You may recall me noting that the Chromebook has been Amazon's top selling laptop for the whole of Q4 2012. There are now a lot of Chromebooks out there - so what can we do with them? Let's see...
Enter Developer Mode
Conveniently, Chromebooks have a developer mode, which lets you bypass all the normal checks and balances that Google use to ensure that rogue software does not run on ChromeOS devices. After you have switched into developer mode your Chromebook will run whatever you want it to, and you can open up a Linux shell in a browser tab (Chromebooks are running a cut down Linux distribution after all) simply by hitting Ctrl-Alt-T.
This is important to me with my IT manager's hat on, because there are still a few rough edges to the ChromeOS product that make it awkward in my environment. Two particular bugbears for me are that we use the Cisco AnyConnect VPN system and VMware View for our Virtual Desktop Environment for legacy Windows apps. Both of these are supported by open source clients, but these haven't been integrated with ChromiumOS yet.
There are also the fun and profit elements, of course... If you have hacker tendencies, then hopefully this post will give you some interesting insights along the former theme. See the end of this post for more on the latter.
Now, how do we get the OpenConnect package onto our Chromebook, to provide a free workalike for Cisco's AnyConnect? (Cisco also have a packaged Linux client, but if we can make the open source client work then it is more likely to be embedded in ChromiumOS and thence ChromeOS)
Crouton to the Rescue
Google's Dave Schneider has helpfully produced Crouton, the "Chromium OS Ubuntu Chroot Environment" (there are other examples out there using Tinycore and Arch Linux), which lets us run a full copy of Ubuntu Linux via chroot. It's absolutely trivial to install, although you should note that the Chromebook's Aura window manager doesn't know what to do with windows spawned by random applications - hence Dave recommends that you start a new X session with a conventional window manager/desktop like Xfce.
So now we can enter our chroot environment (which is actually encrypted by default, using a key requested from the user as part of the Crouton setup process - so perhaps not as insecure as I may have implied), and start installing and even building packages just as we would on a normal Ubuntu Linux distribution. However, many Chromebooks come with quite small SSDs, so watch out when pulling in additional software!
Here we are adding some useful additional packages to our test Chromebook using apt-get, just as we might on any other Ubuntu system...
OpenConnect
Now, we can install OpenConnect in a similar fashion - in fact, we'll need to apt-get install openconnect uml-utilities in order to also get a tunnel device management utility we need called tunctl. However, note that there is a little fancy footwork involved in actually using OpenConnect, because our chroot environment is essentially an entire Linux filesystem - with its own /etc, and so on and so forth. We may be happy running OpenConnect inside the chroot environment, but for eventual integration with the core product it will need to be able to run in the "host" ChromiumOS too.
Now we can create tunnel devices to use for the VPN tunnel back to base, like so:
In my testing I sometimes found that I had to create not just tun0, but also tun1, and then OpenConnect would magically create and use tun2 for me, like so:
This merits some further investigation...
However, the upshot is that we can now happily make a VPN connection back to our home institution using OpenConnect:
The vpnc-script file is a separate download, and consists of some code which tries to manage your /etc/resolv.conf (DNS resolver details) and default route automatically. This is a bit of a mixed bag under Crouton because we have two copies of a number of interesting files such as resolv.conf, and in practice you might need to zap your old default route like so:
root@localhost:~# route del -net default gw 192.168.1.1
...and manually update your /etc/resolv.conf. However, now you are VPNing:
(for a non-VPN connection this traceroute would normally include multiple ISP and JANET routers)
VMware View
VMware have helpfully led the VMware View Open Client project, which has released a nice open source VMware View client package that we can use. Installing it is simply a matter of apt-get install vmware-view-open-client. However, if you try to use it from a Linux shell running inside Chrome (rather than a separate X session for Ubuntu) you will see a message in your log file to the effect that:
This is because your chroot'd Ubuntu session doesn't know about the X session that you are running. You can fix this by setting $DISPLAY in your environment:
...but you will also need to open up a non-chroot Linux shell session and give yourself permission to connect to the X server, e.g. via xhost or .Xauthority:
Success! (as shown below...) However, your VMware View session will by default take over the entire display (remember my comment about Aura not managing windows from apps that it doesn't know about), and is a little messy to shut down again afterwards. This is where a separate dedicated X session for Ubuntu would be a lot simpler.
Wrapping Up
So, with a little bit of hacking we have taken our £199 device (actually my experiments have been with the old Samsung Series 5 Chromebook that I was given by Google a while ago) and a) turned it into a general purpose Linux box, b) integrated our corporate VPN, and c) integrated our legacy Windows apps via VMware View. OK, so it's a little rough around the edges, but these are solveable problems.
To make the additional OpenConnect and VMware View Open Client packages more properly part of ChromiumOS (so that we could avoid having to hack things around) there are probably quite a few dependencies around library versions that would need to be resolved. But what actually are they? Well...
If you don't mind twisting your brain a little, you can experiment with merging the chroot environment and the normal ChromeOS Linux environment through tweaking the $LD_LIBRARY_PATH environment variable, which governs where Linux picks up its shared liibraries from. The key point here is that /usr/local/chroots/precise directory I referenced above. This is the root of the chroot filesystem.
We could create a file somewhere that contained the necessary shell commands to prep our environment to use the library files on the chroot side, as shown in the screenshot below...
The Profit Bit
Remember that £199 laptop. Perhaps you thought that it was in some way less of a computer by virtue of being "underpowered" and so on, and incompatible with your enterprise software and systems. In this post I have shown you how it could be quite a nifty thin client to your corporate virtual desktop service, or a full Linux box in its own right. And these things were already flying off the shelves because normal people (not geeks reading blog posts about Linux hacking ;-) were happy to spend £199 on a laptop that would "only browse the web".
I hope we will see OpenConnect and VMware View Open Client properly integrated with ChromeOS, and that this blog post has provided a few pointers in the right direction. My ideal scenario would be to open remote VMware apps or a full desktop as a Chrome tab, like we can with the Linux shell sessions. Why? Imagine if we could make web links to all our key student software available as part of our Virtual Learning Environment - click and Matlab appears in a browser tab, for any of our students, anywhere in the world. That's the money shot :-)
[Update August 2015: Cisco have just released an early adopter preview of their AnyConnect VPN client for ChromeOS, available from the Chrome Web Store]
No comments:
Post a Comment