Softethervpn: windows installer: no silent install /S for automatic deployment

[dreamcat4]

Hi,
It seems here:

http://www.softether-download.com/files/softether/v4.19-9599-beta-2015.10.19-tree/Windows/SoftEther_VPN_Client/

and here:

http://www.softether-download.com/files/softether/v4.19-9599-beta-2015.10.19-tree/Windows/SoftEther_VPN_Server_and_VPN_Bridge/

Your windows installer .exe is not possible without GUI interaction, for scripted silent deployment. And there is no .zip alternative either.

Wheras the Manager is a .zip. Please fix / rectify.

[dreamcat4]

I check your installer's source code at:

https://github.com/SoftEtherVPN/SoftEtherVPN/tree/master/src/vpninstall

However do not find / see and argv[] argument parsing or handling. It does mention .INF file though there is no example anywhere how it might be used with local .INF file to bypass the GUI selectio screens.

[dreamcat4]

@dnobori please take a look if you can. Otherwise no chocolatey windows pkg / easy install (not possible).

[dreamcat4]

@dnobori Can you please look / comment on this issue? It would help for the popularity and adoption of your software if users could just choco install softethervpn, or your pkg. That is the reason why it's worthwhile to expend effort in making a _silent_ installer (no user interaction).

Many thanks.

[elliot-huffman]

An MSI variant would be awesome.
That would allow GPO based deployment.

An exe version that supports silent options would be good for SCCM/MDT based deployments but MSI would be ideal.
The auto installer should include options for generating these client deployment packages.

Thanks!

[chipitsine]

another (good) enterprise task

[chipitsine]

as a side note (I was running pretty big vpn installation for 5+ years), I have a question - for example, you deployed MSI using GPO. ok. How to deal with "road warriors" ? i.e. people who use own devices to connect to vpn ? no GPO, nothing.

from that point of view, GPO is not very usefull (but I would to hear that I'm wrong)

[chipitsine]

what I think is really more usefull is chocolatey or oneget package

[elliot-huffman]

You could put the VPN installer on a internet routed system, like Office 365 sharepoint. You could manage access to the installer from the ACLs in the cloud.
You could also use a security exception. In tandem with the manual install. To allow cert enrollment and GPOs for MFA and what not.
Security exceptions are time bombed security groups.

Also you design your corp image to have it pre deployed in the corp image.
That eliminates the majority of deployment while remote issues with GPO.

GPO is used for more than just deployment, you can use it for patch management, access management and software removal.
MSI packages fit perfectly into almost all of those scenarios. Look at Applocker.

Heck, if you support all automation deployment types, that would be Awesome, that will increase your user base faster.
For my side of things, I try to minimise 3rd party software and try to keep it pure. Microsoft solutions as much as possible (RRAS/AlwaysOnVPN failed me so I ended up here).
As the more moving parts the more likely there is going to be a security issue with one of them.

[chipitsine]

as for myself, I doubt about GPO/Applocker (we use it actually).

however, SE VPN would definetely like to learn something from you. do you have some best practice to share ? wiki / md / rst ?

[elliot-huffman]

When I have time, I will create a PR.
Overview:
Use some sort of MFA,
Control access via group membership instead of per user permissions.
Don't use insecure protocols.

[checkin247]

Any updates on the possibility of a silent installer?
I'd prefer using softether client on windows but need to be able to create a chocolatey package (which is easy to build with an install.msi /s).
Surprised not more people asking for this.

[KuzloPavlo]

Any news about silent installer?

[checkin247]

@KuzloPavlo
I realized silent installation with scripting a chocolatey package.
The virtual adapter and vpn configuration setup can be scripted in there as well.
If you want to run the client in the background without gui, you can create a nssm service for vpncmgr_x64.exe .
If you are interested on that approach, I could share the installer script for chocolatey, you would have to built the package (choco build).

If the project team is interested, I'd be happy to provide the choco package for official distribution.

[chipitsine]

@checkin247 , official choco distribution would be perfect

[checkin247]

@chipitsine
How do you want me to send it to you?
The entire package (with embedded zip archive) is about 40MB?
It would also be possible to modify the installer to use official download url, for our purpose it was easier to deploy with embedded archive .

[chipitsine]

any file sharing service is nice. I do not have special preferences

[checkin247]

@chipitsine
sent by email

[chipitsine]

gmail occasionely put it to spam.
I'll have a look and reply

thank you for your efforts!

[silvanet123]

@checkin247 I would be interested in your choco scripts. Would you mind emailing me as well

[guilhermecugler]

nssm service

@checkin247 can you send me to?

[cnause]

Hello Thomas (@checkin247),

I'm as well interested pretty much. I'm wondering when a silent installation via setup or as chocolatey package finds a place into the official repository. I guess that this feature would be helpful for many admins (like me). If you would need test support, I'm happy to support

Christian

[checkin247]

@guilhermecugler @cnause
I made a self contained package for "my own purpose". I don't think I am allowed to redistribute that package.
If anyone can proof me wrong, I am willing to share.
Also, the package would need to be updated to reflect the latest softether version.

For anyone interested, I can share the install script, you would have place the files yourself and run 'choco pack'.

[cnause]

@checkin247: Thanks for your message, sounds good. I think that the script itself could be shared here. There is no need to share the whole package. I would try to update the script to the latest client and server windows setups and would publish it here. The softether maintainers could maybe suggest an appropriate place in the repo

[guilhermecugler]

@checkin247

send me in [email protected] thanks :D

[cnause]

Hello @checkin247, if you don't want to publish the script here, I would be happy if you would send it to me via PM: nause at cntec dot de. Thank you, Christian

[checkin247]

For everyone interested, I put the scripts on a gist: https://gist.github.com/checkin247/df20b55f55529b70d141b4db2cf5061a

@guilhermecugler @cnause @silvanet123