Arch Linux User Repository

If you want to use old pulse-secure client 9.1r9, please download the following package.

https://drive.google.com/file/d/1_8tRA-T9vV08n_TpHqdcG5IvalxBuZ7_/view?usp=sharing

The rewritten pulse-secure client requires a service called 'pulsesecure'. Please enable and start the service before running the client.

@garylinux666 what is your output for ldd /usr/local/pulse/pulseUi | grep icu? Mine wants libicui18n.so.64, which matches the file in /usr/lib/

Does anyone know why if I run PulseUI do I receive this library error?. I already rebuilt webkitgtk and it still doesn't work.

pulseUi

/usr/local/pulse/pulseUi: error while loading shared libraries: libicui18n.so.63: cannot open shared object file: No such file or directory

find /usr/ -iname "libicui18n.*"

/usr/lib/libicui18n.so.64 /usr/lib/libicui18n.so.64.2 /usr/lib/libicui18n.so /usr/lib32/libicui18n.so.64 /usr/lib32/libicui18n.so.64.2 /usr/lib32/libicui18n.so

@danilopiazza Thanks for reporting! I'll update to 9.1r2 in this weekend. :)

The latest version (July 2019) is 9.1r2.0-b69: https://www.rz.uni-osnabrueck.de/dienste/vpn/index.html#Anchor3db > https://www.rz.uni-osnabrueck.de/fileadmin/user_upload/VPN/Software/ps-pulse-linux-9.1r2.0-b69-centos-rhel-64-bit-installer.rpm

@klutchell The latest binary version is not 9.0 but 9.1 (https://ccnet.ntu.edu.tw/vpn/for-ubuntu.html). I'll update this package to 9.1r1.0-b21 in this weekend.

Here are some links to the latest binary releases:

http://trial.pulsesecure.net/clients/ps-pulse-linux-9.0r4.0-b943-ubuntu-debian-64-bit-installer.deb

http://trial.pulsesecure.net/clients/ps-pulse-linux-9.0r4.0-b943-centos-rhel-64-bit-installer.rpm

I'd update it myself but I haven't contributed an arch package yet. I'll see if I can sort out the process this weekend if someone else hasn't repackaged it by then.

@hkirsman You can use pulse-secure without webkitgtk via pulsesvc command. As described as in dependencies section, webkitgtk is required only for pulseUi frontend, not entire pulse-secure client.

To get pulseUi working I also had to install webkitgtk (something that has been mentioned below also). Wondering why it's not dependency of this package? May be there's even some better one because webkitgtk took quite a while to compile.

Dropped - I switched to openconnect to connect to Pulse Secure servers.

You need to rebuild webkitgtk if you got ICU related errors.

PulseUi doesn't work because it depends on the icu package in version 62, but icu has been updated to 63.

The error I got is

pulseUi: error while loading shared libraries: libicui18n.so.62: cannot open shared object file: No such file or directory

Is there any way out except for downgrading icu?

Hello. I'm getting this error after successful login with pulseUi:

(pulseUi:9418): Gtk-ERROR **: 14:37:32.588: GTK+ 2.x symbols detected. Using GTK+ 2.x and GTK+ 3 in the same process is not supported
`trap' para punto de parada/seguimiento

I don't understand how could there be symbols of GTK 2 and GTK 3 in the same executable. Any clue of what to investigate or how to solve this?

Thanks

Currently using the "OATH Passcode" realm on the pulsesvc command line. Anyone has successfully attempted the "Class-A DigitalBadge" realm with pulsesvc, which requires a certificate? Upon executing "pulsescv --help" I see no way to specify a cert, and if using the the "Class-A DigitalBadge" realm doesn't prompt for a cert either. Thanks !

@kikislater: thanks for the patch! I've applied a simplified version and PulseClient should work now.

9.0r2.0_b1151 is out. Please leave a comment if you found a mirror. This version should be released as soon as possible as it contains security fixes [1].

[1] https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/?l=en_US&atype=sa&fs=Search&pn=1&atype=sa

Ok thank you, pulsesvc works ! Someone patch it with older version : https://github.com/kaymmm/pulseconnectsecure-arch Don't need it at this time since pulsesvc works ...

@kikislater: PulseClient_x86_64.sh is not supported on Arch Linux. Please consider using pulsesvc as an alternative. I'll try to check whether it is possible or not to patch PulseClient_x86_64.sh so that it works on Arch Linux.

PulseClient does not work :

/usr/local/pulse/PulseClient_x86_64.sh -h host -u user

Checking for missing dependency packages for command line client ...

@johnchen902: Thanks!

@mgomez: The message tells nothing. If you have systemd, you may want to use coredumpctl to get full backtrace.

You can download 9.0r1.0 from National Taiwan University: http://ccnet.ntu.edu.tw/vpn/Download/ps-pulse-linux-9.0r1.0-b739-ubuntu-debian-64-bit-installer.deb

See also: http://ccnet.ntu.edu.tw/vpn/for-ubuntu.html

I get execution errors with kernel 4.18.x:

kernel: pulsesvc [568]: segfault at 7ffde4007060 ip 00007fea4de42667 sp 00007ffde4915158 error 4 in libc-2.28.so [7fea4dd05000 + 14b000]

Does anyone know the cause? It continues to work with kernel 4.17.

@patrick.luehne, @DrJPeppe: Both 5.3r4.2 and 9.0r1.0 works fine with ICU 62. Make sure you've rebuilt webkitgtk after upgrading to ICU 62.

@DrJPepper: The latest version of Pulse Secure (9.0R1) requires an outdated version of ICU (version 61 is required, but Arch comes with ICU 62 now). There is an AUR package for icu61, which should do the trick. If you’re using an older version of Pulse Secure, you may need another version of ICU.

However, I’d appreciate if this PKGBUILD could be updated to 9.0R1 with the additional dependency on icu61 to make it work again …

Has anyone gotten this to work recently? Seems to be linked to a lot of outdated libs (even the version from 5-26), and just simlinking the newer version of said libs results in further errors.

I created a branch 'latest-pulse-secure' [1] that uses unofficial RPMs. Use at your own risk.

[1] https://gitlab.com/yan12125/aur/tree/latest-pulse-secure/pulse-secure

@yan12125: Pulse Secure 9.0R1 has been released recently. The only RMP containing 9.0R1 I’ve found so far is http://webdev.web3.technion.ac.il/docs/cis/public/ssl-vpn/ps-pulse-centos-rhel.rpm. Not sure whether there is a more official source though.

@thecrow: Thanks for the info. I switched to the mirror on my school's server temporarily to get the latest version. If you have a link from pulsesecure.net or other ideas, please tell me.

The pulse secure PULSE5.3R4.1 and lower is vulnerability:

The Pulse Linux GUI component does not perform strict SSL certificate validation which allows the attacker to manipulate the Pulse connection set. (https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43620)

This issue is resolved in the following Pulse Secure Desktop Linux client releases PULSE5.3R4.2 Software (Build 639)

Info for the latest version: https://www.pulsesecure.net/techpubs/pulse-client/pulse-secure-client-desktop

Latest unofficial download links: https://wiki.univ-nantes.fr/nomade:document2 I just tried ps-pulse-linux-5.3r4.2-b639-centos-rhel-64-bit-installer.rpm and it's still linked to legacy webkitgtk rather than modern webkit2gtk.

@yan12125 re: link issues. It just seemed like there were less runtime link dependencies on the older webkitgtk2 vs the newer one, so I choose that one to get something running more easily.

@pd5rm: Thanks for the patch, but it's not necessary now. I've adopted webkitgtk and applied the enchant fix. Furthermore, the archlinuxcn team has published prebuilt binaries for webkitgtk. Check my comments at the webkitgtk package.

seems to have less link issues

Mind sharing what's the actual linking issue? It might be a webkitgtk issue and can be solved there.

Sorry, didn't have notifications enabled so didn't see earlier responses. I cleaned up my patch a little (makes the lib stuff more generic), and merge from latest master.

It's basically working around the issue of building webkitgtk from source which is very time consuming by pulling down the related binary bits (icu, enchant, webkitgtk) from archives. It's not a great way to package, but until Pulse starts pushing new builds there's not much else we can do here but workaround it.

@yan12125 I don't know if webkitgtk2 is any better, but seems to have less link issues when I tried. I think webkitgtk is newer in that it has GTK3 support. The versioning is very confusing.

Happy holidays and new year!

I put it in a GIST, since it got garbled a bit. https://gist.github.com/pd5rm/fad6d3800bdf1848d66040e47547db14

@ImNtReal, @mlotysz: icu and enchant issues belong to the webkitgtk package instead of this one. Please leave comments at https://aur.archlinux.org/packages/webkitgtk/ if you want them fixed.

@pd5rm: Is webkitgtk2 better than webkitgtk? Both are AUR packages and need lots of time for building.

@csmiet: Thanks for the suggestion. I'm currently rebuilding (patched) webkitgtk for testing. Please checkout https://github.com/yan12125/aur/issues/10 for progress.

I needed to install enchant1.6 and icu59 to get pulseUi to run.

Hi yan12125,

I packed pd5rm patch (see pd5rm commented on 2017-12-02 00:54) and added missing libenchant.1.so to it. Pulse secure is running now, however I don't have possibility to test it thoroughly. Patch: https://gist.github.com/mlotysz/a6e905477948e6bb05f95ba25d46a9ad.

Have fun!

Hi, I´m trying to run the pulseUi on a fresh ArchLinux installation. It fails with /usr/local/pulse/pulseUi: error while loading shared libraries: libwebkitgtk-3.0.so.0: cannot open shared object file: No such file or directory I don´t know where i can find this lib. Can anybody help me, please?. Thanks a lot.

I had some issues with this, so I wrote up a patch that makes it work for me. 1) Used Debian version instead of CentOS. Webkitgtk2 uses GTK 1 for Debian vs using GTK 3 (not available as a dep) for CentOS. 2) Made webkitgtk a real dependency since it's needed now because of previous step. 3) Added icu59 libs (pulled from archive, not ideal but it works) 4) Fixup related LD_LIBRARY_PATHs because of icu59 dep. 5) Fixup desktop file. The upstream pulse packages (deb/rpm) are just wrappers around shell scripts that do the installing. They also will rm -rf /usr/local if used. ;-( --- PKGBUILD | 27 +++++++++++++++++++++------ pulseUi.sh | 2 +- 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/PKGBUILD b/PKGBUILD index fdd2160..8826e96 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -2,26 +2,32 @@ pkgname=pulse-secure pkgver=5.3r3.0 -pkgrel=3 +pkgrel=4 pkgdesc='Pulse Connect Secure (PCS) Client' arch=(x86_64) license=(custom) url='https://www.pulsesecure.net/' depends=(gcc-libs libgnome-keyring) source=("https://trial.pulsesecure.net/clients/ps-pulse-linux-$pkgver-b1021-centos-rhel-64-bit-installer.rpm" + "https://archive.archlinux.org/packages/i/icu/icu-59.1-2-x86_64.pkg.tar.xz" pulseUi.sh EULA.txt) md5sums=('4cbe64953952d9ffdeaa4ffe2fc92a20' - 'd81155461e2666c2b9d669c1b76f85fe' + '049ca9bf777280536b3b75861e1512eb' + '44bb6dd99f201b84ed5e30aae17bc8f9' '261848a28201e5386ec4bf587473a48b') -optdepends=('webkitgtk: for pulseUi frontend' - 'psmisc: for pulsesvc -K') +depends=('webkitgtk2') +optdepends=('psmisc: for pulsesvc -K') conflicts=(pulse-connect-secure) prepare() { mkdir -p pulse && pushd pulse tar -zxvf ../usr/local/pulse/pulse.tgz popd + + # Extact libicu59 dependency no longer available in Arch current + mkdir -p libicu59 + cp usr/lib/libicu* libicu59 } package() { @@ -33,8 +39,15 @@ package() { # Skip PulseClient.sh - seems it's not useful here install -Dm755 pulse/{pulsediag,pulseutil} "${pkgdir}"/usr/local/pulse/ install -Dm4755 pulse/pulsesvc "${pkgdir}"/usr/local/pulse/ - install -Dm755 pulse/pulseUi_centos_7_x86_64 "${pkgdir}"/usr/local/pulse/pulseUi - install -Dm755 pulse/libpulseui.so_centos_7_x86_64 "${pkgdir}"/usr/local/pulse/libpulseui.so + # The Ubuntu version has depedency on WebGTK 2 which is easier to deal with than CentOS build. + install -Dm755 pulse/pulseUi_Ubuntu_16_x86_64 "${pkgdir}"/usr/local/pulse/pulseUi + install -Dm755 pulse/libpulseui.so_Ubuntu_16_x86_64 "${pkgdir}"/usr/local/pulse/libpulseui.so + + # Fix desktop file libicu + sed -i 's|$LD_LIBRARY_PATH|/usr/local/pulse/libicu59:$LD_LIBRARY_PATH|' pulse/pulseUi.desktop + # Fix desktop file version (desktop-file-validate complains about it) + sed -i 's|^version|Version|' pulse/pulseUi.desktop + install -Dm644 pulse/pulseUi.desktop "${pkgdir}"/usr/share/applications/ # Wrappers & symlinks @@ -43,5 +56,7 @@ package() { cp -dr --no-preserve=ownership pulse/html "${pkgdir}"/usr/local/pulse/html + cp -dr --no-preserve=ownership libicu59 "${pkgdir}"/usr/local/pulse + install -Dm644 EULA.txt "${pkgdir}"/usr/share/licenses/$pkgname/ } diff --git a/pulseUi.sh b/pulseUi.sh index ed7eced..d9515ed 100644 --- a/pulseUi.sh +++ b/pulseUi.sh @@ -1,4 +1,4 @@ #!/bin/sh -export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/pulse +export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/pulse/libicu59:/usr/local/pulse exec /usr/local/pulse/pulseUi -- 2.15.1

@patrick.luehne This is not really the fault of this package. You need to also rebuilt webkitgtk, since that is actually the package with the icu dependency.

@yan12125: This package’s pulseUi command doesn’t work currently, because icu got updated earlier this month to version 60, but the pulseUi command requires the so files from version 59. This results in loading errors when attempting to start pulseUi. Fortunately, there is an icu59 package now in order to install older so files. For this reason, I’d suggest exchanging the icu dependency with icu59 until Pulse Secure sees a new release :).

Hi, Thanks for packaging! Could you include the installation of PulseClient.sh if you ever update the PKGBUILD? My institute uses it for cli-based logon to the vpn.

Hi, I installed lib32-webkitgtk, but when I run pulseUi from terminal, I get the same error: "error while loading shared libraries: libwebkitgtk-3.0.so.0: cannot open shared object file: No such file or directory. I read through all the comments and searched online, but could not find what I am missing. Could you please help me?

I gave up and moved files back to /usr/local/pulse. Things are beyond my control. @jsimonetti: thanks for testing results!

It appears that actually it is the running of pulsesvc which is the problem. I removed the symplink and ran pulseUi from terminal: % LD_LIBRARY_PATH=/opt/pulsesecure:$LD_LIBRARY_PATH /opt/pulsesecure/pulseUi (pulseUi:1623): libsoup-CRITICAL **: soup_cookie_jar_get_cookies: assertion 'SOUP_IS_COOKIE_JAR (jar)' failed Cert Subject Name: <snip> Cert Issuer Name: <snip> Cert Expiry Date: <snip> sh: /usr/local/pulse/pulsesvc: No such file or directory

@yan12125: how about this error; (pulseUi:1614): libsoup-CRITICAL **: soup_cookie_jar_get_cookies: assertion 'SOUP_IS_COOKIE_JAR (jar)' failed [EDIT]: never mind... this seems to be a proxy issue of some kind. I'm going to following up with Pulse team. https://forums.pulsesecure.net/topic/pulse-desktop-clients/1003626-ubuntu-pulseui-4460-libsoup-critical-soup-cookie-jar-get-cookies-assertion-soup-is-cookie-jar-jar-failed

@jsimonetti: Could you run `sudo strace -fp <pid of pulsesvc> |& grep /usr/local/pulse` to see which path is it accessing? I may reconsider putting things back to /usr/local/pulse. See also https://lists.archlinux.org/pipermail/aur-general/2017-August/033451.html for previous discussions. @rudepeople: that message is less than informative. Only Pulse Secure staff can fix it - nobody else has pulseUi.cpp.

For some reason, this package only works if I also add a symlink from /usr/local/pulse -> /opt/pulsesecure/ Our company uses a hostchecker (which doesn't do anything for linux platform, but still runs). Without this symlink, the log is spammed with errors such as: pulseui.error Failed to read return cookie from host checker process (pulseUi.cpp:948) pulseui.error initiatePreAuthHostCheck() failed, isPostAuth: 1 (pulseUi.cpp:1055) So somewhere in the pulseUi code there appears to be a hardcoded path to /usr/local/pulse ;(

@yan12125: Yep, I'm already using networkmanager, and before you responded, I went ahead and installed gnome... same issue. On your suggestion, I ran: $tail -f ~/.pulse_secure/pulse/pulsesvc.log every time I click "submit" (within pulseUi) I get something like this: 20171023224951.187212 pulsesvc[p2864.t2864] pulseui.error (pulseUi.cpp:265) I'm seeing it every time I hit "submit". I tried googleing it, but I'm not seeing that specific error anywhere else (the search was only 2 pages deep so... gotta check 'em all!), and I cant seem to get to kb.pulsesecure.net to search for the error specifically. I get a DNS error when I try. Any help would be greatly appreciated! Before anyone suggests network issues, my ISP is a "last mile" provider. their network is secure as FSCK, but it's also completely transparent, lacking all the traffic shaping BS of large providers. Also, this all works fine in... *sigh* ...windows.

@rudepeople: This is DE-independent. I use this fine with LXQt. I indeed got some issue with connman. Its routing table strategy conflicts with pulse-secure, so I switched to NetworkManager. BTW, I found that after checking ~/.pulse_secure/pulse/pulsesvc.log.

do I have to have gnome installed for this to work? when I open pulseUi and add my company connection, I get the user-name field, but clicking submit yields no response... I'm attempting to run this in KDE.