Title: Fedora 44 KDE + Cisco Secure Client: “VPN establishment capability
for a remote user is disabled” — root cause and workaround
TL;DR: On Fedora 44 KDE (Plasma Login Manager), graphical sessions have
no utmp record. Cisco Secure Client decides “local vs remote user” by reading
utmp, finds no local login, and refuses to connect when the VPN profile sets
LinuxVPNEstablishment: LocalUsersOnly. Workaround: log into a spare TTY.
Environment: Fedora 44 KDE (plasmalogin, the new F44 default,
plasma-login-manager-6.6.5-1.fc44), Cisco Secure Client 5.1.16.194,
university VPN (ASA 9.22) whose pushed profile contains
<LinuxVPNEstablishment>LocalUsersOnly</LinuxVPNEstablishment>.
Symptom: Authentication succeeds, the tunnel establishes, then the client
immediately kills it. GUI shows “VPN establishment capability for a remote
user is disabled.” journalctl shows:
csc_vpnagent: Termination reason code 26: Profile settings do not allow
VPN establishment by a remote user.
Root cause (verified): The client scans utmp for a console-style login to
decide whether a local user is present. Under Plasma Login Manager, the
graphical session writes no utmp USER_PROCESS record:
$ utmpdump /run/utmp # graphical session active, no TTY login
[2] ... [reboot]
[7] ... [user] [pts/0] [:0] <- terminal windows only
[7] ... [user] [pts/2] [ ]
(no record for the graphical session at all)
Do not verify this with who — on Fedora 44, who shows the session
anyway (it reads systemd-logind, not utmp). Use utmpdump /run/utmp.
Workaround: Log into a text console once per boot: Ctrl+Alt+F3, log in,
Ctrl+Alt+F2 back to Plasma. Connect normally. This writes a classic utmp
record the client recognizes. Exactly one TTY login — a second one trips
the profile’s SingleLocalLogon rule. Security note: that console stays logged
in; exit it before leaving the machine unattended in public (the Plasma
lock screen does not lock TTYs).
Open question: Is the missing utmp registration intentional in Plasma
Login Manager (utmp is being deprecated) or a regression vs SDDM?
KDE bug link:
(Diagnosed with the help of Claude’s Fable 5 at max effort, every step above was run and
verified by hand on my machine.)