Sysadmin's World

A Fix for Checkpoint SecureClient VPN on Mac OS X 10.6 Snow Leopard

Posted on 03 September 2009

We all remember, once Leopard was out it took Checkpoint quite a long time to update their VPN client. Now Snow Leopard is out and it begins …

After installing Snow Leopard, Checkpoints SecureClient refuses to install and if already installed (through an upgrade) it won’t start at all.

I did some investigation and I finaly made it working since Apple hasn’t changed too much.

1. The Checkpoint installer refuses to install

The installer checks up for the Darwin Kernel version 9. In Snow Leopard we have version 10. So two files need to be edit within the installer package.

1. just right click on the installer and select Show Package Contents. This opens finder within the package.
2. go to Contents/Resources.
3. open TextEdit, use vi in a shell or whatever you prefer to edit a simple file
4. on file “InstallationCheck” change the number 9 in line 8 to number 10: if  [ "$MAJOR" != "10" ]; then
5. same on file “postinstall “ change the number 9 in line 84 to number 10

That’s it. Just install it and reboot. Changes need to make afterwards in order to have it starting.

2. SecureClient fails to start

Now this gets just a bit more tricky. Apple has moved some options of kextload to kextutil in 10.6. Checkpoint hardcoded such an option -s in two binary files. This option is to create the symbol files in the Checkpoint directory. It  does not exist anymore in kextload, and is now provided in kextutil. But creating the symbol files is only needed for debug reasons, so not really necessary. Therefore I only replaced the option -s with option -r to fill up the space, because the binary file should not change in size. Two binary files have to be changed with an hexeditor.

Preparation:

• Download and install a hexeditor. 0xED is one of it.
• After inserting the first command, it will ask you for your local user password (User needs Administrator permission)

1. Open the terminal application from Utilities folder and type:.
   sudo cp /opt/CPsrsc-50/bin/StartupItemsMgr $HOME/Desktop
   sudo cp /opt/CPsrsc-50/boot/SecureClient/SecureClientStarter /$HOME/Desktop
   sudo chown $USER /$HOME/Desktop/StartupItemsMgr
   sudo chown $USER /$HOME/Desktop/SecureClientStarter

2. Now run 0xED and choose File/Open Files from the Menu to load the StartupItemsMgr and SecureClientStarter from your Desktop in it.
3. From Menu Edit choose Find/Find or just press Apple-F and type in to find: “kextload -s” and type in replace “kextload -r”
   Click on Replace All
   
   Save and close …
4. Now once you succeeded editing copy those back by typing in the terminal window:
   sudo cp $HOME/Desktop/StartupItemsMgr /opt/CPsrsc-50/bin/
   sudo cp $HOME/Desktop/SecureClientStarter /opt/CPsrsc-50/boot/SecureClient/
   rm $HOME/Desktop/StartupItemsMgr
   rm $HOME/Desktop/SecureClientStarter
5. Reboot and you should have SecureClient starting …

I also succeeded by doing all the changes on the installer package. Probably only interesting if you have a few Macs to install. As  soon as I have a bit more time I could write it down here.

Please let me know if this did help.

PS: There is an EarlyAvailable Version for Snow Leopard (32bit) by now. It won’t need all these steps and even more some small issues are solved in there. You can apply to the EA Program and could get the download almost immediately with a vaild support contract.