I had similar problems. It turned out that their stuff makes a number of assumptions which are invalid on most sanely configured Linux systems. In particular,
1) when it opens a terminal emulator window and asks for root password it does so in order to make
ncsvc setuid root. However most people mount home directories with nosuid option so setuid binaries don't work there
2)
ncsvc, having established a VPN connection, attempts to configure
/etc/resolv.conf to point at the new nameserver, and save a backup copy in
/tmp/resolv.conf doing rename() which doesn't work across filesystems. Most modern distros configure /tmp to be on a separate filesystem so this fails too.
The solution I used:
1) open ncsvc (found somewhere under
~/.juniper_networks) with your favorite editor capable of binary editing and replace
/tmp/resolv.conf with something of the same length but under /etc, say,
/etc/resolv.conx2) figure out the realm you want to connect to. For that you can connect to the login page of your web service with your browser and view the page source (or just do
curl -kL https://your.web.service/); the html code contains
<input type="hidden" name="realm" value="your_realm">
.
3) obtain the ssl server certificate in DER format. For that you can do
openssl s_client -connect your.web.service:443 -showcerts < /dev/null 2> /dev/null |
openssl x509 -outform der > cert.der
Now you've got all you need. So go ahead and run as
root:
ncsvc -h your.web.service -u your_user -p your_pass -r your_realm -f your_cert.der
P.S. You also need to make sure that you have
tun driver loaded.
