MAC: Prevent Remote Access VPN client to start on login

[bpistone]

Hi, I need to prevent to start the client when I turn on my mac. I've already tried all the proposed solutions found on Google but they are not working.

It's incredible that there is a deamon that boot automatically on the start. Please give me a solution because I have serious problems with other working tools.

I've tried to modify the scripts /Library/LaunchDaemons/com.checkpoint.epc.service.plist and /Library/LaunchAgents/com.checkpoint.eps.gui.plist by putting

<key>RunAtLoad</key>
<false/>

but it doesn't work on mac os Catalina.

Please give me a solution! Thank you

[JackPrendergast]

I presume you have taken it out of your login options under your User account, right? 

[JackPrendergast]

Also, you checked /Library/LaunchAgents ? 

[bpistone]

I checked both /Library/LaunchDaemons/com.checkpoint.epc.service.plist and /Library/LaunchAgents/com.checkpoint.eps.gui.plist

[PhoneBoy]

Pretty sure it’s the kernel module that’s blocking traffic, not a user process.
This was discussed here: https://community.checkpoint.com/t5/Remote-Access-VPN/MacOS-EPS-Standalone-Client-VPN-client-Block-A...

[_Val_]

You cannot do that. Some essential client components are loaded with system, not user, permissions. However, you can offload and re-load the client with cpstop.sh and cpstart.sh scripts, ran by sudo. Of course, you should have full admin permissions to do so.

Important: this is highly not recommended, as unloading the client leaves you completely unprotected.

[bpistone]

Hi, I've to use the client for only connecting to a customer vpn. In my opinion, this type of approach is too much aggressive, I should have the possibility to load and unload the client in an easy way.

About the scripts that you mentioned (cpstart.sh nad cpstop.sh), where I can find them?

Really there isn't a more user friendly way to launch the client only when I need?

Thank you.

[_Val_]

We do not have lightweight VPN only client for Mac, AFAIK. EPS package includes FDE, FW, malware protection, emulation, anti-ransomware, and more. Most of this components require system level access.

You may want to try SNX/Mobile Portal option instead. 

The mentioned scripts and more, they are under Library, Application Support, in the client package folder. If you do not know where it is, you probably should not poke around.

Once more, I emphasise, off-loading and re-loading components is a very bad security practice, and I would urge you not to do that on production machines.

[G_W_Albrecht]

The Shutdown Client command from the Menu does not help ?

It will unload it until next reboot...

[PhoneBoy]

As I noted in the thread I linked, the Mac VPN client is intended—and licensed—as a full Endpoint client.
This Desktop Firewall is a mandatory component of this that cannot be removed.
The only other option on the Mac without the firewall is SNX + Mobile Access Blade or to manually run the stop/start script referenced.