!

BTW: here are the Release Notes for newest version: https://www-prev.pulsesecure.net/download/techpubs/current/2007/pulse-client/pulse-secure-client-desktop/9.1Rx/ps-pulse-9.1r5-releasenotes.pdf

@fprietog Thanks for notification! I've updated the package. :)

New version 9.1R5(151)

Download: https://wiki.univ-nantes.fr/_media/nomade:pulse_clients:ps-pulse-linux-9.1r5.0-b151-centos-rhel-64-bit-installer.rpm

@alogim Congrats!

@danilopiazza @chiwanpark I finally managed to find the culprit. I use a manually-written script to connect to NordVPN, where I also set the immutable attribute (+i) on /etc/resolv.conf. I removed that and now I am finally able to successfully connect. strace was a great help, since it reported this openat(AT_FDCWD, "/etc/resolv.conf", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EPERM (Operation not permitted)

@alogim use either strace or ltrace to detect what the host checker is looking for:

strace /usr/local/pulse/pulsesvc -host HOST -user USER -password PASSWORD -realm REALM -Url URL

ltrace /usr/local/pulse/pulsesvc -host HOST -user USER -password PASSWORD -realm REALM -Url URL

For instance, my network's host checker looks for the xinetd process.

@alogim I found the following logs from your uploaded file.

20200410094556.344381 pulsesvc[p48776.t48776] pulsesvc.info Host checking failed, Required file not found (FileHCRule.cpp:91) 20200410094556.344425 pulsesvc[p48776.t48776] pulsesvc.info HC policy evaluation response String: policy:vc0|19|policy_3|3|LnxHost status:NOTOK error:Required file not found (HCLinuxImc.cpp:431) 20200410094556.344458 pulsesvc[p48776.t48776] pulsesvc.info HC policy evaluation response String: policy:vc0|19|policy_3|3|LnxHost status:NOTOK error:Required file not found , hcStatus: 3 (HCLinuxImc.cpp:435)

The logs mean that the VPN server disconnect connection because the client verification has failed. Note that the server can accept only specific linux distribution (CentOS or Ubuntu) via host checker configuration. You may check the host checker configuration from your network administrator.

Sure, here it is: https://pastebin.com/raw/MMMScxqy

@alogim Could you upload ~/.pulse_secure/pulse/pulsesvc.log? To be clarify the reason easily, please remove the log file first, and attempt to connect your VPN.

@chiwanpark I can connect perfectly fine from Ubuntu inside a virtualbox hosted on the same system and with the same connection. So it seems an Archlinux problem. Notice that I tried everything, the RPM, the DEB and the one provided by my company, but on Archlinux I always get that error message and then the application closes.

@aiogim @mvidaldp Could you attempt to connect your VPN in other distro (such as Ubuntu, CentOS) with the RPM (or DEB) from the source site? It seems that the problem is not our packaging, but the bug in pulse-secure client with your VPN configuration.

I am unable to connect, I have the same problem reported by user mvidaldp. What happens:

1) I create a new connection

2) Click on the "Connect" button

3) A new window pops up where I enter my credentials (user name and password)

4) I click Sign in

5) The window changes and it says

Loading Components...

If an error prevents a component from loading properly, you can click here to continue. Not all functionality may be available.

6) After a few seconds this window closes and it goes back to the original window with the connection

7) Compliance goes from an empty string to "Meets security policies"

8) The window closes with this error in the terminal:

pulseUi: pulseUiLib.cpp:305: void NCUI::run(uint64_t): Assertion `m_conn->isConnected()' failed.

By the way, I tried installing, removing and reinstalling all three versions of webkitgtk.

I had the following errors while trying to run it:

/usr/local/pulse/pulseUi: error while loading shared libraries: libwebkitgtk-3.0.so.0: cannot open shared object file: No such file or directory

/usr/local/pulse/pulseUi: error while loading shared libraries: libicui18n.so.64: cannot open shared object file: No such file or directory

I fixed it by installing: webkitgtk-bin icu64

However, I cannot connect to a VPN. When I try I get this:

20200327125631.442475 pulsesvc[p206629.t206684] IpcConn.error connect failed with error 111 (ncipc.cpp:227) pulseUi: pulseUiLib.cpp:305: void NCUI::run(uint64_t): Assertion `m_conn->isConnected()' failed. Aborted (core dumped)

@danilopiazza Thanks for notification! I've pushed the updated package.

As of March 2020, the latest version is 9.1r4.0-b143.

It hosted at either:

1. https://wiki.univ-nantes.fr/nomade:client_lourd → https://wiki.univ-nantes.fr/_media/nomade:pulse_clients:ps-pulse-linux-9.1r4.0-b143-centos-rhel-64-bit-installer.rpm
2. https://ccnet.ntu.edu.tw/vpn/for-ubuntu.html → http://ccnet.ntu.edu.tw/vpn/Download/ps-pulse-linux-9.1r4.0-b143-centos-rhel-64-bit-installer.rpm

@Baltazar72 @zarere You need to rebuild webkitgtk after ICU update.

Is pulseUi supposed to be working if I install binaries from : https://cdn.repo.archlinuxcn.org/ ? I cannot get webkitgtk to build from aur.

When I use the prebuilt webkitgtk binaries i get :

$ pulseUi

/usr/local/pulse/pulseUi: symbol lookup error: /usr/lib/libjavascriptcoregtk-3.0.so.0: undefined symbol: ucol_getLocaleByType_64

Hoping anyone can "set me straigh" :)

ThankYou Torstein

I got this from today

➜ ~ pikaur -Ss pulse-secure Searching... [###] aur/pulse-secure 9.1r2.0_b69-1 [installed] (17, 0.58) Pulse Connect Secure (PCS) Client

➜ ~ pulseUi
/usr/local/pulse/pulseUi: error while loading shared libraries: libicui18n.so.64: cannot open shared object file: No such file or directory

➜ ~ sudo find /usr/ -iname "libicui18n.*"
/usr/lib/libicui18n.so.65 /usr/lib/libicui18n.so /usr/lib/libicui18n.so.65.1 /usr/lib32/libicui18n.so.65 /usr/lib32/libicui18n.so /usr/lib32/libicui18n.so.65.1

BTW the latest version is already

https://www.rz.uni-osnabrueck.de/fileadmin/user_upload/VPN/Software/ps-pulse-linux-9.1r3.0-b85-centos-rhel-64-bit-installer.rpm

@dpdani read older comments - this is where the newer version is hosted right now

Is it normal that the download URL changed from <http://ccnet.ntu.edu.tw/vpn/Download/ps-pulse-linux-9.1r1.0-b21-centos-rhel-64-bit-installer.rpm> to <https://www.rz.uni-osnabrueck.de/fileadmin/user_upload/VPN/Software/ps-pulse-linux-9.1r2.0-b69-centos-rhel-64-bit-installer.rpm>?