topic Re: Custom HIP Check for Linux in General Topics

Custom HIP Check for Linux

Paul_Lupini — Mon, 13 Aug 2018 16:58:31 GMT

Hey guys,

I've been tasked to have Globalprotect only allow company owned devices over the VPN. I know I can create custom HIP checks for Windows/Mac (reg/plist value). How would I do the same for Linux clients?

I have two end users that work remote, and are on a Linux machine. Still having issues with getting the GlobalProtect client for linux to work properly. VNC with IPSec is how they currently connect, and it works fine. I'm only on version 4.1.2, and am working on upgrading to 4.1.4 in hopes it corrects my problem.

The problem I'm having with the Linux client is that it fails because it doesn't trust the server certificate. However, when you navigate to the portal there is no certificate error.

Linux client problems aside... I'm trying to find the best answer to meet this initiative -> Only allow our devices on the VPN

Is the HIP check the best/easiest answer, or should I be looking elsewhere?

Thanks for all your help,

Paul

Re: Custom HIP Check for Linux

BPry — Mon, 13 Aug 2018 18:27:50 GMT

@Paul_Lupini,

You could query 'dnsdomainname' and verify that the output matches your domain; this would at least ensure that the linux machine is joined to your AD. Just keep in mind that there really isn't anything stopping a user from doing a domain join on a different linux machine as long as they have a user within your domain unless you have restricted those permissions. Most enviroments seem to forget that by default users have the ability to do a domain join operation.

Re: Custom HIP Check for Linux

Paul_Lupini — Mon, 13 Aug 2018 18:36:54 GMT

That's what I was thinking of as well. The two users are using Mint 18 Cinnamon. Mint isn't recognizing dnsdomainname, but does respond with domainname though it reports none. However, I can run realm list and see the domain.