topic Re: MAC: Prevent Remote Access VPN client to start on login in General Topics

MAC: Prevent Remote Access VPN client to start on login

bpistone — Mon, 23 Nov 2020 11:55:19 GMT

Hi, I need to prevent to start the client when I turn on my mac. I've already tried all the proposed solutions found on Google but they are not working.

It's incredible that there is a deamon that boot automatically on the start. Please give me a solution because I have serious problems with other working tools.

I've tried to modify the scripts /Library/LaunchDaemons/com.checkpoint.epc.service.plist and /Library/LaunchAgents/com.checkpoint.eps.gui.plist by putting

<key>RunAtLoad</key>
<false/>

but it doesn't work on mac os Catalina.

Please give me a solution! Thank you

Re: MAC: Prevent Remote Access VPN client to start on login

JackPrendergast — Mon, 23 Nov 2020 20:12:52 GMT

I presume you have taken it out of your login options under your User account, right?

Re: MAC: Prevent Remote Access VPN client to start on login

JackPrendergast — Mon, 23 Nov 2020 20:15:46 GMT

Also, you checked /Library/LaunchAgents ?

Re: MAC: Prevent Remote Access VPN client to start on login

PhoneBoy — Tue, 24 Nov 2020 03:05:55 GMT

Pretty sure it’s the kernel module that’s blocking traffic, not a user process.
This was discussed here: https://community.checkpoint.com/t5/Remote-Access-VPN/MacOS-EPS-Standalone-Client-VPN-client-Block-All-Incoming/m-p/81480

Re: MAC: Prevent Remote Access VPN client to start on login

_Val_ — Tue, 24 Nov 2020 07:31:02 GMT

You cannot do that. Some essential client components are loaded with system, not user, permissions. However, you can offload and re-load the client with cpstop.sh and cpstart.sh scripts, ran by sudo. Of course, you should have full admin permissions to do so.

Important: this is highly not recommended, as unloading the client leaves you completely unprotected.

Re: MAC: Prevent Remote Access VPN client to start on login

bpistone — Tue, 24 Nov 2020 08:18:27 GMT

I checked both /Library/LaunchDaemons/com.checkpoint.epc.service.plist and /Library/LaunchAgents/com.checkpoint.eps.gui.plist

Re: MAC: Prevent Remote Access VPN client to start on login

bpistone — Tue, 24 Nov 2020 08:22:26 GMT

Hi, I've to use the client for only connecting to a customer vpn. In my opinion, this type of approach is too much aggressive, I should have the possibility to load and unload the client in an easy way.

About the scripts that you mentioned (cpstart.sh nad cpstop.sh), where I can find them?

Really there isn't a more user friendly way to launch the client only when I need?

Thank you.

Re: MAC: Prevent Remote Access VPN client to start on login

_Val_ — Tue, 24 Nov 2020 08:37:36 GMT

We do not have lightweight VPN only client for Mac, AFAIK. EPS package includes FDE, FW, malware protection, emulation, anti-ransomware, and more. Most of this components require system level access.

You may want to try SNX/Mobile Portal option instead.

The mentioned scripts and more, they are under Library, Application Support, in the client package folder. If you do not know where it is, you probably should not poke around.

Once more, I emphasise, off-loading and re-loading components is a very bad security practice, and I would urge you not to do that on production machines.

Re: MAC: Prevent Remote Access VPN client to start on login

G_W_Albrecht — Tue, 24 Nov 2020 09:18:58 GMT

The Shutdown Client command from the Menu does not help ?

It will unload it until next reboot...

Re: MAC: Prevent Remote Access VPN client to start on login

PhoneBoy — Tue, 24 Nov 2020 18:37:49 GMT

As I noted in the thread I linked, the Mac VPN client is intended—and licensed—as a full Endpoint client.
This Desktop Firewall is a mandatory component of this that cannot be removed.
The only other option on the Mac without the firewall is SNX + Mobile Access Blade or to manually run the stop/start script referenced.