The solution came in the form of Maurice Massar's vpnc - a relatively little-known and fairly unassuming application which does exactly as it says on the tin. Ubuntu users are one step ahead of the source-based distros just because a vpnc package does exist for dapper. First let's install that on the client system. Do this with the following command:
sudo apt-get install vpnc
If you are not running ubuntu, you will probably have to compile the program yourself. I would image this to be quite simple. The sources are downloadable from this page: http://www.unix-ag.uni-kl.de/~massar/vpnc/
Now this is where things get a bit tricky - you have the application installed, but it won't work until you have a working config. This contains a bunch of IPSec settings required to talk to your VPN endpoint. When I first looked at these, I really didn't know where to start, but I pretty soon determined that the most important values would be these:
IPSec gateway
IPSec ID
IPSec secret
Xauth username
Xauth password
So from whence should we collect this data? I knew that if I was to ask the IT department at work, they would probably tell me that the software isn't supported and to use the cisco client under windows. That doesn't suit my needs, but it does offer a clue. You see, for every connection profile, the Cisco VPN client keeps a profile description file called a .pcf. All I need to do is locate the .pcf file on my windows partition and copy it over.
mount /dev/hda1 /windows
cp /windows/Program Files/Yahoo! Inc/VPN Client/profiles/London.pcf /home/chris/Desktop/.
Now we can extract the vpn gateway hostname, the Group ID and the group 'secret' from the locally copied .pcf. The group secret is a very long string of characters - it's actually a hexadecimal representation of the key, (which itself is formed from a mixture of SHA-1 hashing and triple-DES in CBC mode - a web search will yield all the gory details if that interests you). This throws a slight hurdle in our path, because it is the original plain text version which we need to offer our vpnc config. Thankfully there are tools around to help us with this. First you will need to install the libgcrypt-dev package:
sudo apt-get install libgcrypt-dev
You will then need to compile the cisco-decrypt.c utility which is downloadable from here: http://www.unix-ag.uni-kl.de/~massar/soft/cisco-decrypt.c . Note that when you come to compile the program you will need to use the following compile options:
gcc -Wall -o cisco-decrypt cisco-decrypt.c $(libgcrypt-config --libs --cflags)
This will result in a working binary in ./cisco-decrypt.
Okay, we're nearly there.. all we need to do now is decrypt that cipher string from the .pcf file and then we can paste that into our vpnc.conf. The first thing cisco-decrypt does is convert the string from hexadecimal to binary. Here's how I did that:
root@snackerjack-lx:~/Desktop# grep enc_GroupPwd London.pcf | awk -F= '{print $2 }' | xargs ./cisco-decrypt
atat@atet8s8cu*7777uv8paiaiecrac$
root@snackerjack-lx:~/Desktop#
Of course I have modified it for obvious reasons, but you get the idea. And now to the final stage - creating the config file:
vim /etc/vpnc/vpnc.conf
Just enter the follwing lines (of course using your own settings), write out the file and exit:
IPSec gateway <your gateway address from the pcf>
IPSec ID General
IPSec secret atat@atet8s8cu*7777uv8paiaiecrac$
Xauth username clacy
Xauth password nottellingyou
It's worth mentioning here that if you omit the username and/or password, the vpnc program will prompt you for them at run time. I highly recommend you do this. It will save you from having to enter them in plain text into a config file. Additionally, if you use RSA-SecureID fobs for your passwords it will make using the application far easier. Nobody wants to hack a config every time they run a program!
Now all you need to do is fire up the connection like this:
sudo vpnc /etc/vpnc/vpnc.conf
If this is useful to you and you would like some of this packaged up in some way, please let me know. I think it's pretty simple as it is, but if there is any interest out there and I can make this simpler for the next person, then I will :)
christo
