Arch Linux User Repository

If you want to use old pulse-secure client 9.1r9, please download the following package.

https://drive.google.com/file/d/1_8tRA-T9vV08n_TpHqdcG5IvalxBuZ7_/view?usp=sharing

The rewritten pulse-secure client requires a service called 'pulsesecure'. Please enable and start the service before running the client.

For saved connections in pulseUI to not disappear when the pulsesecure service restarts, mkdir -p /var/lib/pulsesecure/pulse seems to work.

I have a problem on the latest (9.1r15.0_b15819-2) and older versions : I start the pulsesecure service, and try to run the /opt/pulsesecure/bin/pulseUI command, and it's stuck at

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA

and it hangs there. If I try to press Ctrl + C to cancel it, the UI launches, but it looks like it doesn't detect the running service (lots of DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files error messages, and I can't connect.

What's weird is that if I stop the service and try to run the pulseUI program, it goes straight to the "missing service" error :

dsOpenSSL Start - dsENGINE_register_ECDSA
dsOpenSSL End - dsENGINE_register_ECDSA
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 
DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files 

journalctl -u pulsesecure.service -f doesn't show anything wrong, and the pulselauncher command behaves the same...

Any idea ?

It doesn't save my connections. Every time I restart it I have to create my connections again. Is there anything that I am missing?

Thanks, it works now.

@mso I've updated the package to ignore SSL certificate validation. Sorry for the inconvenience.

Note that skipping SSL validation is insecure. If you don't want skip the validation, remove the second line of PKGBUILD file.

DLAGENTS=("https::/usr/bin/curl -k -o %o %u")

Under Manjaro cannot update to 9.1r15 since curl complains about invalid SSL ceritificate when donwloading the following file: https://webdev.web3.technion.ac.il/docs/cis/public/ssl-vpn/v.9.1R15.0/ps-pulse-linux-9.1r15.0-b15819-64bit-installer.rpm

Error output: curl: (60) SSL certificate problem: unable to get local issuer certificate

Does this work for you?

Note in case it may help someone: I managed to skip the error by manually downloading the rpm file to my local file system and editing the build file pointing the download destination to my local file: source_x86_64=("file://<MY_LOCAL_PATH>") (Replace <MY_LOCAL_PATH> with the path you downloaded the file to)

There is also another problem since last few updates. In case the connection gets stuck or is cancelled, the /etc/resolv.conf is not reset to previous contents.

In my specific case this makes pulse-secure unable to re-connect because the VPN-provided DNS servers cannot resolve the connection endpoint. This could be fixed on my VPN, but the resolv.conf should be reset to previous contents anyway.

The new version 9.1r14.0-b13525 does not work for me. When trying to connect it says, that the embedded chromium is not installed. Then it downloads and extracts the browser, but cannot use it afterwards. No error is logged.

Noticed a new release today but there is a later release actually (which was released in January):

https://webdev.web3.technion.ac.il/docs/cis/public/ssl-vpn/v.9.1R14.0/ps-pulse-linux-9.1r14.0-b13525-64bit-installer.rpm

I have tried version r12, r13, and r14 and all fail for me on an up-to-date system. I can see these errors on the logs:

failed with error /opt/pulsesecure//lib/iveConnectionMethod/samAccessMethod.so: cannot open shared object file
'ConnectionManager' failed to start connection method integrationAccessMethod, error 1000
'AccessServiceProxy' createInstance of plugin integrationAccessMethod failed with error 0xe00103e8

Any ideas?

New URL to use for the binary:

https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/old/ps-pulse-linux-9.1r12.0-b10247-64-bit-installer.rpm

I have installed, enabled service and started. Still not working, freezing if i start from commandline and no written nothing on logs.

  ~/Downloads ❯ pulseUI dsOpenSSL Start - dsENGINE_register_ECDSA dsOpenSSL End - dsENGINE_register_ECDSA

If i interrupt with Ctrl + c, then start but dont save connections and no connect.

^C (pulseUI:19056): Gtk-WARNING **: 12:14:33.740: Theme parsing error: gtk.css:68:35: The style property GtkButton:child-displacement-x is deprecated and shouldn't be used anymore. It will be removed in a future version

DBUS api call failed with code: 2 - message:GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name net.psecure.pulse was not provided by any .service files

Updated using https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r13.1-b12971-64bit-installer.rpm

Temporary workaround until this get updated: 1. Download built zst from here https://mega.nz/file/XwwQ2Y6C#mKqm9v9RUWt6EjoNGQq-VGTVG7FcnxkeJT9s3oFbIN8 1b. Or you can build your own by modifying the code with the file URL and its md5sum hash. 2. Offline install using "sudo pacman -U *.zst"

New URL to use for the binary:

https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r13.1-b12971-64bit-installer.rpm

@DevopTux Your PKGBUILD works, but it still misses to pull extra/gtkmm3 and extra/webkit2gtk needed by the UI. Moreover, you missed the final "closed curl brace" (aka '}') from the script.

Here a PKGBUILD that I modified and works for now:

# Maintainer: Chiwan Park <chiwanpark@hotmail.com>

pkgname=pulse-secure
pkgver=9.1r12.0_b10247
pkgrel=2
pkgdesc='Pulse Connect Secure (PCS) Client'
arch=(x86_64)
license=(custom)
url='https://www.pulsesecure.net/'
depends=(gcc-libs libgnome-keyring openssl curl dbus libbsd)
install=${pkgname}.install
source=(EULA.txt)
source_x86_64=("https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r13.1-b12971-64bit-installer.rpm")
md5sums=("261848a28201e5386ec4bf587473a48b")
md5sums_x86_64=("ecd8d38761284a31726b62c4fd31a5d2")
optdepends=('psmisc: for pulsesvc -K', 'gtkmm3: for pulseUi', 'webkit2gtk: for pulseUi')
conflicts=(pulse-connect-secure)

package() {
   install -Dm644 EULA.txt "$pkgdir"/usr/share/licenses/$pkgname/EULA.txt

   for d in $(find opt/pulsesecure -type d); do
       install -dm755 "$d" "$pkgdir"/"$d";
   done
   for f in $(find opt/pulsesecure/bin -type f); do
       install -Dm755 "$f" "$pkgdir"/"$f";
   done
   for f in $(find opt/pulsesecure/lib -type f); do
       install -Dm755 "$f" "$pkgdir"/"$f";
   done
   for f in $(find opt/pulsesecure/resource -type f); do
       install -Dm644 "$f" "$pkgdir"/"$f";
   done
   install -Dm644 usr/share/man/man1/pulse.1.gz "$pkgdir"/usr/share/man/man1/pulse.1.gz

   # we move service unit file to /usr/lib/systemd/system due to pacman limitation
   install -Dm644 lib/systemd/system/pulsesecure.service "$pkgdir"/usr/lib/systemd/system/pulsesecure.service

   mkdir -p "$pkgdir"/usr/share/applications/ "$pkgdir"/usr/share/dbus-1/system.d/ "$pkgdir"/opt/pulsesecure/lib/JUNS/interfaces
   ln -s /opt/pulsesecure/resource/pulse.desktop "$pkgdir"/usr/share/applications/pulse.desktop
   ln -s /opt/pulsesecure/lib/JUNS/net.psecure.pulse.conf "$pkgdir"/usr/share/dbus-1/system.d/net.psecure.pulse.conf
   for f in $(find opt/pulsesecure/lib/JUNS/interfaces -type l); do
       ln -s $(readlink $f) "$pkgdir"/"$f" ;
   done

}

Seems like 9.1r12 is not online anymore.

==> ERROR: Failure while downloading https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r12.0-b10247-64-bit-installer.rpm

Correct URL for r13 is https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r13.0-b11723-64bit-installer.rpm

9.1R13 works even for 2FA. I had problems with repeated prompts of 2FA and no success with VPN connection with earlier versions. But did build 9.1R13 version, as suggested by bodograumann, and it worked.

Here is the version 9.1r13 provided by Uni Lübeck:

-pkgver=9.1r12.0_b10247
+pkgver=9.1r13.0_b11723

-source_x86_64=("https://gml.noaa.gov/aftp/user/cornwall/Pulse%20Client/ps-pulse-linux-9.1r12.0-b10247-64-bit-installer.rpm")
+source_x86_64=("https://www.itsc.uni-luebeck.de/fileadmin/files/software/datennetz/pulse/pulsesecure-9.1-R13.x86_64.rpm")

-md5sums_x86_64=('74f180159f742e138e166b3b8d7eb4d5')
+md5sums_x86_64=('3fe9029ef73592734c8d1fa2262440f9')

Please incorporate these changes.

Looks like there is already r13: https://help.ivanti.com/ps/help/en_US/PCS/9.1R13/rn/fixed_issues.htm

Does anyone know a download URL? :D

This is broken for me right now. It used to work, though.

need to add a tmpfiles.d entry to create /var/lib/pulsesecure/pulse so that the connection store works correctly

@nunopinheiro I found out a number of minor issue plus a major one.

The application is trying to access the CA store at "/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt". My system has it in "/etc/ca-certificates/extracted/ca-bundle.trust.crt". I had to create /etc/pki and then add a couple of symlinks in there to make it compatible with what Pulse is expecting.

Second problem comes from the cef-browser cache and cookies. I had to manually clean it up under ~/.pulsesecure/cef. I removed "Cache", "Code Cache" directories as well as all ".org.chromium.Chromium*" and "Cookies" files.

@thecrow also spotteed another issue.

I just found this:

https://wiki.archlinux.org/title/Pulse_Connect_Secure#AUR

:-D

@Syzygianinfern0 You must create the /var/lib/pulsesecure/pulse/ directory which is where the connections are saved.

@0BAD-C0DE seams like my bug...is it kde/plasm related have you tried on a different desktop?

It seems not to work for me under KDE/Plasma. Despite I have installed the package and have started the service, the app doesn't connect nor it gives any feedback. Any hint?

pulseUI does not show up. I can make it appear by killing the pulsesecure service but it gets "blocked" (cant interact with mouse) again after pulsesecure service restarts

on the other end if I try version 9.1r9 pulseUi gives me a segfault coredump ;(

@hugojosefson @schui The binary from official link also does not work with 2FA.

@hugojosefson The link you gave does not contain download links to 9.1R12.

I agree with @schui; Current download link doesn't work.

@chiwanpark Please update PKGBUILD to use the official download links that I described in my previous comment https://aur.archlinux.org/packages/pulse-secure/?O=10&PP=10#comment-819158

Here is the oneliner again, to find the official download url:

curl -s https://www.ivanti.com/ty/security/trial/pulse-client | awk -F '"' '/application.ivanti.com/{print $4}'

Doesn't work anymore, downloadlink isn't reachable.

For some reason connection profiles that are added get removed automatically after a reboot. Is this expected?

Although I cannot provide a solution for the MFA issue here, there is some hope nonetheless. In some unoffical R13 build from PulseSecure we got our MFA issue solved. I've asked whether this will be part of the next release but got no definitive answer.

@Syzygianinfern0 Check the manual. Note that you cannot connect to VPN through CLI if the organization requires MFA or other authentication methods.

@chiwanpark How do you connect through CLI?

I have the same issue as everyone else it looks like. I have been trying to get my MFA (web) login to work since the update was made in Feb. I have followed everything on this thread and nothing seems to work. I am running the 5.4 kernel on Manjaro i3wm. It is starting to look like the only option would be to rollback to the 9.1r9 release. Seeing "Connection Error: Authentication rejected by server. (Error:1319)". Any suggestions would be appreciated.

@OBAD-C0DE thanks for suggestion. however, the packages you suggested are not required packages. They are optional dependencies to use Pulse Secure UI. If a user wants to connect VPN through CLI client, the packages are not required.

Currently it is missing a few dependencies: - gtkmm3 - libwebkit2gtk - webkit2gtk

Once installed it will start and then dump the core when hovering on the "modify" item icon or selecting the File->Connections menu.

I have the same problem as @gorilladeezy, I cannot get MFA (web) login working. It stuck in a login loop in the embedded webkit browser :-(. Apparently the update did not help, i would appreciate any suggestions how to fix.

@chiwanpark thank you very much for the help

@gorilladeezy, @hughjosefson Sorry for late response. I'll update this package to latest in today.

Is there any way this can be updated to 9.1r12? I believe that version fixes the pulseUI MFA issue. That's the current issue I am having where after approving the MFA sign-in, it re-directs right back to the sign-in window

Please update download URL (source_x86_64) to the official download URL from the Pulse Secure website.

For the current version, that would be:

source_x86_64=("https://application.ivanti.com/SSG/Clients/ps-pulse-linux-9.1r11.4-b8575-64-bit-installer.rpm")

(md5sums_x86_64 stays the same.)

Here is how you can see that the above is actually the official URL:

1. https://www.pulsesecure.net/
2. Click FREE TRIAL -> https://www.pulsesecure.net/trynow/
3. Click → Looking for Pulse Client to download? -> https://www.ivanti.com/lp/security/trials/client-download -> redirects to https://www.ivanti.com/lp/security/trials/pulse-client (Apparently, Ivanti bought Pulse Secure in 2020)
4. Fill in the form with something and Submit -> redirects to https://www.ivanti.com/ty/security/trial/pulse-client
5. Copy URL from relevant download button.

Shortcut for getting download URL:s later, without web browser or forms:

curl -s https://www.ivanti.com/ty/security/trial/pulse-client | awk -F '"' '/application.ivanti.com/{print $4}'

Thanks!

@Syzygianinfern0

This will fix SSL Cert issue connecting to VPN server Otherwise, you might see following message:

You are about to authenticate to an untrusted server.
There are problems with the site's security certificate
Certificate Error
Should Pulse continue to connect?
[Ok] [Cancel]

@tchung What does this fix?

In my case (Manjaro 21 Gnome), I had to:

$ pkill pulseUI
$ sudo mkdir -p /var/lib/pulsesecure/pulse
$ sudo trust extract-compat
$ sudo mkdir -p /etc/pki/ca-trust/extracted/openssl
$ sudo ln -s /etc/ca-certificates/extracted/ca-bundle.trust.crt /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
$ systemctl restart pulsesecure.service

Am I correct in assuming that updating this package means "google search some random site that allows public downloads?" If so, then http://webdev.web3.technion.ac.il/docs/cis/public/ssl-vpn/ps-pulse-centos-rhel.rpm appears to have the latest version. (9.1.11.8575)

If you have a DNS service enabled (such as systemd-resolvd) the VPN won't work: it'll claim to be connected, but won't route traffic properly. You will need to use NetworkManager's builtin DNS resolver instead. If you're using a DNS service currently, to switch back you'll need to not only disable the service but also remove /etc/resolv.conf. NetworkManager will see the symlink in /etc/resolv.conf and still think you're using a separate DNS service otherwise.

Hi @Syzygianinfern0,

I left a comment here: https://community.pulsesecure.net/t5/Pulse-Connect-Secure/Pulse-r9-1-embedded-browser-install-failure-Mint-Linux/m-p/45451/highlight/true#M28892

Based on strace run, seems like there's a bug in pulse-secure 9.1r11.0.

The VPN works fine but after a few minutes of connection, it disconnects and the VPN profile that was added is deleted as well. Are there any logs that I can share to debug this issue? Or is it a known issue?