FortiClient VPN-only

[rneher-igel]

FortiClient VPN-only

https://www.fortinet.com/support/product-downloads

[rneher-igel]

foriclient.service

[Unit]
Description=Forticlient Scheduler
Requires=dbus.service
Wants=dbus.service
After=dbus.service

[Service]
Type=simple
ExecStart=/opt/forticlient/fctsched
User=root
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=5
StartLimitInterval=300
StartLimitBurst=30
KillMode=mixed

[Install]
WantedBy=multi-user.target

[rneher-igel]

Desktop

# cat opt/forticlient/Fortitray.desktop

[Desktop Entry]
Type=Application
Name=Fortitray
Exec=/opt/forticlient/fortitraylauncher
NoDisplay=true
Terminal=false  

# cat usr/share/applications/forticlient.desktop 

[Desktop Entry]
Version=1.0
Name=FortiClient
GenericName=Security Software
Comment=Endpoint Protection Suite
Exec=/opt/forticlient/gui/FortiClient
Icon=forticlient
Type=Application
Terminal=false
Categories=Utility;

# cat usr/share/applications/forticlient-register.desktop 

[Desktop Entry]
Name=Register with FortiClient
Exec=/opt/forticlient/gui/FortiClient %u
Type=Application
NoDisplay=true
Categories=System;
MimeType=x-scheme-handler/fabricagent;

[rneher-igel]

postinst

#!/bin/bash

arg=$@
if [ "$arg" = "abort-remove" ]; then
    exit 0
fi

FCT_INSTALL_DIR=/opt/forticlient
FCT_CONFIG_DIR=/etc/forticlient
FCT_DATA_DIR=/var/lib/forticlient
FCT_TMP_DIR=/tmp/.forticlient
FCT_RUN_DIR=/var/run/forticlient

# Generate bash completion for cli
/opt/forticlient/forticlient-cli completion bash > /etc/bash_completion.d/fct_cli_autocomplete

# Remove older version directories and files when upgrading
if [ -d /usr/bin/forticlient ]; then
    pkill -f /usr/bin/forticlient
    rm -rf /usr/bin/forticlient
fi

# Remove old tcp error db
rm -rf $FCT_RUN_DIR/tcp-error.db

# Remove old configuration files when upgrading from older versions
rm -rf $FCT_CONFIG_DIR/config.xml
rm -rf $FCT_CONFIG_DIR/config_backup.xml

# Remove old pid lock
rm -rf $FCT_TMP_DIR/fortivpn.pid

if [ -f $FCT_INSTALL_DIR/Fortitray.desktop ]; then
    ln -sf $FCT_INSTALL_DIR/Fortitray.desktop /etc/xdg/autostart/Fortitray.desktop
fi

# We are no longer using tpm2-pkcs11 library
rm -rf $FCT_INSTALL_DIR/tpm2_pkcs11.sqlite3

# Also delete any old ZTNA certs
rm -rf $FCT_INSTALL_DIR/ems_ca.crt
rm -rf $FCT_INSTALL_DIR/ems_cert.crt

if [ -f $FCT_INSTALL_DIR/.repackaged ]; then
    # Restore permissions to all files
    if [ -f $FCT_INSTALL_DIR/.acl ]; then
        (cd / && setfacl --restore $FCT_INSTALL_DIR/.acl)
    fi

    # Repackaged installers mess up the symlinks in the tpm2 binaries, we'll need to restore these
    if [ -f $FCT_INSTALL_DIR/tpm2/bin/tpm2 ]; then
        for f in $(find $FCT_INSTALL_DIR/tpm2/bin -name tpm2_* -type f); do
            ln -sf $FCT_INSTALL_DIR/tpm2/bin/tpm2 "$f"
        done
    fi

    # Mark deployment installation as complete
    if [ -f $FCT_DATA_DIR/deploy/.deploying ]; then
        touch $FCT_DATA_DIR/deploy/.deploy_complete
    fi
fi

if [ -f $FCT_CONFIG_DIR/servers.conf ]; then
    chmod 600 $FCT_CONFIG_DIR/servers.conf
fi

# Keep old database when upgrading from older versions
if [ ! -d $FCT_DATA_DIR ] || [ ! -O $FCT_DATA_DIR ]; then
    rm -rf $FCT_DATA_DIR
    mkdir -m 755 $FCT_DATA_DIR
fi

if [ -f $FCT_CONFIG_DIR/config.db ]; then
    if [ -O $FCT_CONFIG_DIR/config.db ]; then
        mv $FCT_CONFIG_DIR/config.db $FCT_DATA_DIR/config.db
    else
        # Old database cannot be trusted and should be replaced
        # So ems connection info is lost and fct has to register to ems again
        rm -f $FCT_CONFIG_DIR/config.db $FCT_INSTALL_DIR/.fct_ec_registered
    fi
fi

if [ ! -f $FCT_DATA_DIR/config.db ]; then
    cp $FCT_INSTALL_DIR/.config.db.init $FCT_DATA_DIR/config.db
fi

chmod 600 $FCT_DATA_DIR/config.db

# Create CLI symlink to launch from terminal
if [ -f $FCT_INSTALL_DIR/forticlient-cli ]; then
    ln -sf $FCT_INSTALL_DIR/forticlient-cli /usr/bin/forticlient
fi

# Launch fortitray
if [ -f $FCT_INSTALL_DIR/fortitraylauncher ]; then
    if [ ! -z "$(logname 2>/dev/null)" ]; then
        user="$(logname 2>/dev/null)"
    elif [ ! -z "$SUDO_USER" ]; then
        user="$SUDO_USER"
    else
        user=$(users 2>/dev/null | cut -d ' ' -f1)
    fi

    GUI_ENV=
    # fortitray has gtk-2 dependency which relies on X11. on newer linux
    # distros, they migrated to wayland from X11, so dbus-daemon may not have
    # appropriate environment variables for display. In case it's running on
    # system with wayland, try to get environment variables from Xwayland,
    # compatability layer for X11.
    PID_ENVIRON=$(pgrep -u $user Xwayland | head -n 1)
    if [ -z "$PID_ENVIRON" ]; then
        for p in $(pgrep -u "$user" dbus-daemon); do
            if [ -z "$(xargs -0 -L1 -a /proc/$p/cmdline | grep '^--config-file=')" ]; then
                continue
            fi

            PID_ENVIRON=$p
            break
        done
    fi

    if [ -n "$PID_ENVIRON" ]; then
        OIFS="$IFS"
        IFS=$'\n'
        for e in $(xargs -0 -L1 -a /proc/$PID_ENVIRON/environ); do
            IFS== read -r left right <<< "$e"
            GUI_ENV="$GUI_ENV $left=\"$right\""
        done
        IFS="$OIFS"

    fi

    FORTITRAY_CMD="env -i $GUI_ENV setsid $FCT_INSTALL_DIR/fortitraylauncher &>/dev/null &"

    # Start fortitraylauncher while forwarding environment variables needed by Fortitray
    su $user -c "$FORTITRAY_CMD"

    echo =====================================================================
    echo If fortitray is not auto-started,
    echo try running /opt/forticlient/start-fortitray-launcher.sh as non-root.
    echo =====================================================================
fi

# Update icons cache so icon will show correctly
if [ -f /usr/share/icons/hicolor/48x48/apps/forticlient.png ]; then
    gtk-update-icon-cache -f /usr/share/icons/hicolor || true
fi

# Setup forticlient protocol handler
if [ -f /usr/share/applications/forticlient-register.desktop ]; then
    update-desktop-database
fi

# Remove ZTNA browser certificates installed by old FCT installation
if [ -f /usr/bin/certutil ]; then
    PASSWD_USERS=$(awk -F':' '!a[$6]++ {print $6}' /etc/passwd)
    # ldap managed users did not appear in passwd, get their home directory
    # from home folder
    HOME_USERS=$(ls -d /home/* 2>/dev/null)
    COMBINED_USERS=$(echo -e "$PASSWD_USERS\n$HOME_USERS" | sort -u)
    for hp in $COMBINED_USERS; do
        if [ ! -d $hp ]; then
            continue
        fi

        DIRS=($hp/.mozilla/firefox/*.default $hp/.mozilla/firefox/*.default-release $hp/.pki/nssdb)
        for p in ${DIRS[@]}; do
            if [ ! -d "$p" ]; then
                continue
            fi

            RUN_USER=$(stat -c '%U' "$p")
            if [ $? -ne 0 ]; then
                continue
            fi

            su - "$RUN_USER" -c '/usr/bin/certutil -D -n "FortiClient ZTNA" -d sql:'"$p"' 2>/dev/null || true'
            su - "$RUN_USER" -c '/usr/bin/modutil -delete "FortiClient ZTNA" -dbdir sql:'"$p"' -force 2>/dev/null || true'
        done
    done
fi

# Automatically added by dh_systemd_enable
# This will only remove masks created by d-s-h on package removal.
deb-systemd-helper unmask forticlient.service >/dev/null || true

# was-enabled defaults to true, so new installations run enable.
if deb-systemd-helper --quiet was-enabled forticlient.service; then
	# Enables the unit on first installation, creates new
	# symlinks on upgrades if the unit file has changed.
	deb-systemd-helper enable forticlient.service >/dev/null || true
else
	# Update the statefile to add new symlinks (if any), which need to be
	# cleaned up on purge. Also remove old symlinks.
	deb-systemd-helper update-state forticlient.service >/dev/null || true
fi
# End automatically added section
# Automatically added by dh_systemd_start
if [ -d /run/systemd/system ]; then
	systemctl --system daemon-reload >/dev/null || true
	deb-systemd-invoke start forticlient.service >/dev/null || true
fi
# End automatically added section