To add to @ThoriumBR answer above (I'm not allowed to leave comments yet :().
I use a pair of docker containers running the VPN software within each and use SSh tunnelling to access servers on "the other side" of the VPN connection (usually via browser with socks proxy settings). This works quite well, but in your case would be potentially wrong and could allow data crossing. I just thought I'd add this tidbit in case someone else is looking for something like this but not exactly the OP's original problem.
If you don't want to hardcode the credentials, a simple FIFO/Pipe works really well for not storing the user ID and password and still allows for an interactive prompt for the bits of required info.
Example from the startup script of the container:
# Copy the ID and password from the pipe that has the startup script on the other end
# and has prompted for the two values. These values will be written to a file that is
# used during openconnect's startup and authentication and then deleted 30 seconds afterwards.
# The OVPN file needs to be updated so that "auth-user-pass" (which prompts to the command
# line)is updated to be "auth-user-pass /openvpn.pass"
# Use 'mkfifo PASS' in the current directory to create the passthrough and this folder must be shared with the container.
cat /keys/PASS > /openvpn.pass
cat /keys/PASS >> /openvpn.pass
chmod 600 /openvpn.pass
$( sleep 30 ; rm /openvpn.pass ) &
The startup script for the container will have the following ("openconnect" is the container name):
docker start openconnect
read -r -p "UserID:" TFR
echo "$TFR" > PASS
read -r -s -p "Password: " TFR
echo -e "$TFR\e" > PASS
Obviously, data collected from the VPNs can be stored within or external to the docker container, depending on your needs for archival and backup purposes.
If you really want to get creative you could have encrypted folders being the shared data location without needing to encrypt the entire VM/Container.
There's no reason why this shouldn't work on any OS as well.
Edit: As requested, here's the complete script file for the full setup (It may not be perfect, but I only spent an hour on it, so meh! :) ):
#!/bin/bash
# This script will create a dockerfile to then create a docker image and then start it.
# The image will contain this file to be run on startup, making this an all-in-one file
# for a docker image proxy to the vpn. Assumes to be run from your .ssh directory for
# setup.
#
# Options:
# "dockerfile" - Create the docker file needed to create the proxy container image
# "container" - Create the container running the proxy and VPN
# "start" - Start an existing container
if [ $# -gt 0 ] ; then
if [ "$1" == "dockerfile" ] ; then
if [ -f opentrust.docker ] ; then
rm opentrust.docker
fi
shift
fi
if [ ! -f opentrust.docker ] ; then
echo Generating the docker file...
cat > opentrust.docker <<-EOF
FROM openbase
RUN useradd -m -s /bin/bash myuser
RUN mkdir /home/myuser/.ssh
# Copy your SSH key into the image to allow you to SSH in using your normal key
COPY id_ecdsa.pub /home/myuser/.ssh/authorized_keys
RUN chmod 600 /home/myuser/.ssh/authorized_keys
RUN chown -R myuser:myuser /home/myuser/.ssh
COPY startTrust.sh /
RUN chmod +x /startTrust.sh
RUN apt-get install -y openvpn
ENTRYPOINT ["/startTrust.sh"]
EOF
else
echo "opentrust.docker already exists Delete it to regenerate. Using existing file..."
fi
if [ "$1" == "container" ] ; then
docker build -t opentrustimg -f opentrust.docker .
shift
fi
if [ "$1" == "start" ] ; then
docker start opentrust
if [ $? -gt 0 ]; then
echo "opentrust doesn't exist... creating one"
# Container didn't exist, create one and start it. SSH into it via port 24
# Container has access to the .ssh folder of your user to read ID/PWD and write log files etc...
#docker run -d --privileged --name opentrust -p 24:22 --mount type=bind,source="$(pwd)",target=/keys opentrustimg
docker run -d --cap-add=NET_ADMIN --device=/dev/net/tun --name opentrust -p 24:22 --mount type=bind,source="$(pwd)",target=/keys opentrustimg
fi
read -r -p "UserID:" TFR
echo "$TFR" > PASS
read -r -s -p "Password: " TFR
echo -e "$TFR\e" > PASS
echo Waiting for startup...
sleep 8
docker logs --tail 100 opentrust
fi
docker ps
exit
fi
set +x
/usr/sbin/sshd -D &
# Copy the ID and password from the pipe that has the startup script on the other end
# and has prompted for the two values. These values will be written to a file that is
# used during opentrust's startup and authentication and then deleted 30 seconds afterwards.
# The OVPN file needs to be updated so that "auth-user-pass" (which prompts to the command
# line) is updated to be "auth-user-pass /openvpn.pass"
# Use 'mkfifo PASS' in the .ssh directory to create the passthrough.
cat /keys/PASS > /openvpn.pass
cat /keys/PASS >> /openvpn.pass
chmod 600 /openvpn.pass
$( sleep 30 ; rm /openvpn.pass ) &
$( sleep 30 ; echo -e 'nameserver 192.168.120.1\nsearch remote-domain.ca' > /etc/resolv.conf ) &
openvpn --config /keys/myuser@open.vpn.config.ovpn.docker
OOPS. Forgot about how to define "openbase". Here's that script:
#!/bin/bash
# This script will create a dockerfile to then create a docker base image used by the
# startTrust.sh scripts containing OpenSSH server, Dig, Curl and OpenVPN.
#
# Options:
# "dockerfile" - Create the docker file needed to create the "openbase" base container image
if [ $# -gt 0 ] ; then
if [ "$1" == "dockerfile" ] ; then
if [ -f openBase.docker ] ; then
rm openBase.docker
fi
shift
fi
if [ ! -f openBase.docker ] ; then
echo Generating the docker file...
cat > openBase.docker <<-EOF
FROM ubuntu
RUN mkdir /keys
RUN apt-get update
RUN apt-get upgrade -y
RUN apt-get install -y curl openssh-server
RUN apt install -y dnsutils inetutils-ping
RUN mkdir /var/run/sshd
RUN echo 'root:TH3PASSWoRDYOUCREATED!' | chpasswd
RUN sed -i 's/.*PubkeyAuthentication yes/PubkeyAuthentication yes/ ; s/.*AuthorizedKeysFile/AuthorizedKeysFile/ ; s/#GatewayPorts.*/GatewayPorts yes/' /etc/ssh/sshd_config
# SSH login fix. Otherwise user is kicked off after login
RUN sed 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' -i /etc/pam.d/sshd
ENV NOTVISIBLE "in users profile"
RUN echo "export VISIBLE=now" >> /etc/profile
RUN useradd -m -s /bin/bash myuser
# Don't use this, use SSH keys
# RUN echo "myuser:Th3myuserPassw0rd!" | chpasswd
RUN mkdir /home/myuser/.ssh
RUN chmod 700 /home/myuser/.ssh
# Copy your SSH key into the image to allow you to SSH in using your normal key
COPY id_ecdsa.pub /home/myuser/.ssh/authorized_keys
RUN chmod 600 /home/myuser/.ssh/authorized_keys
RUN chown -R myuser:myuser /home/myuser/.ssh
EXPOSE 22
EOF
# Disable IPv6
#cat > /etc/sysctl.d/70-ipv6.conf <-EOF
#net.ipv6.conf.all.disable_ipv6 = 1
#net.ipv6.conf.default.disable_ipv6 = 1
#EOF
#nmcli connection modify ens33 ipv6.method ignore ipv4.dns-priority 10 ipv4.dns-search wte93c2a9
#nmcli connection modify ens37 ipv6.method ignore ipv4.dns-priority 100 ipv4.dns-search wte93c2a9
#EOF
else
echo "openBase.docker already exists Delete it to regenerate. Using existing file..."
fi
if [ "$1" == "container" ] ; then
docker build -t openbase -f openBase.docker .
fi
# Example container creation command:
# docker run -d --name openIMAGE -p 24:22 --mount type=bind,source="$(pwd)",target=/keys openIMAGEimg
docker image ls
exit
fi
