How auto-login works

Most institutional VPNs built on Cisco AnyConnect / Cisco Secure Client require two factors to log in:

1. A username + password.
2. A 6-digit TOTP code, usually the same code you'd read off Google Authenticator, Authy, iCloud Keychain, or Microsoft Authenticator.

This repo was written against HKU's vpn2fa.hku.hk, but the approach generalizes to any similarly-configured gateway.

The TOTP code is not magic

That code is just HMAC-SHA1(secret, current_time_step) truncated to 6 digits. Once you have extracted the Base32 secret used to seed your authenticator (usually shown as text or a QR code during 2FA enrollment), you can compute the same code yourself and drive the whole login non-interactively:

• On Unix (macOS / Linux): oathtool --totp -b "$SECRET"
• On Windows: the totp-go CLI, totp-go "$SECRET"

Protect this secret like a password

Anyone who has it can generate valid 2FA codes for your account indefinitely. It does not rotate or expire the way a single OTP code does.

Never commit a config file that contains your real secret, password, or username to a public (or even private, shared) repository. The config.bat / config.sh files in this repo are templates with placeholder values only. Fill in your real details locally and keep that change out of git.

Pick a path

You want	Use
The official client, one command / one double-click to connect	Cisco CLI on macOS / Linux or Windows
Only some apps through the VPN, or chain it with another proxy	OpenConnect in Docker, SOCKS5 on port 1080

Mobile

• iOS: no full automation is possible. At most you can auto-fill the TOTP code via the Passwords / Authenticator autofill integration.
• Android: not investigated in this repo.

Repository layout

.
├── Cisco/
│   ├── unix/
│   │   ├── cisco-vpn.sh          # connect/disconnect via oathtool + `vpn -s` scripted stdin
│   │   ├── config.sh             # your VPN host/username/password/TOTP secret (template)
│   │   └── install.sh            # one-line installer (curl | bash)
│   └── win/
│       ├── cisco-vpn.bat         # double-click entry point; calls totp-go and writes the scripted vpncli.exe input
│       ├── config.bat            # your VPN host/username/password/TOTP secret (template, same names as unix)
│       ├── icon/                 # connect.ico / disconnect.ico used by desktop shortcuts
│       └── install.ps1           # one-line installer, also installs totp-go and offers desktop shortcuts (irm | iex)
└── Openconnect/
    ├── openconnect-setup.sh       # OpenConnect + microsocks Docker setup (lighter)
    └── openconnect-gost-setup.sh  # OpenConnect + gost Docker setup (more proxy features)